Persistent denial of service in libkcapi's AIO interface allows a local attacker to permanently hang an affected application thread by exploiting improper error-state handling in _kcapi_aio_read_all(). Affected deployments span Red Hat Enterprise Linux 8, 9, and 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 - all environments where applications leverage libkcapi's asynchronous cryptographic operations. No public exploit code or active exploitation has been identified at time of analysis; the high attack complexity (AC:H) and local-only attack vector substantially limit real-world risk beyond targeted or insider-threat scenarios.
Reflected XSS in ProjectSend r2029 exposes privileged user sessions to complete account takeover: an unauthenticated attacker crafts a malicious URL targeting thumbnails-regenerate.php with injected payloads in the start_date or end_date GET parameters, which are echoed raw into HTML attribute values without escaping. When a victim holding edit_settings permissions is socially engineered into clicking the link, the injected script executes in the application origin, enabling session cookie theft and unauthorized administrative actions - including user management, file management, and global settings changes. No public exploit has been identified at time of analysis; an upstream patch is available via GitHub commit and was reported by VulnCheck.
Firewall rule inheritance bypass in Cisco Terminal Services (TS) Agent allows an authenticated remote attacker to escape their own firewall policy and operate under the network access rules of a different user account. Affected versions span TSAgent-1.0 through TSAgent-1.4.2 per EUVD-2026-53447. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and network-accessible vector make it straightforward to attempt for any credentialed user in an affected deployment.
Incorrect authorization in OpenStack Ironic through 38.0.0 allows an authenticated low-privilege project reader to leak Portgroup configuration data belonging to Nodes owned or leased by other tenants via a crafted API request. The flaw breaks multi-tenant isolation - a core security guarantee of shared cloud infrastructure - enabling cross-project enumeration of bare-metal network topology. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and wide affected version range (spanning multiple major release series) make this a meaningful risk for multi-tenant OpenStack deployments.
SQL injection in the Askeet - Talk to Your WooCommerce Data plugin (all versions through 3.0) enables authenticated administrators to exfiltrate arbitrary data from the WordPress database by exploiting a filter bypass in the plugin's query sanitization routine. The `askeet_is_safe_query()` function strips standard MySQL block comments before scanning for forbidden keywords, but fails to account for MySQL's conditional comment syntax (e.g., `/*!UNION*/`), which MySQL executes as live SQL while the filter treats it as a comment. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at the time of analysis; EPSS data was not included in the available intelligence.
SQL injection in the WP TripAdvisor Review Slider WordPress plugin (all versions through 14.3) enables authenticated administrators to extract arbitrary data from the underlying WordPress database via a maliciously crafted `curselrevs[]` array parameter. The flaw stems from insufficient escaping and improper SQL query preparation in the plugin's admin-side code, documented at specific lines in the plugin's source on the WordPress repository. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified; real-world risk is substantially constrained by the administrator-level privilege requirement reflected in the CVSS 4.9 Medium score.
Time-based SQL injection in the JoomSport WordPress plugin (all versions through 5.7.9) allows extraction of sensitive WordPress database contents via the unsanitized 'order' parameter on a vulnerable admin boxfields page. While the direct exploitation path requires administrator-level authentication (PR:H), the affected admin endpoint lacks nonce or CSRF protection on GET requests, creating a second, more accessible attack path: an unauthenticated actor can trigger the injection by social-engineering an active administrator session into issuing a crafted URL. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CSRF bypass substantially elevates real-world risk beyond the official CVSS 4.9 score.
Arbitrary file write via tar path traversal in Fledge's backup-restore API allows an authenticated admin to overwrite files anywhere on the host filesystem reachable by the Fledge process. The upload_backup() handler in backup_restore.py calls Python's tarfile.extractall() without a filter argument or member-path sanitization, enabling a classic 'tar slip' attack. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the attack is mechanically trivial for any actor holding admin credentials.
SQL injection in the PrettyLinks WordPress plugin (all versions through 3.6.20) enables authenticated administrators to extract arbitrary data from the underlying WordPress database by appending malicious SQL to the 's' search parameter on the Pretty Links listing page. The root cause is insufficient input escaping and absent prepared-statement usage in the `search_links_table()` function within `PrliLinksController.php`. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the CVSS confidentiality impact is rated High, meaning successful exploitation could expose all data stored in the WordPress database.
