Arbitrary file deletion in the Custom Fields WordPress plugin before 1.5.1 allows unauthenticated attackers to delete any file on the server - including wp-config.php - leading to full site takeover. Because the plugin fails to validate a user-supplied path before deletion, a remote attacker needs no authentication or user interaction (CVSS 10.0). Publicly available exploit code exists via WPScan, though EPSS is low (0.17%) and the flaw is not listed in CISA KEV.
Unauthenticated remote code execution in Nuxt DevTools (@nuxt/devtools before 3.3.1) lets any client reaching the Vite HMR WebSocket invoke RPC methods that were never gated by the ensureDevAuthToken check. By chaining updateOptions() to poison the persisted behavior.openInEditor value and then calling openInEditor(), an attacker runs an arbitrary program on the developer's machine via the launch-editor package. Only development environments are affected; production builds do not run DevTools. This is rated CVSS 9.6 (scope-changed), and no public exploit has been identified at time of analysis.
SQL injection in the Ajax Load More WordPress plugin before 8.0.1 lets unauthenticated attackers inject into an unsanitised parameter used in a database query, enabling time-based blind extraction of sensitive data such as user credentials and secrets. Reported by WPScan with publicly available exploit detail and a vendor patch in 8.0.1; scored CVSS 9.1 with an unauthenticated network vector. EPSS is low (0.19%, 9th percentile), indicating limited observed exploitation despite the critical rating.
Account takeover in the WordPress plugin "OTP Login With Phone Number, OTP Verification" before 1.8.71 stems from missing rate-limiting and non-invalidation of one-time login codes, letting an unauthenticated attacker request a login OTP for any account and brute-force the short numeric code to seize control of any user, including administrators. CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) reflects trivial network exploitation with high confidentiality and integrity impact. Publicly available exploit code exists (reported by WPScan), though EPSS is low at 0.15% (4th percentile) and it is not in CISA KEV, so there is no public exploit identified as actively exploited in the wild.
Unauthenticated remote command execution in PraisonAI's bundled Claude GitHub Actions workflow (versions before 4.6.40) lets an outside contributor run arbitrary shell code on the CI runner by opening a fork pull request whose branch name contains shell metacharacters and posting an @claude comment. Two compounding flaws enable this: the workflow interpolates the attacker-controlled branch name directly into an unquoted Bash run: block, and it triggers for any @claude comment without verifying the commenter is a trusted collaborator. Because the job runs with a GitHub App token holding write permissions plus OIDC and gh/git access, injected commands can be chained via $GITHUB_PATH into later privileged steps to gain repository write, PR/issue manipulation, or OIDC-token abuse. No public exploit identified at time of analysis.
Arbitrary file write leading to remote code execution in OpenPLC Runtime v3 lets a low-privileged web user upload a crafted Structured Text (.st) program whose embedded `(*FILE:path content*)` directive escapes the intended ./core directory via path traversal. Because the compile_program() sink never calls the project's own validate_file_path() guard, an attacker can plant files such as a cron job or SSH authorized_keys to gain code execution as the runtime user. Exploitation is further eased by OpenPLC's shipped default credentials (openplc:openplc); no public exploit identified at time of analysis and the issue is not in CISA KEV.
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 lets an authenticated user holding only a low-privileged REST role elevate to administrator through the SQL, SPARQL, and Optic REST query interfaces, after which they can run privileged operations and read data they were never authorized to see. The flaw is remotely reachable and requires only valid low-tier credentials, driving a critical 9.9 CVSS score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation and cross-boundary information disclosure in Cisco Catalyst SD-WAN Manager and SD-WAN Controller stems from improper input validation (CWE-20) discovered during Cisco's internal hardening review; an authenticated attacker with low privileges can send crafted input over the network to break out of their intended authorization scope and compromise the confidentiality, integrity, and availability of the management plane. The CVSS 9.9 score is driven by a scope change (S:C), meaning impact extends beyond the vulnerable component to the broader SD-WAN control fabric it orchestrates. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the near-maximal CVSS and the centrality of the affected controllers make this a high-priority patch.
