Authentication bypass in Apple's macOS Screen Sharing service allows a network-adjacent attacker to establish a Screen Sharing session without supplying valid credentials, granting interactive remote control of the target Mac. The flaw affects macOS Sequoia before 15.7.9, macOS Sonoma before 14.8.9, and macOS Tahoe before 26.6.1, and was reported by Apple Product Security itself. There is no public exploit identified at time of analysis and it is not in CISA KEV, though the state-management defect underlying it can be reached over the network with low complexity.
Remote code execution in WGDashboard (a self-hosted WireGuard management web UI) versions up to 4.3.2 lets attackers inject OS commands that execute as root through multiple unsanitized input paths (CWE-78). Publicly available exploit code exists (Stuub PoC targeting v4.3.2), and CISA's SSVC framework rates the technical impact as total and the flaw as automatable, though it is not listed in CISA KEV. Note a data conflict: the CVSS vector marks this as unauthenticated (PR:N) while the description states exploitation requires an authenticated attacker.
Remote code execution in WGDashboard 4.3.2 and earlier lets authenticated attackers inject Server-Side Template Injection payloads that execute arbitrary commands as root, giving full host compromise. Publicly available exploit code exists (Stuub's SSTI-to-Root-RCE PoC), though the flaw is not listed in CISA KEV and carries a low EPSS score of 0.28% (20th percentile), indicating no evidence of widespread automated exploitation yet. The combination of a working PoC and root-level impact makes this a high-priority patch target for any internet-exposed WGDashboard instance.
Unrestricted file upload in ICS-Park Smart Park Management System v2.0 lets a remote attacker upload and execute arbitrary code through the product's file upload module, yielding full server compromise (CVSS 9.8). Public exploit code exists and the flaw is automatable with total technical impact per CISA SSVC, though the EPSS probability remains low at 0.26% (17th percentile), indicating limited observed exploitation activity so far. No CISA KEV listing means no confirmed active exploitation at time of analysis.
Server-Side Request Forgery in WGDashboard (WireGuard management dashboard) version 4.2.3 and earlier (EUVD extends the range through 4.3.2) lets attackers abuse the webhook functionality to make arbitrary HTTP requests from the server and read back full responses. The description scopes this to authenticated attackers, though the supplied CVSS vector marks it PR:N (unauthenticated) - a discrepancy defenders should resolve with the vendor. Publicly available exploit code exists (Stuub PoC), but EPSS is only 0.16% (6th percentile) and there is no public exploit identified as actively exploited.
Unauthenticated arbitrary file read in OpenChamber 1.11.7 lets remote attackers pull any file off the host by setting the allowOutsideWorkspace=true query parameter with an absolute path against the /api/fs/read, /api/fs/stat, and /api/fs/raw endpoints. Because the workspace boundary check in resolveReadPathFromContext relies on a vacuous isPathWithinRoot guard, attackers can harvest the JWT signing secret, SSH private keys, and API credentials, then forge session cookies to fully bypass authentication on password-protected deployments. Reported by VulnCheck with an upstream fix committed; no public exploit identified at time of analysis.
SQL injection in the WPCargo Track & Trace WordPress plugin before version 8.0.4 allows unauthenticated attackers to inject arbitrary SQL through an improperly sanitised parameter, exposing the WordPress database. Reported by WPScan with publicly available exploit code, this flaw is notable for affecting a code path distinct from the previously patched CVE-2024-44004, indicating an incomplete prior fix. Despite a CVSS 9.1 and public POC, the EPSS score is low (0.18%, 7th percentile) and the CVE is not on CISA KEV, so there is no public exploit identified as actively exploited in the wild.
Unauthenticated arbitrary file deletion in the Drag and Drop Multiple File Upload for WooCommerce WordPress plugin (all versions before 1.1.8) lets anonymous attackers destroy customer order attachments staged in the plugin's upload directory. The plugin's only access control on its deletion routine is a nonce, but that nonce can be freely obtained by unauthenticated visitors, defeating the check entirely. Publicly available exploit code exists and a vendor patch has been released; EPSS is low (0.14%) and the issue is not in CISA KEV.
