Full account takeover in DjangoCRM stems from a hardcoded Django SECRET_KEY committed in webcrm/settings.py, letting anyone who reads the public GitHub repository forge session cookies (including the superadmin), CSRF tokens, and password reset tokens. The default DEBUG=True setting compounds this by exposing database, email, and OAuth credentials plus internal paths on error pages. No public exploit is identified at time of analysis, but exploitation is trivial and requires no authentication (CVSS 9.1, PR:N).
Privilege escalation in Red Hat's Multicluster Engine (MCE) for Kubernetes ClusterCurator controller allows a namespace-scoped tenant administrator to obtain cluster-wide administrative control. By creating a namespaced ClusterCurator resource, the tenant can cause the controller to mint an authentication token for a ServiceAccount holding cluster-admin authority, breaking tenant isolation. Rated CVSS 9.1 (scope-changed) by Red Hat; no public exploit identified at time of analysis and not listed in CISA KEV.
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote attacker forge SAML assertions and impersonate any user, including administrators, on deployments where SAML single sign-on is enabled. The flaw stems from improper cryptographic signature verification (CWE-347) in the SAML authentication module, yielding full identity spoofing over the network with low complexity and no user interaction. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but the 9.1 CVSS and pre-authentication admin impersonation make it a high-priority patch.
Authentication bypass in iot-ecology's rust-iot-platform lets any remote attacker reach every endpoint guarded by the AuthToken request guard simply by sending a non-empty Authorization header such as 'Authorization: fake'. The Rocket request guard in api/src/main.rs checks only for the header's presence and never validates its value against a session, token store, or signature, so unauthenticated attackers gain full access to protected API functionality. No public exploit identified at time of analysis, but the flaw is trivial to trigger and carries a CVSS 9.1.
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge SAML responses to hijack accounts when a SAML identity-provider's metadata was imported without explicit key-usage attributes, causing the keycloak-services identity-brokering engine to silently disable signature validation despite a signing certificate being present. Rated CVSS 9.1 with total technical impact per CISA SSVC, an attacker who knows a victim's external identifier can log in as that user. No public exploit identified at time of analysis, and EPSS is low (0.14%, 4th percentile), indicating the risk is currently theoretical/targeted rather than mass-exploited.
Predictable Fernet encryption keys in IBM Langflow OSS 1.0.0 through 1.10.3 allow attackers to decrypt stored API keys and authentication tokens, because when a user secret is shorter than 32 characters the platform derives keys with Python's non-cryptographic `random` (Mersenne Twister) module. Because the Mersenne Twister PRNG is deterministic, identical seeds reproduce identical keys, so an adversary who can reconstruct the seeding conditions can regenerate the key and read every secret Langflow encrypted with it. No public exploit identified at time of analysis; EPSS is low (0.11%) and CISA SSVC records no known exploitation.
OS command injection in HashBrown CMS through version 1.4.6 enables any authenticated user holding media resource scope to execute arbitrary shell commands on the server by exploiting a discrepancy between two filename-parsing functions. The MIME-type filter in getMIMEType() truncates filenames at the first '?' character - accepting 'x.jpg?$(command)' as a valid image - while Node.js Path.extname() does not truncate at '?', allowing the full malicious suffix to flow unescaped into a shell exec() call inside the thumbnail generation routine. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique is well-understood and requires only low-privilege access, making it a meaningful risk for any internet-accessible deployment.
Remote code execution on the Jenkins controller is achievable by attackers holding Agent/Connect permission via a JEP-200 deserialization filter bypass in the Remoting library (agent.jar/remoting.jar). Jenkins 2.575 and earlier, and LTS 2.568.1 and earlier, include a Remoting version (3384.v60d89463d9e0 and earlier, except the backport 3355.3357.v931d3c992987) that fails to apply the JEP-200 class filter to a fallback deserialization code path, allowing crafted serialized Java objects to reach classes on the Jenkins core classpath that are not blocked by the pre-JEP-200 denylist. No public exploit or CISA KEV listing has been identified at time of analysis, but the primitive - controller-side code execution triggered from an agent - represents a critical trust-boundary violation in Jenkins' controller-agent architecture.