Privilege escalation in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an authenticated user holding only a low-privileged Hadoop integration role break out of that role and perform privileged operations against the internal Security database, effectively enabling full control over authentication and authorization data. Rated CVSS 9.9 with a changed scope, the flaw turns a minimal Hadoop-connector account into an administrative foothold. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a low-privileged REST role to abuse the REST API document patch operation, gaining the ability to run privileged operations against the internal Security database and effectively take over authorization data. Rated CVSS 9.9 with a changed scope, it is exploitable by any low-privileged REST account over the network. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a high-priority patch.
Privilege escalation and authentication-boundary bypass in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows a low-privileged, remote authenticated attacker to abuse improper access-control checks (CWE-284) to reach functionality or data intended for higher-privileged roles, with full confidentiality, integrity, and availability impact (CVSS 9.9, scope changed). The flaw was discovered internally by Cisco during a proactive hardening review and shipped as part of a consolidated software-hardening release; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because SD-WAN Manager is the central orchestration plane for an entire SD-WAN fabric, successful abuse can cascade beyond the compromised component to the managed network.
Authentication bypass in mrswapnilsahu's Stock-Inventory-Management-System (PHP) lets an unauthenticated remote attacker log in as any user by injecting SQL through the login form. The login.php script concatenates raw POST username/password into the auth query (CWE-89) and also ships hardcoded admin credentials (admin/neola), giving two independent full-bypass paths. No public exploit identified at time of analysis, though the trivial ' OR '1'='1 payload is described directly in the disclosure.
Missing authentication in IoTSharp's BlobStorageController lets unauthenticated remote attackers reach Upload, Download, List, Modify, and Delete blob endpoints that every other controller (Devices, Customers, Tenants) guards with [Authorize]. Because the path and filename parameters are written to disk without sanitization, attackers can traverse outside the blob directory to read, alter, or delete arbitrary files - and drop a webshell into a web-accessible path for remote code execution. No public exploit identified at time of analysis, but the combination of unauthenticated access and a clear RCE path makes this trivially weaponizable.
Unauthenticated remote code execution in iot-ecology's rust-iot-platform allows attackers to run arbitrary JavaScript in the server process by creating a malicious "calc rule". The POST /calc-rule/create endpoint omits the AuthToken guard applied to other routes, and the supplied script field is later passed unsandboxed to quick_js::Context::eval(), giving full script execution once triggered. CVSS is 9.8; no public exploit identified at time of analysis, though the flaw is trivially reachable and the root cause is confirmed by source-level reference.
Out-of-bounds heap/stack write in nanoMODBUS through v1.23.0 lets an unauthenticated network client corrupt memory in the Modbus server via a single crafted Read File Record (FC 0x14) request. The server-side handle_read_file_record() function validates per-request and per-sub-request sizes but never checks the cumulative response size, and a uint8_t accumulator (response_data_size) silently overflows, allowing swap_regs() to write up to ~8490 bytes past the 260-byte receive buffer. There is no public exploit identified at time of analysis, but the flaw yields reliable denial of service and, on embedded/bare-metal targets lacking memory protection, potential remote code execution.
Authentication bypass in the ODBC App Server of Progress MarkLogic Server (before 11.3.6 and 12.0.3) lets an unauthenticated remote attacker circumvent password verification and run queries as any named user, including administrators. Because impersonation extends to admin-level accounts, an attacker gains full read/write control over the database and its data. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and admin-impersonation impact make this a critical, network-reachable flaw.
Unsafe class loading in the ORB (Object Request Broker) component of IBM WebSphere Application Server 8.5, 9.0, and Liberty Continuous Delivery allows a malicious or attacker-controlled IIOP server to force a WebSphere client/server to load and instantiate arbitrary Java classes over the network. Exploitation requires no authentication or user interaction (CVSS 9.8), and successful abuse can lead to loss of confidentiality, integrity, and availability, potentially culminating in remote code execution via dangerous class instantiation. There is no public exploit identified at time of analysis, and EPSS estimates only a 0.44% probability of exploitation in the next 30 days.