Cross-site scripting in the Cisco Integrated Management Controller (IMC) web-based management interface allows an authenticated remote attacker with high privileges to execute arbitrary JavaScript in a victim's browser. The attack requires the attacker to craft a malicious link and social-engineer another IMC interface user into clicking it, at which point the attacker can steal browser-based session data or perform actions on behalf of the targeted user. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing practical risk well below the nominal CVSS 4.8 medium score.
Reflected XSS in Smash Balloon Social Photo Feed for WordPress (all versions through 6.11.3) allows unauthenticated attackers to inject arbitrary JavaScript via the REQUEST_URI query string in admin callout pages. Successful exploitation requires tricking an authenticated WordPress user - likely an administrator - into clicking a crafted link, after which the injected script executes in their browser session. No public exploit code or CISA KEV listing has been identified; the CVSS vector assigns high attack complexity (AC:H) and required user interaction (UI:R), placing real-world risk below the raw severity suggests.
XML External Entity (XXE) injection in Eclipse Accessibility Tools Framework (ACTF) versions through 1.6.0 and miChecker through 3.1.0 allows a local attacker to exfiltrate files and probe internal network resources by supplying a maliciously crafted XML document to a user running an ACTF-based application. Exploitation requires user interaction - the victim must open or process the attacker-supplied XML - but no special privileges are required. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 4.6 reflects the limited, read-only confidentiality impact scoped to local and internal resources.
Stored XSS in the Contact Form 7 Dynamic Text Extension WordPress plugin (all versions through 5.0.5) enables an authenticated Editor-level user to inject arbitrary JavaScript into form shortcode keys, which executes in an administrator's browser when the admin triggers the 'Scan Forms for Post Meta and User Data Keys' feature. The Scope:Changed CVSS metric correctly reflects that the injected payload runs in a higher-privilege context (administrator session) than where it was planted (editor account). No public exploit code and no CISA KEV listing exist at time of analysis; vendor-released patch version 5.0.6 resolves the issue.
Stored XSS in the Super Progressive Web Apps WordPress plugin (all versions through 2.2.43) enables authenticated WordPress administrators to persist arbitrary JavaScript payloads via the offline snackbar message setting, which executes in the browsers of site visitors when their browser transitions offline. The offline message is stored without sanitization, serialized into the page via wp_localize_script(), and rendered through innerHTML in the PWA snackbar component - a classic stored-to-DOM XSS chain crossing the administrator-to-visitor security boundary. No public exploit code or CISA KEV listing exists at time of analysis; the high privilege requirement substantially constrains real-world attack surface.
Argument injection in xidown, a desktop GUI wrapper for yt-dlp and ffmpeg, allows any string beginning with '-' supplied as a URL to be interpreted by yt-dlp as a CLI option rather than a link target, because the application never inserts a '--' end-of-options separator before appending user input to subprocess invocations in scanner.py and downloader.py. All versions under cpe:2.3:a:indravoyager:xidown are affected across every call site. While full code execution via yt-dlp's --exec flag was not demonstrated during testing, the injection primitive is confirmed and unmitigated, placing the theoretical impact ceiling - arbitrary shell command execution - substantially above what the CVSS 4.4 score conveys. No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.
Denial-of-service in Cisco IOS XE Software's web-based management interface (WebUI) allows an authenticated remote attacker holding only low-privilege credentials to render the management interface unresponsive by sending crafted input that bypasses input validation. The vulnerability spans an exceptionally broad version footprint - from 16.9.x through the 26.x release train - making patching scope significant for organizations running Cisco enterprise routing and switching infrastructure. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, placing real-world urgency below its broad scope might suggest.
Arbitrary file write via crafted tar archive extraction in Jenkins 2.575 and earlier allows attackers controlling agent processes to escape extraction directory boundaries on the controller filesystem, directly enabling remote code execution. The root cause is unsafe handling of symbolic links with effectively empty names during .tar and .tar.gz extraction on the controller, permitting writes to sensitive paths such as JENKINS_HOME/init.groovy.d/ (Groovy init scripts) or JENKINS_HOME/plugins/ (plugin deployment). No public exploit or CISA KEV listing has been identified at time of analysis, but the agent-to-controller trust boundary is a well-established Jenkins attack surface with a history of critical exploitation.