Privilege escalation to cluster-admin in Red Hat Advanced Cluster Management for Kubernetes (ACM) lets a user holding only namespace-scoped 'edit' rights on an ACM hub namespace take over the entire cluster. By creating a Channel pointing to an attacker-controlled Helm repository and a Subscription referencing it, the app-subscription controller (multicluster-operators-subscription) applies the chart with its own elevated authority and without enforcing the subscription-admin role or namespace confinement, letting the chart install cluster-scoped objects such as a ClusterRoleBinding to cluster-admin. No public exploit identified at time of analysis, and EPSS is low (0.25%), but the technical impact is total and the flaw directly contradicts ACM's documented namespace-confinement guarantee.
Authentication bypass and improper access control in Cisco IOS XE Software allow a remote, unauthenticated attacker to gain unauthorized access with a scope-changing impact affecting confidentiality, integrity, and availability across affected components. The issue was discovered internally by Cisco's engineering team during a proactive security review and is grouped under CWE-284 with a CVSS base score of 9.0, though the high attack complexity (AC:H) indicates non-trivial preconditions. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Arbitrary OS command execution in IBM Langflow OSS 1.0.0 through 1.10.3 is reachable by any authenticated low-privileged user who can modify MCP server configurations. Improper validation of the command field in those configurations allows injected shell commands to be executed with the application's process privileges, yielding full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, network-accessible attack path against a growing AI-tooling platform warrants prompt patching.
Command injection in Cisco Integrated Management Controller (IMC) allows a remotely authenticated low-privileged attacker to execute arbitrary OS commands and escalate privileges to root on affected Cisco UCS Standalone servers. Exploitation requires only low-level credentials to the IMC web-based management interface - no local access, no user interaction. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and full system impact make it a meaningful priority for any environment with IMC exposed to internal or management networks.
OS command injection in IBM Langflow OSS 1.0.0 through 1.10.3 enables remote authenticated attackers to execute arbitrary system commands on the underlying server. The flaw stems from insufficient sanitization of user-supplied input passed to OS-level command execution routines (CWE-78), granting full system-level access with a single authenticated request. No public exploit code has been identified at time of analysis, and CISA does not list this in KEV, though CVSS-assessed technical impact is total across confidentiality, integrity, and availability.
Arbitrary file upload in LightSync Pro WordPress plugin (all versions through 2.1.6) enables authenticated attackers with Author-level access to upload executable files - including PHP webshells - via the unvalidated `rest_replace_media()` REST API function, with remote code execution as a realistic outcome. The root cause is CWE-434: missing file type validation on the server side, allowing any file extension to be accepted. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the CVSS score of 8.8 reflects the high post-exploitation impact given the minimal privilege bar (Author role).
OS command injection in HashBrown CMS through version 1.4.6 allows any authenticated user with project configuration access to execute arbitrary OS commands on the server by embedding shell metacharacters in the Git deployer's branch field - an attack surface left exposed by the incomplete remediation of CVE-2020-6948, which fixed single-quote injection in git clone fields but not the branch parameter in the git checkout invocation. GitDeployer.validate() blocks only single-quote characters, leaving semicolons, pipes, ampersands, backticks, and command substitution syntax freely injectable; once planted, the malicious branch value fires automatically on every subsequent deployer operation (media upload, content save) without further attacker interaction. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the attack is mechanistically trivial given the complete absence of metacharacter filtering.
Unsandboxed Twig template rendering in Bolt CMS allows any user holding an editor-level CMS role to inject arbitrary OS commands via Server-Side Template Injection (SSTI), achieving remote code execution as the web server process. The root cause is that Bolt's Twig environment never registers a SandboxExtension, so the full Twig filter chain - including dangerous filters like `passthru` - is available to content authors. The default out-of-the-box configuration of the 'pages' content type ships with `allow_twig: true`, meaning this is exploitable in a standard Bolt installation without any additional misconfiguration. No public exploit has been independently confirmed, though the CVE description includes a working payload demonstrating command execution.