Missing authentication in the NASA-AMMOS ANMS reference implementation exposes the amp-manager REST API (CivetWeb, port 8089) directly on the host network, allowing any network-reachable client to command DTNMA agents without credentials. Because the shipped docker-compose.yml publishes the port and bypasses the CAM authentication gateway, unauthenticated remote attackers can enumerate agents, submit arbitrary EXECSET command sets to them, and clear stored reports. No public exploit identified at time of analysis; the flaw affects the reference/testbed implementation rather than onboard spacecraft flight software, though managed agents may represent real ground or space nodes depending on deployment.
Improper neutralization of special elements (CWE-74 injection class) in Cisco IOS XE Software allows remote, unauthenticated attackers to compromise the confidentiality, integrity, and availability of affected network devices, per Cisco's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8 Critical). The flaw was found during an internal Cisco security review and fixed via software hardening releases; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the disclosure is a bundled hardening advisory, the exact injection sink and affected feature/protocol are not specified, so the concrete attack surface is not confirmed from available data.
SQL injection in the Inventory-Management-System-PHP application (Harsh21Patel GitHub project) allows unauthenticated attackers to fully bypass authentication and destructively manipulate the product database. login.php concatenates raw POST email/password into its query, so a payload like email=' OR 1=1 LIMIT 1-- - logs in as the first user, while delete.php runs a DELETE on an unsanitized GET id parameter with no auth check, enabling arbitrary row deletion and blind SQLi. No public exploit identified at time of analysis, though the advisory itself publishes working payloads; the flaw carries CVSS 9.8 and is not listed in CISA KEV.
Stack buffer overflow in rxi's microtar C library allows memory corruption when an application archives files with attacker-influenced names longer than 99 characters. The mtar_write_file_header() and mtar_write_dir_header() functions use an unbounded strcpy() into a fixed 100-byte stack buffer, so any calling program that feeds externally-controlled filenames into these APIs is exposed to potential code execution or crash. No public exploit identified at time of analysis, and the library is not listed in CISA KEV, but the missing length check is trivially reachable in code that tars user-supplied paths.
Authentication bypass and database exfiltration in Miantang's IoT-PHP application via SQL injection in the login handler. The POST /userlogin route in index.php concatenates the unsanitized $_POST['pwd'] value directly into a MySQL query, letting an unauthenticated attacker log in as any user with a payload like pwd=' OR '1'='1 and use UNION-based injection to read arbitrary database contents. No public exploit identified at time of analysis, though the technique is trivial and well-documented; no EPSS or KEV data was supplied.
Authentication bypass and data exfiltration in IOTSmartHome's login component allow an unauthenticated attacker to submit a base64-encoded SQL injection payload via the lastLogin cookie, defeating login checks and reading arbitrary database contents including user credentials. The checkCookie() function in gui/login.php decodes the client-supplied cookie with URL-safe base64 (safe_decode()) and concatenates the result directly into a SQL query without sanitization. No public exploit is identified at time of analysis, but the trivial injection path (base64("' OR '1'='1")) and network reachability make weaponization straightforward.
Authentication bypass in the NASA-AMMOS Aerie/PlanDev sequencing-server allows unauthenticated remote attackers to impersonate the aerie_admin role because the authorization middleware trusts a session_variables object supplied in the request body over the Authorization header JWT. An attacker who submits {"session_variables":{"x-hasura-role":"aerie_admin"}} to POST /command-expansion/put-expansion can insert arbitrary expansion rules that govern how spacecraft activities are translated into commands, and POST /put-dictionary is separately whitelisted for unauthenticated writes. Rated CVSS 9.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
XML External Entity injection in IBM QRadar SIEM (versions 7.5.0 through 7.5.0 UP 15 IF005 and 7.6.0.0 through 7.6.0.1) lets remote unauthenticated attackers submit crafted XML-formatted syslog events to the parseXmlPayload() function in the event-processing pipeline. When any log source type uses XML-format property autodetection, events arriving on port 514 (UDP/TCP) are parsed without authentication, enabling file disclosure, SSRF, and denial of service. No public exploit identified at time of analysis, but EPSS is a low 0.32% (25th percentile) and IBM has published a fix.