Remote code execution in Dell Virtual Storage Integrator (VSI) for VMware vSphere Client, all versions prior to 10.11.1.0, lets an unauthenticated remote attacker inject OS commands through the IAPI component and run them as root on the appliance's host OS. Because the flaw requires no authentication and no user interaction over the network, it enables full compromise of the VSI deployment and the storage infrastructure it manages. No public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated root RCE make this a top-priority patch.
Full unauthenticated site takeover in the Premium SEO WordPress plugin stems from an intentional backdoor shipped in the plugin code itself, which silently provisions a hidden administrator account and, in certain builds, exposes remote code execution, server-side request forgery, and arbitrary front-end content injection. Any WordPress site running this plugin is affected, and because the backdoor is reachable without authentication, an attacker who knows the endpoint gains complete control of the site. WPScan attributes the finding; no public exploit is identified at time of analysis and the CVE carries the maximum CVSS 10.0 score.
Supply-chain compromise of MonsterInsights Pro, a widely used WordPress Google Analytics plugin, delivered a malicious file (class-system-check.php) through the vendor's own S3 update bucket (monster-insights.s3.amazonaws.com). Both the current release (10.2.2) and the 10.2.0 build the vendor rolled back to are trojaned, so administrators who updated - or downgraded to remediate - received attacker-controlled PHP that runs with full site privileges. WPScan reports the attacker still holds write access to the bucket and was iterating on three AES-256-GCM payload variants on 2026-06-11; there is no CISA KEV listing and no public exploit code, but the malicious distribution is described as active and ongoing by the reporter.
Remote code execution in the Spider Analyser WordPress plugin (by wbolt.com) affects all versions up to and including 2.1.3, allowing remote attackers to inject and run arbitrary PHP code on the underlying web server without authentication. Because the CVSS vector carries PR:N/UI:N with a scope change, exploitation requires no login or user interaction and can compromise the entire hosting environment. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the maximal 10.0 score makes it a high-priority patch target for affected sites.
Unauthenticated arbitrary file upload in the Type Hub WordPress plugin (versions ≤ 2.0.6) lets remote attackers upload malicious files without any credentials, typically leading to remote code execution and full site compromise. The CVSS 3.1 base score is a maximum 10.0 with a changed scope (S:C), reflecting that a successful upload can pivot beyond the plugin into the underlying host. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the trivial attack complexity and lack of authentication make it an urgent patch priority.
Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane, and the Carbon API Manager REST API Utility) allows remote unauthenticated attackers to forge JWT tokens because the authentication layer accepts tokens signed with algorithms outside the explicitly configured/supported set. By crafting a JWT with an unsupported or attacker-chosen algorithm that is then incorrectly validated, an attacker can gain unauthorized access up to full administrative account takeover. Rated CVSS 10.0 (scope-changed) by WSO2, with the description noting a contained 9.8 score for single-tenant deployments; no public exploit identified at time of analysis.
Remote code execution in the Betheme WordPress theme (muffingroup) through version 28.4.2 allows a user holding a low-privileged Contributor account to inject and execute arbitrary PHP/code (CWE-94) on the underlying host. Because the CVSS vector marks scope as changed (S:C) with full confidentiality, integrity, and availability impact, a successful attack escapes the WordPress application boundary and can compromise the web server itself. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; risk is elevated by the very low privilege bar and the widespread commercial deployment of Betheme.
Privilege escalation in OpenReception's appointment booking platform (versions prior to 1.0.2) lets any TENANT_ADMIN promote an account to platform-wide GLOBAL_ADMIN with a single PUT request to the staff role-update endpoint. Because no policy check enforces that only an existing GLOBAL_ADMIN may grant that role, schema validation alone acts as the authorization gate, and after re-login the attacker's JWT carries platform-wide control over every tenant. No public exploit identified at time of analysis, but the fix is a one-line authorization guard, making the flaw trivially reproducible for anyone reading the GHSA advisory or patch commit.