Unauthenticated arbitrary file and directory deletion in GitHub Enterprise Server allows any network-reachable attacker to recursively destroy critical instance data - including Git LFS objects, release assets, issue attachments, and user avatars - by injecting a path traversal sequence into the X-GitHub-Request-Id HTTP request header. The vulnerability stems from using this header value unsanitized as a filesystem path component for an upload buffer directory; a deferred cleanup routine then recursively deletes whatever directory the traversal resolves to, including the entire user storage root. No public exploit has been identified at time of analysis and the CVE is not in the CISA KEV catalog, but the near-zero exploitation bar - no authentication, no user interaction, effective even with private mode enabled - makes this a critical priority for any organization running on-premises GitHub Enterprise Server.
Remote code execution in IBM Langflow OSS 1.0.0-1.10.3 allows authenticated remote attackers to inject and execute arbitrary Python code by crafting payloads that evade the platform's AST-based security scanning mechanism. The flaw (CWE-94, Code Injection) is particularly insidious because the defensive AST validation layer gives a false sense of protection while silently passing malicious constructs to the Python runtime. No public exploit or CISA KEV listing exists at time of analysis, but the low-complexity, fully network-accessible attack path with complete confidentiality, integrity, and availability impact warrants urgent patching - especially for any internet-exposed or multi-tenant deployments.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated remote attackers to run arbitrary commands by supplying crafted configuration parameters that bypass the application's incomplete input denylist (CWE-184). The flaw carries a CVSS 8.8 score with full confidentiality, integrity, and availability impact, and SSVC rates the technical impact as total. No active exploitation is confirmed - EPSS sits at 0.42% (35th percentile) and the vulnerability is absent from CISA KEV - though the low attack complexity makes it a genuine priority for any internet-exposed Langflow deployment with untrusted authenticated users.
OS command injection in the backmeup npm package allows any attacker who can supply input to the package's name, source, destination, or filter options to execute arbitrary shell commands on the backup host or, when SSH mode is configured, on the remote SSH target. The flaw stems from direct string concatenation of option values into shell command strings executed via child_process or ssh2-exec, with no neutralization of metacharacters beyond path.normalize() and path.join(). No public exploit has been identified at time of analysis, but the CVSS vector (PR:L, AV:N, AC:L) indicates this is straightforwardly exploitable by any low-privilege application user whose input reaches the vulnerable call sites.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 allows any internet-reachable attacker to execute arbitrary server-side code using only two HTTP requests. The vulnerability is rooted in CWE-94 (Code Injection), enabling full server compromise with no user interaction. A vendor patch is available via IBM advisory, and no public exploit has been identified at time of analysis - however the trivially low attack complexity makes any internet-exposed instance an immediate remediation priority.
Unsandboxed Groovy script execution in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows any attacker holding Item/Create or Item/Configure permission to run arbitrary code directly on the Jenkins controller JVM. The plugin exposes Groovy scripting capabilities that intentionally bypass the Script Security Plugin - the standard Jenkins mechanism for confining script execution to a restricted sandbox - meaning scripts execute with the full privileges of the Jenkins service account. The fix is available in Multijob Plugin 677.v7ffc23d6a_4c2; no public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Privilege escalation in Dokan (WordPress multivendor marketplace plugin) versions up to and including 5.0.1 enables any authenticated vendor or seller to read, modify, or delete any WordPress user account - including site administrators - via REST API calls to `/wp-json/dokan/v1/customers/{id}`. The plugin's `CustomersController` re-registers WooCommerce's customer CRUD routes but replaces the native `manage_woocommerce` capability gate with a flawed check that inspects only the requesting user's role and never validates authorization against the target user. Setting the `password` parameter on an administrator's record via a PUT request yields full site takeover. No public exploit identified at time of analysis, though the attack is mechanically trivial for any Vendor-role account holder.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 is achievable by remote attackers holding low-privilege credentials via server-side code injection (CWE-94). The CVSS score of 8.8 reflects full confidentiality, integrity, and availability impact with a low-complexity network attack path requiring only valid user authentication. No public exploitation has been confirmed - EPSS places the exploitation probability at 0.36% (29th percentile) and SSVC rates exploitation status as none and the attack as non-automatable, though SSVC's technical impact rating is total, consistent with arbitrary code execution.