Arbitrary-address memory write in the nanoMODBUS Modbus client library (through v1.23.0) allows a malicious or compromised Modbus server to corrupt the memory of any client that issues a Read Device Identification request. The flaw stems from an unchecked server-supplied object_id used as an array index, ultimately steering a strncpy() destination pointer with attacker-controlled data - a condition that typically leads to remote code execution or crash on embedded/IoT clients. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the assigned CVSS is 9.8, though exploitation requires the victim client to communicate with an attacker-controlled server.
Server-Side Request Forgery in IBM Application Gateway Operator versions 22.2 through 26.06 lets remote unauthenticated attackers coerce the operator into issuing arbitrary HTTP requests by supplying attacker-controlled URLs in custom resources that the operator fails to validate. Because the operator typically runs inside a Kubernetes/OpenShift cluster, this SSRF can reach internal-only services and cloud metadata endpoints. There is no public exploit identified at time of analysis, EPSS risk is low (0.29%, 21st percentile), and CISA SSVC rates exploitation as none.
Denial-of-service (NULL pointer dereference) in the open62541 OPC UA server v1.5.5 lets remote attackers crash the server by sending an AddReferencesRequest whose target uses an empty targetServerUri combined with a non-zero targetNodeId.serverIndex; the server's AddReferences handler fails to validate this non-local ExpandedNodeId case, leaving the target node pointer NULL while execution continues and dereferences it. Publicly available exploit code exists (SSVC exploitation: poc); it is not listed in CISA KEV and EPSS is low at 0.27% (19th percentile). Note that although the input CVSS is scored 9.8 with full C/I/A impact, the underlying flaw class (CWE-476) is consistent with a crash/DoS rather than confidentiality or code-execution impact.
Authentication bypass in the My Safetipin Android application version 5.2.1 stems from hardcoded credentials in the authentication module that produce predictable OTP values, letting remote attackers log in as arbitrary users and take over accounts without legitimate credentials. Any personal-safety data stored in a victim's account - location history, safety pins, and profile details - becomes exposed and modifiable. No public exploit has been identified at time of analysis, and the EPSS score of 0.27% (18th percentile) reflects low observed exploitation activity despite the maximal CVSS rating.
Predictable Fernet encryption key generation in IBM Langflow OSS (versions 1.0.0 through 1.10.3) stems from the ensure_fernet_key() function deriving keys from a cryptographically weak source (CWE-338), letting an attacker reconstruct the symmetric key that protects stored secrets such as API keys, credentials, and connection variables. Because the key is guessable rather than random, an actor who can read Langflow's encrypted data store can decrypt it and, depending on how the key is reused, potentially forge or tamper with protected values. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), but IBM rates the flaw CVSS 9.8 and a vendor patch is available.
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML SSO endpoint does not verify whether an upstream identity provider is restricted to account-linking-only mode. An attacker who controls a linked upstream identity can drive that endpoint to complete a full login rather than a mere link operation, seizing complete access to the corresponding local user account. Red Hat has shipped fixes; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.19%).
Heap-based buffer overflow in lib60870-C 2.4.0 affects the server-side FileSegment ASDU encoding path, where FileSegment_encode() checks only the standalone segment length via FileSegment_GetMaxDataSize() but never verifies remaining capacity in the current ASDU frame before writing object fields and segment data. In IEC 60870-5-101/104 telecontrol servers using the library's file transfer functionality, this out-of-bounds heap write can corrupt memory, enabling denial of service and potentially remote code execution. There is no public exploit identified at time of analysis, and the flaw is tracked upstream as issue #201 against the current 2.4.0 release.
Insecure deserialization (CWE-502) in Apache Lucy affects all versions of this retired full-text search engine library, allowing an attacker who can supply crafted serialized data to a Lucy-backed application to corrupt reconstructed object state and potentially achieve code execution or logic abuse during deserialization. Because Apache Lucy is retired, the ASF has explicitly declined to ship a fix, so exposure is permanent for any deployment still using it. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Kernel memory corruption in the Linux IPsec IP-TFS/AGGFRAG (xfrm iptfs) receive path allows crafted or normal traffic arriving on an IPTFS tunnel to corrupt kernel memory and panic affected hosts (introduced in Linux 6.14, fixed in 6.18.42, 7.1.6 and 7.2-rc4). Because iptfs_skb_add_frags() fails to propagate the SKBFL_SHARED_FRAG flag when copying page-pool-backed shared frags, a subsequent nested transport-mode esp_input() takes the no-COW fast path and decrypts in place over pages still referenced by the outer SKB. There is no public exploit identified at time of analysis and EPSS is low (0.15%), consistent with the narrow, non-default configuration required.