Path traversal in Jenkins file parameter name validation allows authenticated attackers holding Item/Configure and Item/Build permissions to write arbitrary files to the Jenkins controller's file system, leading to code execution. Affected releases are Jenkins 2.575 and earlier (weekly) and LTS 2.568.1 and earlier; fixed in Jenkins 2.576 and LTS 2.568.2, published 2026-08-05. No public exploit code or CISA KEV listing has been identified at time of analysis.
Blind SSRF in Firefly III's webhook subsystem exploits two distinct validation failures: an explicit early-return in IsValidWebhookUrl.php that whitelists the entire 127.0.0.0/8 loopback range, and a TOCTOU race where hostname resolution at validation time (gethostbyname()) is decoupled from the independent re-resolution performed by Guzzle at send time, enabling DNS rebinding to bypass private-range filters. Exploitation requires an authenticated user and the webhooks feature to be enabled, which is off by default. This is a blind SSRF primitive with no exploit code publicly identified at time of analysis - webhook responses are written only to a server-side debug log, restricting attacker utility to internal service probing and side-effect triggering rather than direct data exfiltration.
Unauthorized post creation in Xpro Addons - 140+ Widgets for Elementor (WordPress) affects all versions through 1.5.1, allowing any authenticated user with Subscriber-level access to publish arbitrary posts of the custom type `xpro_content` via a missing capability check on the `get_menu_content_editor()` AJAX handler. The created posts are publicly queryable on the front-end, enabling content injection, SEO spam campaigns, and database pollution against any WordPress site running the plugin. No public exploit or CISA KEV listing has been identified at time of analysis, though the low authentication barrier (any registered user) lowers the practical difficulty of abuse.
Unauthenticated open redirect in DjangoCRM's toggle_default_sorting view exposes users to same-site phishing and referrer-based token leakage. The endpoint is the sole route in common/urls.py lacking a login_required or staff_member_required decorator, and it redirects to a caller-supplied next_url GET parameter after only a domain-level check via secure_url() - permitting redirection to any arbitrary same-site path without authentication. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the unauthenticated attack surface combined with potential token harvest in redirect chains elevates practical risk beyond the 4.3 CVSS score alone.
IBM Maximo Application Suite 9.0, 9.1, and 9.2 fails to set the `Secure` attribute on authorization tokens and session cookies, enabling interception of credential material over unencrypted HTTP. An attacker who tricks an authenticated user into following an HTTP link - via phishing or a malicious page - causes the victim's browser to transmit the session cookie in plaintext, where it can be captured by a server the attacker controls or via network sniffing. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, session token theft can lead to full account takeover, meaningfully exceeding the limited confidentiality scope implied by the raw CVSS score.
Stored cross-site scripting in Ghost CMS feature image captions enables any authenticated staff user to inject unsanitized HTML into the post revision history modal, hijacking the Ghost Admin session of another staff or administrator user who views that revision. Affects Ghost npm package versions v4.9.0 through v6.54.0. No public exploit identified at time of analysis and not listed in CISA KEV, but the privilege escalation potential - a lower-privileged staff member compromising a full administrator session - makes this higher-impact than the CVSS 4.3 score implies for multi-tenant or shared Ghost Admin environments.
Remote code execution and privilege escalation across Jenkins core and multiple plugins were disclosed in the 2026-08-05 security advisory, with the most critical issue being a JEP-200 deserialization filter bypass (CVE-2026-70426) in Remoting 3384.v60d89463d9e0 and earlier that allows agent processes or holders of Agent/Connect permission to execute arbitrary code on the Jenkins controller. Compounding this, two separate arbitrary file-write primitives (CVE-2026-70427 via malicious tar archives, CVE-2026-70428 via path traversal in file parameter names) independently enable code execution by writing into JENKINS_HOME/init.groovy.d/ or deploying rogue plugins. No public exploit code or CISA KEV listing was identified at time of analysis, but the attack surface spans both network-accessible agents and authenticated users with low-privilege build permissions.
Remote code execution and privilege escalation are the headline risks in this Jenkins advisory covering multiple vulnerabilities in Jenkins core (versions 2.575/LTS 2.568.1 and earlier) and eleven plugins. The most critical flaw (CVE-2026-70426) bypasses the JEP-200 deserialization class filter via a fallback path in the Remoting library, allowing an agent process or a user with Agent/Connect permission to execute arbitrary code on the Jenkins controller. A companion archive-extraction vulnerability (CVE-2026-70427) enables arbitrary file writes to the controller filesystem - including into init.groovy.d or the plugins directory - through crafted tar/tar.gz archives delivered from an agent; no public exploits or CISA KEV listing were identified for any issue in this advisory at time of analysis.