Missing authorization in OpenReception's appointment booking platform (before 1.0.1) lets any unauthenticated network attacker POST to `/setup/create-admin-account` and mint additional GLOBAL_ADMIN accounts on an already-claimed, fully configured instance. The created account is immediately active (`is_active=true`, `confirmation_state=ACCESS_GRANTED`) with no email confirmation, granting full platform-level administrative control and successful login and tenant enumeration. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the root cause is confirmed by the vendor GHSA advisory and fix commit.
Account takeover in OpenReception's end-to-end encrypted appointment booking platform prior to 1.0.2 lets an unauthenticated attacker bind their own WebAuthn passkey to a victim's account. The registration handler at POST /api/auth/register/{userId} confirms the WebAuthn challenge matches the registration cookie's email but never checks that the {userId} in the URL belongs to that email, so an attacker registers a passkey for their own email against any victim's userId and is issued a session as the victim on the next login. No public exploit is identified at time of analysis (a live PoC is still pending) and it is not in CISA KEV, but the fix is confirmed in version 1.0.2.
PHP Object Injection in the Export User Data WordPress plugin (versions up to and including 2.2.6) allows attackers to inject crafted serialized objects that are deserialized by the plugin, potentially leading to remote code execution, data theft, or site takeover when a suitable POP gadget chain is present. Reported by Patchstack (EUVD-2026-53980) and rated CVSS 9.8, though the Patchstack title labels it a 'Subscriber' issue, implying a low-privileged account is actually required. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in FineAdmin V1.0 (FineAdmin.Mvc) lets remote attackers inject arbitrary SQL through the `field` and `order` parameters of paginated list endpoints, where user input is concatenated into an ORDER BY clause that cannot be safely parameterized. NVD rates it CVSS 9.8 with full confidentiality, integrity, and availability impact, and public GitHub write-ups documenting the ORDER BY-clause injection exist, though EPSS remains low at 0.40% (33rd percentile) and it is not in CISA KEV - so no public exploit is confirmed as weaponized. The 'RCE' tag reflects theoretical escalation from SQLi to code execution (e.g. via stacked queries), but the demonstrated impact is database compromise.
Sensitive information disclosure in Dell Virtual Storage Integrator (VSI) for VMware vSphere Client, all versions prior to 10.11.1.0, lets an unauthenticated remote attacker retrieve active session credentials and hijack authenticated sessions, including those of administrators. Because stolen session tokens grant full impersonation of legitimate users, Dell rates this critical (CVSS 9.8); there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the SSVC framework flags it as automatable with total technical impact. EPSS remains low at 0.39% (32nd percentile), consistent with the absence of observed exploitation to date.
PHP Object Injection in the Ajax Search Lite WordPress plugin (versions ≤ 4.14.4) lets unauthenticated remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, enabling object instantiation that - when paired with a suitable gadget chain in the plugin or wider WordPress runtime - can lead to remote code execution, data theft, or site takeover. Reported by Patchstack and tracked as EUVD-2026-53942, it carries a CVSS of 9.8 (fully unauthenticated network vector). No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Supply-chain compromise of the Supsystic Pro WordPress plugin family delivered trojanized plugin updates from the vendor's own compromised update server, giving unauthenticated attackers a foothold on every site that pulled the poisoned release. The embedded malicious code fetches a second-stage payload that harvests credentials and other sensitive data and hands the operator full control of the affected WordPress site. Reported by WPScan; no public exploit is identified and the issue is not listed in CISA KEV at time of analysis, though the delivery mechanism means the implant is effectively pre-planted rather than requiring an active attack against each target.