Remote code injection in IBM Langflow OSS 1.0.0 through 1.10.3 allows an authenticated remote attacker to execute arbitrary code on the underlying server by supplying malicious input through user-controlled code fields within the platform. The CVSS vector (AV:N/AC:L/PR:L) confirms the attack is network-reachable at low complexity, requiring only low-privilege credentials, with full confidentiality, integrity, and availability impact on the host. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privilege client registration credentials full realm administrator access by exploiting a validation bypass in the 'Allowed Protocol Mapper Types' security policy. The policy correctly validates mapper types at initial registration but fails to re-validate the mapper type during a client update when the mapper's surrounding configuration is unchanged, allowing a type-swap from a permitted mapper to a restricted high-privilege mapper (such as a HardcodedRoleMapper that injects realm-admin roles into tokens). No public exploit code has been identified and no CISA KEV listing is present, but the attack is low-complexity, fully network-exploitable, and results in complete confidentiality, integrity, and availability compromise of the Keycloak realm.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 is achievable by any authenticated attacker due to improper validation of module imports, classified under CWE-94 (Code Injection). The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact with no user interaction required beyond low-privilege authentication. No public exploit code has been identified at time of analysis, EPSS sits at 0.34% (27th percentile), and SSVC designates exploitation as 'none' currently - though the SSVC technical impact is rated 'total', confirming the severity of successful exploitation.
Unsafe pickle deserialization in Hugging Face PEFT's LoRA-GA and CorDA initialization modules allows arbitrary code execution when a victim loads a malicious cache or covariance file. The affected code paths in corda.py (lines ~102 and ~163) and loraga.py (line ~101) call torch.load() without weights_only=True, bypassing the safe-loading wrapper that PEFT enforces elsewhere in the codebase. An attacker who can supply or substitute a pre-computed LoRA-GA or CorDA cache file - for example via a shared model repository or poisoned download - achieves full code execution in the victim's ML environment upon initialization. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Privilege escalation in the Smart Popup by Supsystic WordPress plugin (all versions through 1.12.0) enables unauthenticated remote attackers to create persistent WordPress Administrator accounts with attacker-controlled credentials. Three compounding flaws are chained: a PHP `array_merge()` collision silently removes the `save` action from the popup module's permission blocklist, the subscription confirmation email leaks a reusable `pps_nonce` that the `wp_ajax_nopriv_save` endpoint accepts, and `createWpSubscriber()` applies no server-side role allowlist - allowing an attacker to freely set `params[tpl][sub_wp_create_user_role]=administrator`. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack chain is fully described in the CVE and the low complexity makes independent weaponization likely.
Unauthenticated arbitrary file write in Eclipse Theia 1.73.1 and earlier (browser-mode deployments) allows any cross-origin web page to overwrite files at any absolute path the backend process can access, with a realistic escalation to remote code execution. The `POST /file-upload` handler in `@theia/filesystem` accepts attacker-controlled absolute paths with no workspace boundary check, while a distinct HTTP middleware flaw in `@theia/core` lets the connection token check pass without rejection for tokenless HTTP requests. Because `multipart/form-data` is a CORS-safelisted request type, browsers send the exploit request cross-origin with no preflight and no credentials. No public exploit has been identified at time of analysis, and no CISA KEV listing appears in the provided data, but the attack mechanism is straightforward and requires only that a victim visit an attacker-controlled page.