Cross-site request forgery in Pluck CMS's admin panel lets a remote attacker force a logged-in administrator's browser to execute forged admin.php actions, escalating to stored XSS (via raw-HTML page creation) and remote code execution (via malicious PHP module/theme installation). The admin area protects every action solely with a Referer-header check and ships no anti-CSRF tokens; because an attacker page can suppress the Referer header, the check's fallback branch treats headerless requests as same-origin and is bypassed. No public exploit or CISA KEV listing exists yet, but the CVSS 9.6 rating and trivial bypass make this a high-priority issue for exposed installs.
Heap buffer overflow in libXfont2's font-server client allows a malicious or compromised font server to overflow the X server's heap with attacker-controlled content by sending overlapping glyph source offsets. Affected systems running X server as root are exposed to privilege escalation; unprivileged X server instances crash with denial of service. All libXfont2 versions prior to 2.0.9 are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attacker-controlled write primitive makes this a high-severity memory corruption issue.
Privilege escalation in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to forge a crafted internal authentication header and elevate from a low-privileged account to system-level administrative access. The flaw stems from improper validation of the origin/trust of an internal auth header (CWE-346), and carries a critical CVSS 4.0 base score of 9.4 driven by high confidentiality, integrity, and availability impact plus a scope change onto subsequent systems. There is no public exploit identified at time of analysis; Google patched the cloud-hosted service transparently and states no customer action is needed.
Backdoored firmware in Zbtlink routers ships ENDLESSDOORS, an embedded implant (librctl.so, based on the open-source ycsunjane/rctl tool) present in every published build across the product line, granting unauthenticated remote root code execution. Started at boot as root and masquerading as a kernel [kworker/*] thread, it beacons every ~35 seconds over cleartext, unauthenticated TCP to a hardcoded command-and-control server, passing any received command to popen() as uid=0 and offering an interactive root shell via a reserved 'rctlbash' command. Because the channel has no authentication or encryption, control is not restricted to whoever planted it - anyone who answers at the C2 address, hijacks the network path (DNS/route), or registers the hardcoded fallback domain obtains root; no public exploit is identified in the input and there is no CISA KEV listing, though the underlying rctl tooling is publicly available open-source code.
Sandbox escape leading to remote code execution in FrontMCP (agentfront/frontmcp) before 1.5.7 lets a single tools/call to the codecall:execute tool break out of the script sandbox and run arbitrary code as the server user. The security membrane hands back live host Zod v4 schema instances via getTool(), giving script authors a path to the host Function constructor and full process control, exposing OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud metadata. Because the framework ships DEFAULT_AUTH_OPTIONS in public mode, unconfigured servers expose this to unauthenticated callers, and publicly available exploit code exists in the form of the fix commit's regression tests demonstrating the exact escape technique.
Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets a remote, unauthenticated attacker execute arbitrary JavaScript in the browser of an authenticated administrator who is lured to a crafted URL. Because the payload runs with the admin's authenticated session, it can harvest credentials/session tokens and perform privileged database and configuration actions on the admin's behalf. Rated CVSS 9.3 (scope-changed); no public exploit identified at time of analysis and not listed in CISA KEV.
Account takeover in the Membership Plugin - Kadence Memberships (formerly Restrict Content) for WordPress affects all versions through 4.0.0 via password-reset link poisoning. The legacy lost-password handler trusts an attacker-controlled rc_redirect POST value, so an unauthenticated attacker can trigger a reset email for any account (including administrators) whose reset link points at an attacker-controlled host carrying a valid key/login; when the victim clicks it, the reset key leaks and can be replayed to seize the account. No public exploit identified at time of analysis, and the flaw is not in CISA KEV, but Wordfence-confirmed root cause and a straightforward primitive make this a high-priority patch (CVSS 9.3).