Unauthenticated privilege escalation in the AIWU (AI Copilot Content Generator) WordPress plugin versions 1.5.6 and earlier allows remote attackers with no authentication to gain elevated privileges within the WordPress site. Reported by Patchstack and tracked as EUVD-2026-53963, the flaw carries a CVSS 9.8 rating driven by network-reachable, no-interaction exploitation with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Privilege escalation in the Kadence WooCommerce Email Designer WordPress plugin (all versions up to and including 1.5.19) lets unauthenticated remote attackers gain elevated privileges due to a missing authorization check (CWE-862). Reported by Patchstack and tracked as EUVD-2026-53939, the flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, so no login or user interaction is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not confirmed in the wild.
PHP Object Injection in the AI ANN WordPress theme (by AxiomThemes) affects all versions up to and including 1.29.0, allowing unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the theme. When a suitable POP (property-oriented programming) gadget chain is present in the theme, WordPress core, or an active plugin, this can escalate to remote code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis, though the CVSS 9.8 rating reflects the unauthenticated, network-reachable nature of the flaw.
PHP Object Injection in the Agricola WordPress theme (versions ≤ 1.21.0 by AxiomThemes) lets unauthenticated remote attackers inject crafted serialized PHP objects that are deserialized by the application, and with a suitable POP gadget chain this can escalate to arbitrary file operations, SQL manipulation, or remote code execution. Rated CVSS 9.8 and disclosed by Patchstack (EUVD-2026-53878), it requires no authentication or user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV.
PHP Object Injection in the Agora WordPress theme (by AncoraThemes) affects all versions up to and including 1.9, allowing remote unauthenticated attackers to inject serialized PHP objects that are deserialized by the application. Because exploitation requires no authentication and no user interaction over the network, a successful attack can lead to full compromise (arbitrary code execution, data theft, or site takeover) when a suitable gadget chain is present in the theme or its plugin ecosystem. Reported by Patchstack (EUVD-2026-53996); no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
PHP Object Injection in the AncoraThemes 'Advice' WordPress theme (versions up to and including 1.18.0) lets unauthenticated remote attackers pass attacker-controlled serialized data into an unsafe PHP deserialization sink (CWE-502). Because a suitable POP (property-oriented programming) gadget chain in the theme or a co-installed plugin can then be triggered, this can escalate to arbitrary file operations, data disclosure, or remote code execution. Rated CVSS 9.8; reported by Patchstack, with no public exploit identified at time of analysis.
Unauthenticated PHP Object Injection in the Adrena WordPress theme (AncoraThemes) affects all versions up to and including 1.2.14, allowing remote attackers with no authentication to inject crafted serialized PHP objects that are deserialized by the theme. Exploitation can lead to full compromise (confidentiality, integrity and availability all High) when a suitable gadget chain is present in the WordPress core, an active plugin, or another theme. This flaw carries a CVSS 9.8 rating and was disclosed by Patchstack; no public exploit code has been identified and it is not listed in CISA KEV, so there is no public exploit identified at time of analysis.
Unauthenticated PHP Object Injection in the Accalia WordPress theme (by AncoraThemes) affects all versions up to and including 1.5.3, allowing remote attackers to inject crafted serialized PHP objects that are deserialized by the application. When a suitable POP (property-oriented programming) gadget chain is present in the theme, its plugins, or WordPress core, this can lead to remote code execution, data disclosure, or site takeover. The issue was reported by Patchstack and carries a CVSS 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the Abogado WordPress theme (by AncoraThemes) affects all versions up to and including 1.18, allowing remote attackers to inject crafted serialized PHP objects without authentication. If a suitable POP (property-oriented programming) gadget chain is present in the theme, its bundled plugins, or WordPress core, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Insecure deserialization in the Abelle WordPress theme (ThemeREX) versions 1.22 and earlier lets unauthenticated remote attackers inject crafted PHP objects that the application deserializes, enabling PHP Object Injection. Because attacker-supplied serialized data reaches unsafe unserialize() logic without authentication, an adversary can potentially achieve remote code execution, data tampering, or full site compromise depending on available gadget chains in WordPress core, the theme, or co-installed plugins. There is no public exploit identified at time of analysis, but the flaw carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, high-impact exploitation.