Arbitrary server-side code execution in Magistrala's Rules Engine exposes any authenticated low-privileged user to full file system access, environment variable exfiltration, database manipulation, and SSRF against internal microservices. The platform's two script runtimes - Go via Yaegi and Lua - both fail to sandbox dangerous capabilities: the Go engine exposes the complete standard library behind a trivially insufficient regex filter, while the Lua engine performs no validation whatsoever and explicitly preloads file I/O, HTTP client, and database libraries. No public exploit code has been identified at time of analysis, but the attack requires only a valid account and the ability to create rules, making exploitation straightforward for any tenant or internal user.
Host filesystem read and write access in IBM Langflow OSS 1.0.0 through 1.10.3 is achievable by any authenticated low-privilege user via insufficient filtering of Docker volume-mount and device-mapping arguments passed to Docker-based MCP servers. By injecting unsanitized flags such as --volume into MCP server configuration, an attacker can bind-mount arbitrary host directories into a spawned container, exposing or tampering with sensitive files outside the intended Docker isolation boundary. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the network-exploitable, low-complexity attack path and full CIA impact score (CVSS 8.8) make this a high-priority patch target for any organization running Langflow in Docker environments with externally accessible or multi-tenant access.
SQL injection in Koha's guided report builder (`reports/guided_reports.pl`) allows any authenticated staff member holding the low-privilege `create_reports` or `execute_reports` permission to perform time-based blind SQL injection against the Koha database, which stores patron PII, borrowing history, and staff/LDAP credentials. The `order_by` and dynamically-named `{order}_ovalue` CGI parameters are concatenated verbatim into an ORDER BY clause by `C4::Reports::Guided` with no allowlist, escaping, or prepared-statement binding - a structural defect, since SQL placeholders cannot parameterize column names. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack technique is well-understood and the affected permission is routinely granted to non-admin library staff.
Time-based blind SQL injection in Cacti's ORDER BY handling allows any authenticated user - regardless of privilege level - to extract, modify, or destroy the Cacti database by supplying a crafted `sort_column` GET parameter to at least four administrative endpoints. The root cause is a regex-based sanitization allowlist in `sanitize_sql_column()` (lib/functions.php) that explicitly permits parentheses to support SQL expressions like `COUNT(id)`, inadvertently passing payloads such as `SLEEP(5)` through unmodified before they are concatenated into unparameterized ORDER BY clauses. No public exploit code or KEV listing has been identified at time of analysis, but the low privilege bar and network accessibility make this a credible priority for any organization running Cacti.
Remote code execution in IBM Langflow OSS (versions 1.0.0 through 1.10.3) allows authenticated attackers to execute arbitrary Python code by exploiting a cryptographic weakness (CWE-326) in the custom component validation mechanism. When the optional hardening mode is enabled - the feature intended to restrict execution to trusted component templates - the application validates submitted component code against a truncated SHA-256 digest, making it computationally feasible for an attacker to craft a malicious Python file that collides with a trusted template's hash and bypasses the validation gate entirely. No public exploit code has been identified at time of analysis; a vendor patch is available per IBM advisory, though the exact fixed version is not stated in available data.
Remote code execution in IBM Langflow OSS 1.0.0-1.10.3 allows authenticated low-privilege users to trigger arbitrary Python execution on the backend server by submitting crafted Agentic Assistant workflows containing malicious LLM-generated components that are evaluated server-side during validation before user approval is granted. The flaw (CWE-94, Code Injection) arises because the validation pipeline eagerly executes model-generated Python without sandboxing or deferral, giving attackers backend process-level privileges to exfiltrate data, interact with the file system, or initiate outbound network connections. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS places exploitation probability at 0.22% (13th percentile), but SSVC rates technical impact as total, making this a high-priority patch target for multi-user or internet-exposed deployments.