The August 2026 Jenkins security advisory discloses multiple severe vulnerabilities across Jenkins core (2.575/LTS 2.568.1 and earlier) and several plugins, with the most critical being a JEP-200 deserialization class filter bypass (CVE-2026-70426) enabling remote code execution on the Jenkins controller from agent processes, and a symlink-based path traversal in tar archive extraction (CVE-2026-70427) permitting arbitrary file writes that achieve controller RCE via init scripts or plugin deployment. Additional high-severity issues include a second path traversal via file parameter names (CVE-2026-70428), Unicode-based user identity impersonation (CVE-2026-70429), arbitrary type instantiation by privileged users (CVE-2026-70430), and unsandboxed Groovy RCE in the Multijob Plugin (CVE-2026-70431/70432). No active exploitation is confirmed at time of analysis, but the exploitability of agent-to-controller RCE paths in Jenkins is a well-understood and historically targeted vulnerability class warranting immediate remediation.
CVE-2026-70443 is part of the Jenkins August 5, 2026 batch security advisory covering Jenkins core and multiple plugins. The provided source data does not include the specific vulnerability description for CVE-2026-70443 - the advisory text is truncated before reaching this CVE identifier (described CVEs end around CVE-2026-70435). The full advisory at https://www.jenkins.io/security/advisory/2026-08-05/ contains authoritative details. No active exploitation is confirmed (not listed in CISA KEV), and no EPSS or CVSS data was provided in the source intelligence.
Remote code execution, arbitrary file write, and privilege escalation vulnerabilities in Jenkins 2.575 and earlier (LTS 2.568.1 and earlier) expose the Jenkins controller to full compromise via agent-initiated attacks. The most critical paths - a JEP-200 deserialization filter bypass (CVE-2026-70426) and a symlink-based arbitrary file write through tar archive handling (CVE-2026-70427) - both allow attacker-controlled agent processes to execute code on the Jenkins controller JVM. Additional vulnerabilities in Multijob, HCL AppScan, and SCM-Manager plugins introduce unauthenticated Groovy RCE, CSRF-triggered code execution, and credential enumeration. No EPSS data or CISA KEV listing is present in available intelligence; no public exploit code is noted at time of analysis.
Authenticated SSRF in Pixelfed's SearchController allows any logged-in user to trigger server-side HTTP fetches to internal network resources, including cloud metadata endpoints such as 169.254.169.254. The root bypass is in ActivityPubFetchService's validateUrl(), which blocks only literal loopback hostnames without resolving DNS names to validate the resulting IP against private or link-local ranges - a classic pre-resolution validation gap. No active exploitation (CISA KEV) or public POC has been identified, but the low attack complexity, broad eligibility (any authenticated user), and high-value targets in cloud-hosted deployments make this a realistic internal reconnaissance and credential-theft risk.
Denial of service in Rancher's dynamiclistener TLS library allows network-accessible attackers to exhaust certificate Subject Alternative Name capacity on both the Rancher server and cattle-cluster-agent components. By sending a large volume of TLS requests each presenting a distinct Server Name Indication (SNI) hostname, an attacker causes the dynamiclistener library to continuously append new SANs to the serving certificate until its size exceeds TLS handshake limits, breaking all TLS communication on the affected listener. No public exploit has been identified at time of analysis, and CISA KEV status is not confirmed; however, exploitation is straightforward given the low technical barrier.
Jenkins 2.575 and LTS 2.568.1 and earlier, along with a broad set of Jenkins plugins, are affected by a batch of security vulnerabilities disclosed in the 2026-08-05 advisory. CVE-2026-70438 is one of the CVEs issued under this advisory batch; based on sequential numbering (the described CVEs run from 70426 through approximately 70435+), it likely corresponds to one of the eleven plugins listed as carrying unresolved security issues without a fix at time of publication - including AWS CodeBuild, CodeSonar, Google Chat Notification, Horreum, Ivy Report, Parameterized Remote Trigger, Qualys Container Scanning Connector, Sauce OnDemand, Summary Display, Violation Comments to GitLab, and XML Job to Job DSL. No public exploit has been identified for CVE-2026-70438 specifically, and it does not appear in CISA KEV. The broader advisory includes critical issues such as a Remoting deserialization filter bypass enabling controller-side code execution from agent processes, path traversal enabling arbitrary file write, and CSRF or missing permission checks across multiple plugins.