PHP Object Injection in the A.Williams (Alisha Williams) WordPress theme by AxiomThemes affects all versions up to and including 1.3.1, allowing remote unauthenticated attackers to inject crafted serialized PHP objects into an unsafe deserialization sink. When a suitable POP gadget chain is present in the theme or co-installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the 9.8 CVSS reflects theoretical worst-case impact rather than confirmed active exploitation.
Unauthenticated PHP Object Injection in the 69 Clothing WordPress theme (versions up to and including 1.2.11.1) lets remote attackers submit crafted serialized data that is unsafely deserialized, potentially triggering property-oriented programming (POP) gadget chains for code execution, data theft, or file manipulation. Reported by Patchstack and tracked as EUVD-2026-53989, it carries a critical CVSS 9.8 with no authentication required. There is no public exploit identified at time of analysis, but the network-reachable, unauthenticated nature makes it a high-priority patching target for any WordPress site running this theme.
PHP Object Injection in the WPBruiser {no- Captcha anti-Spam} WordPress plugin (versions ≤ 3.1.43) allows remote unauthenticated attackers to inject crafted serialized objects that are deserialized by the plugin, enabling arbitrary object instantiation and, when combined with a suitable POP gadget chain, code execution or data compromise. The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is reported by Patchstack (EUVD-2026-53983). No public exploit code was identified at time of analysis and it is not listed in CISA KEV, so there is no confirmed active exploitation.
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly issued token, to invoke product-level Admin REST APIs that should be restricted, potentially resulting in full administrative account takeover. The flaw stems from insufficient scope/privilege restriction on issued tokens (CWE-269) and affects API Manager, API Control Plane, Universal Gateway, Traffic Manager, and the Carbon REST API common/utility components. No public exploit identified at time of analysis; exploitation requires the attacker to already hold a low-privileged account and obtain a token for it.
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) lets remote unauthenticated attackers elevate their privileges, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector rated 9.8 Critical. The flaw (CWE-266, Incorrect Privilege Assignment) stems from the plugin's frontend user-management forms exposing role/capability assignment without proper authorization, enabling an attacker to gain administrator-level access to the WordPress site. No public exploit identified at time of analysis and the CVE is not on CISA KEV, but the CVSS profile indicates trivially weaponizable network-based abuse.
SQL injection in Loca Software Informatics Technology Ltd. Co. CMS (all versions up to and including build 06082026) allows remote unauthenticated attackers to inject arbitrary SQL through improperly neutralized input, per CVSS PR:N. Disclosed by Turkey's national CERT (TR-CERT/USOM), the flaw carries a critical 9.8 score with full confidentiality, integrity, and availability impact, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor was contacted but did not respond, so no fix is available.
Memory corruption (double-free) in the Linux kernel's SMB/CIFS client SMB2_close replay path can be triggered when a mounted SMB server returns a replayable error and a subsequent SMB2_close_init() fails, causing the same response buffer to be freed twice. It affects Linux stable kernels across the 6.6.x through 7.x series before the fixed releases; while the CNA-assigned CVSS is 9.8 with no public exploit identified at time of analysis, real-world abuse requires the victim host to communicate with a malicious or compromised SMB server, making this primarily a client-side memory-corruption/DoS concern rather than trivial remote code execution.