Command injection in IBM QRadar SIEM allows an authenticated privileged user to execute arbitrary OS commands at normal user privilege level due to insufficient input validation (CWE-78). Affected versions span QRadar 7.5.0 through 7.5.0 UP 15 Interim Fix 005 and 7.6.0.0 through 7.6.0.1, placing enterprise security operations centers at risk if SIEM operator accounts are compromised or misused by insiders. No public exploit code exists and no active exploitation is confirmed; EPSS places this at the 13th percentile (0.22%), indicating minimal near-term mass-exploitation probability.
Unauthorized component instantiation in Nuxt server islands (versions >=3.1.0 <3.21.10 and >=4.0.0 <4.5.1) allows remote unauthenticated attackers to render arbitrary globally-registered Vue components or native HTML elements - including constructs like `<iframe>` - by supplying a crafted string prop to the `/__nuxt_island/` endpoint. The attack exploits Vue's attribute fallthrough behavior: props an island does not declare pass through to its root element, so if that root is a polymorphic component (such as reka-ui or @nuxt/ui elements using an `as` prop), the attacker's string silently reaches dynamic component resolution without any explicit forwarding in the island author's code. Unlike the related RCE vector GHSA-9473-5f9j-94wq, this does not require `vue.runtimeCompiler`, making it reachable in substantially more configurations; however, no public exploit has been identified at time of analysis and real-world exploitation is constrained by application-specific island configuration requirements.
Remote code execution via CSRF in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows a network attacker to execute arbitrary code within the Jenkins controller JVM by inducing a low-privileged authenticated user to trigger a forged request. The Jenkins security advisory published 2026-08-05 formally discloses this as SECURITY-3823(2), with EUVD-2026-53526 corroborating the affected version range. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network reachability and low attack complexity make this a meaningful risk wherever Jenkins is accessible and users browse untrusted sites within the same browser session.
Cleartext storage of sensitive information in Cisco Catalyst SD-WAN Controller and Manager exposes credentials or other security-critical data to authenticated network-accessible attackers, with CVSS 8.8 reflecting the high potential for full system compromise via stolen credentials. Affecting an extraordinarily wide version range spanning 17.2.x through 20.14.x across both the Controller and Manager components, this vulnerability was discovered internally by Cisco's engineering team - a positive signal indicating no known prior adversarial exploitation. No public exploit code exists and the vulnerability is not listed in CISA KEV; however, the SD-WAN control plane sensitivity means exposed credentials could enable broad network infrastructure takeover.
Cross-site request forgery in the Progress MarkLogic Server Admin UI allows a remote attacker to perform privileged administrative actions on behalf of a logged-in administrator by luring them to a crafted malicious webpage. Affected versions span the 11.x line prior to 11.3.6 and the 12.x line prior to 12.0.3, covering deployments across both active release trains. No public exploit code or active exploitation has been identified; Progress Software has issued patches for both branches.
Cleartext registration token exposure in Rancher allows a low-privileged user to obtain perpetually valid cluster join tokens and enlist rogue nodes into downstream Kubernetes clusters. The tokens - used to authenticate nodes and agents during cluster bootstrapping - are stored without encryption or expiration and are reachable through at least four distinct channels: the Rancher API, etcd, stored automation artifacts, and direct filesystem access on enrolled nodes. The CVSS scope-change flag (S:C) accurately reflects that successful exploitation extends attacker influence beyond the Rancher management plane into downstream cluster workloads, secrets, and compute. No public exploit has been identified at time of analysis, and no CISA KEV listing exists.
Remote unauthenticated denial of service in OpenStack Swift through 2.38.0 allows any network-reachable attacker to exhaust all proxy worker threads with a trivially crafted HTTP Accept header. The proxy server's Accept header parser employs a qdtext regex pattern susceptible to catastrophic backtracking (CWE-1333), where a payload of just 32 backslash-character pairs stalls a single worker for over 30 seconds. Repeated concurrent requests consume all available proxy workers, causing complete and sustained service unavailability — no authentication, session, or account is required. No public exploit or CISA KEV listing has been identified at time of analysis, though the description itself constitutes a functional attack recipe.