CVE-2026-70445 is one of multiple security vulnerabilities disclosed in the Jenkins security advisory published 2026-08-05, affecting Jenkins core and a range of Jenkins plugins. The specific vulnerability details for this CVE ID were not included in the provided input data - the oss-security disclosure text was truncated before reaching the description of CVE-2026-70445, which falls beyond CVE-2026-70435 in the sequential numbering. Based on the advisory structure, this CVE likely pertains to one of the Jenkins plugins listed either as patched (External Workspace Manager, HCL AppScan, Multijob, SCM-Manager, Webhook Secret Credentials Provider) or as containing unresolved issues (AWS CodeBuild, CodeSonar, Google Chat Notification, Horreum, Ivy Report, Parameterized Remote Trigger, Qualys Container Scanning Connector, Sauce OnDemand, Summary Display, Violation Comments to GitLab, XML Job to Job DSL). No public exploit, KEV listing, or EPSS score was provided.
Missing permission checks in HCL AppScan Plugin 1.8.3 and earlier expose multiple Jenkins HTTP endpoints to any authenticated user holding Overall/Read permission, enabling enumeration of credentials IDs stored in Jenkins. Credential ID disclosure is a stepping-stone attack: while the raw secrets are not returned, knowledge of credential IDs can be combined with a separate vulnerability to capture those credentials. No public exploit or active exploitation has been confirmed. A patched release (1.8.4) is available.
Jenkins 2.575 and earlier (LTS 2.568.1 and earlier) and multiple Jenkins plugins contain a cluster of vulnerabilities ranging from remote code execution via deserialization filter bypass to path traversal, CSRF, permission check failures, and Unicode-based user impersonation. The most critical issue - a bypass of the JEP-200 class filter in the Remoting library - allows authenticated agent operators or principals holding Agent/Connect permission to execute arbitrary code on the Jenkins controller. Three separate avenues for controller-side code execution are present in this advisory: the Remoting deserialization bypass (CVE-2026-70426), a tar archive symlink path traversal (CVE-2026-70427), and a file parameter path traversal (CVE-2026-70428). No public exploit or CISA KEV listing is confirmed at time of analysis, but the severity and variety of attack paths make this advisory high-priority for any Jenkins deployment.
Cross-site request forgery (CSRF) in a Jenkins plugin (SECURITY-3888) allows unauthenticated remote attackers to induce authenticated Jenkins users into triggering unauthorized plugin actions by visiting a malicious page, with no privileges required on the attacker's side. The companion vulnerability CVE-2026-70435 covers a missing permission check in the same plugin, indicating the CSRF-triggered endpoint also lacks server-side authorization enforcement. Fixes are available in the 2026-08-05 Jenkins security advisory bundle; no public exploit or CISA KEV listing has been identified at time of analysis.
Missing permission check in a Jenkins plugin (SECURITY-3888) exposes one or more HTTP endpoints to attackers without adequate authorization enforcement. The vulnerability is one of a paired finding alongside CVE-2026-70434 (CSRF), suggesting the same endpoint lacks both CSRF protection and proper access controls. The full description is truncated in the available source data, so the specific plugin and endpoint are not independently confirmed, but fixes are included in the August 5, 2026 Jenkins security advisory. No public exploit is identified at time of analysis.
Server-Side Request Forgery in Ghost CMS v6.26.0-v6.54.0 allows unauthenticated remote attackers to abuse features such as Webmentions to issue blind HTTP requests from the Ghost server into its internal network, bypassing perimeter controls without returning response content to the attacker. The flaw stems from insufficient URL validation in outbound HTTP request handling, enabling internal host probing across a changed security scope (CVSS S:C). No active exploitation (CISA KEV) or public POC has been identified at time of analysis; the vendor has released a fix in v6.54.1.
Untrusted pointer dereference in HDF5's h5dump utility (before version 2.1.1) causes a denial of service when processing specially crafted HDF5 files containing variable-length string datasets with more than one element rendered in binary mode. The stride calculation for per-element offsets becomes corrupted, causing subsequent elements to be read from misaligned memory addresses and dereferenced as pointers, crashing the tool. No public exploit code exists at time of analysis, and no active exploitation has been confirmed - the local attack vector and DoS-only impact make this a low operational priority for most environments.