Out-of-bounds heap read and write in libXfont2's font server client (all versions prior to 2.0.9) allows a malicious or compromised network font server to corrupt X server heap memory, enabling privilege escalation when the X server runs as root or denial of service via crash in unprivileged configurations. The flaw arises because fs_read_glyphs() in src/fc/fserve.c allocates the encoding[] array based on num_extents from one protocol reply but indexes it using num_chars from a separate reply with no cross-validation, so a crafted server can send mismatched values to trigger OOB heap reads and attacker-controlled OOB heap writes. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor-released fix is confirmed in libXfont2-2.0.9.
Account takeover in Flarum forum software before 1.8.16 lets remote unauthenticated attackers reuse expired password reset tokens by POSTing them directly to the reset endpoint, bypassing the 24-hour token lifetime that is only enforced when the reset form is rendered. Because SavePasswordController::handle() calls PasswordToken::findOrFail() with no expiry check, anyone holding a stale-but-still-existing token can set a new password and log in as that user. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Rancher's authorization (SAR) impersonation middleware lets an authenticated user holding only the default 'user' global role forge Impersonate-User and Impersonate-Group HTTP headers (e.g. impersonating cluster-admin or the system:masters group) to obtain full administrative control of the Rancher control plane and, transitively, every downstream cluster it manages. The flaw stems from the middleware trusting client-supplied impersonation headers instead of the authenticated identity in the request context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the upstream fix in rancher/rancher PR #55983 and advisory GHSA-v584-7w32-jwpq confirm the root cause and remediation.
Unauthorized arbitrary media deletion in the Multi Uploader for Gravity Forms WordPress plugin (all versions through 1.1.8) lets unauthenticated attackers permanently destroy any media library attachment. The flaw stems from the AJAX file-delete handler being wired to the nopriv hook without a capability check, while the CSRF nonce is leaked in page source, defeating the only protection present. No public exploit is identified at time of analysis, but exploitation is trivial and the EPSS/KEV signals are not yet populated for this recently disclosed issue.
HTTP request smuggling in Progress MarkLogic Server's HTTP App Server (versions before 11.3.6 and 12.0.3) lets a remote attacker desynchronize request parsing between a fronting reverse proxy and MarkLogic, enabling authentication/authorization bypass, session hijacking, and credential capture. The flaw is exploitable over the network without authentication (PR:N) and carries a critical 9.1 CVSS with high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.
Privileged file manipulation in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows an authenticated attacker to abuse improper symbolic-link resolution (CWE-59) to read, overwrite, or destroy files outside intended boundaries, with a scope-changing impact that reaches beyond the vulnerable process. The flaw was found during Cisco's internal SD-WAN security review and remediated in hardening releases; it carries a CVSS 9.1 rating driven by network reach, low complexity, and high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the high base score and management-plane exposure make it a meaningful patching priority.
Credential brute-forcing against Typemill CMS (versions up to and including 2.25.0) is possible because its primary password-login endpoint (POST /tm/login, ControllerWebAuth::login()) implements no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled - the default state. Any unauthenticated attacker can submit unlimited password guesses against any account, including administrators, enabling account takeover of weakly-protected credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthorized data modification in the Easy Post Submission plugin for WordPress (all versions through 2.3.0) lets unauthenticated attackers overwrite the title, content, excerpt, categories, tags, and publication status of any existing post by supplying its postId to a public AJAX endpoint. Because the rbsm_submit_post action is registered for logged-out users with no capability check, an anonymous request can silently rewrite or unpublish arbitrary site content, an integrity- and content-availability-focused flaw scored CVSS 9.1. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Out-of-bounds write in the LINUXTCP demo port of FreeModbus (cwalter-at fork) lets a remote, unauthenticated attacker overflow the static aucTCPBuf receive buffer by sending a single crafted Modbus TCP (MBAP) frame. Because the xMBPortTCPPool() length validation uses a strict '>' instead of '>=' against the 263-byte MB_TCP_BUF_SIZE, a frame declaring Length 264 passes the check and recv() writes 7 bytes past the buffer into the adjacent usTCPBufPos variable, corrupting parser state. CVSS is 9.1 (I:H/A:H); there is no public exploit identified at time of analysis and it is not on CISA KEV.