Access control bypass in Open Library Foundation VuFind versions 11.0.3 and 4.1 allows unauthenticated remote attackers to invoke controller functions that should be restricted. The AbstractBase::validateAccessPermission logic returns an 'access denied' response to the requester but fails to halt request processing, so the protected function still executes server-side. Categorized as an authentication/authorization bypass (CWE-863) with a reported CVSS 9.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unsafe deserialization in Apache CXF's JMS transport allows any party able to publish to the service's JMS destination to achieve denial of service or, where a compatible deserialization gadget chain is present on the application classpath, remote code execution within the CXF process. All Apache CXF versions prior to 4.2.3, 4.1.8, and 3.6.12 are affected when the JMS transport is in use. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability class (CWE-502 with unrestricted ObjectInputStream) is well-understood and tooling such as ysoserial makes it routinely exploitable wherever gadget libraries are present.
Sandbox escape in Google Chrome for Linux (versions before 151.0.7922.109) stems from a use-after-free in the Aura windowing subsystem, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and potentially break out of the renderer sandbox. Google rated the Chromium severity Critical (CVSS 9.6, scope-changed), but there is no public exploit identified at time of analysis and CISA's SSVC framework records exploitation status as 'none'. Because a full sandbox escape gives attacker code the privileges of the browser process on the host, this is a high-priority patch despite the absence of observed exploitation.
Sandbox escape in Google Chrome for Android before 151.0.7922.109 stems from a use-after-free in the WebGL graphics component (CWE-416), letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Chromium rates this Critical and CVSS scores it 9.6 with a scope change (S:C), reflecting the cross-boundary sandbox escape. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Chrome WebGL memory-corruption bugs are historically high-value exploitation targets.
Sandbox escape in Google Chrome's Web Authentication (WebAuthn) component before 151.0.7922.109 lets a remote attacker who lures a victim to a crafted HTML page corrupt memory via a use-after-free and potentially break out of the renderer sandbox. Rated High by Chromium and scored CVSS 9.6 (scope-changed), it affects the vast installed base of desktop Chrome; Google has shipped a fixed Stable-channel build. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sandbox escape in Google Chrome for Android before 151.0.7922.109 stems from an out-of-bounds write in ANGLE, Chrome's OpenGL ES/GPU translation layer, allowing a remote attacker who lures a victim to a crafted HTML page to corrupt GPU-process memory and potentially break out of the renderer sandbox. Chromium rates the issue Critical and a vendor patch is available, but there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. The high CVSS 9.6 reflects the scope-changing sandbox-escape potential rather than confirmed in-the-wild use.
Sandbox escape in Google Chrome desktop versions prior to 151.0.7922.109 stems from a use-after-free in the Payments component, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Rated High by Chromium and scored CVSS 9.6 due to a scope change, though exploitation requires user interaction (visiting a malicious page). There is no public exploit identified at time of analysis and no CISA KEV listing, but Chrome renderer/sandbox-escape bugs are historically high-value targets.
Sandbox escape in Google Chrome's Media component on Windows (versions prior to 151.0.7922.109) lets a remote attacker break out of the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and CVSS 9.6 because a successful escape yields full confidentiality, integrity, and availability impact beyond the sandboxed process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Chrome UAF media bugs are historically attractive targets.
Sandbox escape in Google Chrome's Codecs component (versions prior to 151.0.7922.109) allows a remote attacker to break out of the renderer sandbox when a victim views a crafted HTML page, via insufficient validation of untrusted input (CWE-20). Rated CVSS 9.6 with a changed scope, the flaw affects the desktop Stable channel across all platforms and is fixed in 151.0.7922.109. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Server-Side Request Forgery combined with CSRF in Eclipse GlassFish's DownloadServlet ContentSources handler allows a remote attacker to exfiltrate the administrative `gfresttoken` to an attacker-controlled host when an authenticated administrator visits a malicious page. Affecting Eclipse GlassFish 8.0.x prior to 8.0.4, successful token theft yields full control of the GlassFish administrative domain until the token expires, effectively an unauthenticated takeover of the management plane. No public exploit identified at time of analysis, and the issue is not in CISA KEV, but the CVSS 9.6 rating and low attack complexity make it high priority.