Stack-based buffer overflow in OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1 allows a remote unauthenticated attacker to crash worker processes by exploiting the watcherinfo XML generation path in the presence module. The attacker sends a SIP SUBSCRIBE with a From URI exceeding 200 characters, establishing an oversized watcher entry, then triggers presence.winfo generation to overflow a fixed-size stack buffer in create_winfo_xml() within notify.c. No public exploit has been identified at time of analysis, but the unauthenticated network vector and straightforward two-step attack path make this a credible denial-of-service risk for any SIP infrastructure exposing presence services.
Stored XSS in Grocy's API layer allows authenticated users to permanently inject arbitrary script tags into shared application data, executing in the browsers of any user who views affected records. The vulnerability spans all API-writable resource types - products, recipes, stock entries, user records, and chores - making it broadly exploitable across the application. The CVSS score of 8.7 with Scope:Changed reflects the cross-user impact characteristic of stored XSS: a single low-privileged write yields high confidentiality and integrity impact against other users' sessions. No public exploit code or CISA KEV listing is identified at time of analysis.
Stored XSS in InvoiceNinja v5-stable allows an authenticated user with invoice creation access to inject arbitrary JavaScript into the invoice terms field, which executes in a business client's browser when they view the invoice in the client portal. The attack leverages Laravel Blade's raw unescaped output directive in `resources/views/portal/ninja2020/invoices/includes/terms.blade.php`, with no HTML sanitization performed in `StoreInvoiceRequest.php`, enabling session cookie theft and full client account takeover. This is a distinct code path from the previously published CVE-2026-33628 (line-item description XSS), and no public exploit has been identified at time of analysis.
Denial-of-service via malformed XMCP packets forces unexpected reloads of Cisco IOS and IOS XE devices, exploitable by any remote unauthenticated attacker. The CVSS scope change (S:C) reflects that the reload impacts the entire device, not just the XMCP subsystem, bringing down all services simultaneously. No public exploit or CISA KEV listing exists at time of analysis, but the zero-authentication, low-complexity attack vector - combined with Cisco's ubiquitous enterprise footprint - makes this a high-priority patching target for network operations teams.
Denial-of-service in Cisco IOS XE Software's Blocks Extensible Exchange Protocol (BEEP) feature allows an unauthenticated remote attacker to force an unexpected device reload by sending a specially crafted BEEP SOAP request. The CVSS 8.6 score with Changed scope (S:C) reflects that a device reload disrupts all network services downstream of the affected device, amplifying impact beyond the immediate target. No public exploit or CISA KEV listing has been identified at time of analysis, though the low-complexity, no-authentication attack vector makes this a credible automated threat against any internet- or network-exposed IOS XE device running the BEEP feature.
Server-side request forgery in Stirling-PDF's POST /api/v1/convert/url/pdf endpoint allows unauthenticated remote attackers to exfiltrate cloud metadata and internal network resources by supplying a URL to an attacker-controlled page containing embedded resource references (e.g., img tags targeting 169.254.169.254). The endpoint was deliberately excluded from the SSRF protections applied to three sibling conversion endpoints, creating an uneven security boundary; WeasyPrint, the underlying rendering subprocess, fetches all embedded resources with no per-resource SSRF filtering, causing internal HTTP responses to be embedded verbatim into the returned PDF. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication and no special configuration, making any network-exposed Stirling-PDF instance a viable target.
Unauthenticated remote denial-of-service affecting Cisco IOS XE Software across a wide version range results from multiple improper input validation flaws (CWE-20) discovered during Cisco's internal security hardening review. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) indicates that network-adjacent or internet-facing IOS XE devices can be crashed or rendered unavailable without any credentials or user interaction, with the changed scope (S:C) suggesting impact can extend beyond the directly targeted device to dependent network services. No public exploit code has been identified and this is not listed in CISA KEV, consistent with the internally discovered origin.