Unrestricted file upload in SourceCodester Online Examination & Learning Management System 1.0 exposes the server to arbitrary file upload via the upload_files.php endpoint, which lacks adequate file type or extension enforcement. The CVSS 4.0 vector indicates low-privilege authentication is required (PR:L) over a network vector with low complexity, and the 'Authentication Bypass' tag raises the possibility that this authentication gate may itself be circumventable. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the attack class is well-understood and trivially weaponizable against affected deployments.
Apache Polaris incorrectly enforces storage location boundaries during Iceberg table and view registration, enabling an authenticated principal with registration privileges to cause the catalog service to read S3 objects outside the configured allowed storage perimeter. Exploitation depends on a deployment running S3 credential vending where the catalog's underlying credentials can access objects beyond the allowed boundary - a constrained but realistic enterprise configuration. The demonstrated impact is limited to partial confidentiality disclosure of out-of-bounds objects; no unauthorized write or availability impact has been demonstrated, and no public exploit or active exploitation has been identified at time of analysis.
Security Optimizer WordPress plugin versions 1.5.8 through 1.6.4 expose a bypass in its optional IP-based login restriction feature, allowing unauthenticated remote users from non-allowlisted IP addresses to reach the WordPress login form despite administrator-configured access controls. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network exploitability with no authentication or user interaction required to perform the bypass. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, sites relying on the IP restriction as a primary login protection layer face elevated credential attack exposure.
Authorization bypass in the Ad Inserter WordPress plugin (all versions through 2.8.16) allows unauthenticated remote attackers to read ad block contents that administrators have restricted to administrator-only visibility, by invoking the unguarded `ai_ajax` AJAX function. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial unauthenticated network exploitation with no user interaction required. No public exploit has been identified at time of analysis, but two upstream WordPress plugin repository changesets (3583409, 3567905) indicate a fix has been committed.
Unauthenticated information disclosure in OpenReception appointment-booking-software prior to version 1.0.5 exposes private channel metadata through the public `/api/tenants/{id}/schedule` endpoint, bypassing the `isPublic` flag that governs channel visibility in the booking UI. Any caller with a valid tenant ID can retrieve channel names, descriptions, IDs, agent associations, pause status, confirmation requirements, and computed slot availability for channels deliberately configured as internal-only - data that the product's own design intends to hide from public callers. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial unauthenticated reachability requiring no special conditions.
Frontend form upload validation in Statamic CMS fails to enforce administrator-configured file type restrictions, allowing unauthenticated visitors to upload disallowed extensions through public-facing forms containing `assets` or `files` fields. The bypass is constrained: Statamic's global allowlist continues to block truly dangerous executable types such as `.php` and `.html`, meaning direct remote code execution is not achievable through this flaw alone. No public exploit code has been identified at time of analysis; vendor-released patches are available in versions 5.74.3 and 6.24.2.
Unauthenticated sensitive data exposure in the Export Import Menus WordPress plugin (versions up to and including 1.9.2) allows remote, unauthenticated attackers to access sensitive information by invoking the plugin's export functionality without any credentials. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the plugin returns sensitive data in its HTTP responses to unauthenticated requests. No public exploit code has been identified at time of analysis, and this CVE does not appear on the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated sensitive data exposure in the Custom CSS and JavaScript WordPress plugin (by WP Zone) versions up to and including 2.0.16 allows remote unauthenticated attackers to read sensitive information via network-accessible endpoints. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the flaw permits retrieval of data that the plugin transmits without requiring any authentication, with a CVSS 3.1 score of 5.3 (Medium). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated sensitive data exposure in the YITH WooCommerce Zoom Magnifier WordPress plugin (versions ≤ 2.52.0) permits remote, unauthenticated attackers to retrieve sensitive information without any credentials. Classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the plugin exposes data through a network-accessible endpoint that lacks proper authorization controls. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity makes opportunistic discovery straightforward.
CAPTCHA bypass in Element Pack Elementor Addons (WordPress plugin by BDThemes) versions up to and including 8.7.13 allows unauthenticated remote attackers to circumvent CAPTCHA verification on protected forms. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw enables automated or scripted clients to submit forms without completing the CAPTCHA challenge, undermining bot-protection controls. No public exploit code or active exploitation has been identified at time of analysis; CVSS rates this Medium (5.3) with integrity-only impact.
CAPTCHA 4WP WordPress plugin (versions up to and including 7.6.0) allows unauthenticated remote attackers to bypass CAPTCHA verification entirely, undermining bot-protection controls on any form the plugin secures. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw suggests the verification logic can be defeated without completing the human challenge - enabling automated abuse of protected endpoints. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector confirms trivially exploitable, zero-prerequisite network access; no public exploit code and no CISA KEV listing are identified at time of analysis.
Price manipulation via client-supplied ticket values in Event Booking Manager for WooCommerce (Pro) before 5.0.3 allows unauthenticated attackers to book paid event tickets at arbitrary prices, including free. The plugin's native (non-WooCommerce) checkout flow trusts the per-ticket price submitted by the client rather than re-deriving it from the server-side event configuration - a classic business logic failure. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication and no special preconditions beyond the affected checkout mode being in use.
Price manipulation in WP Hotel Booking WordPress plugin before 2.3.3 allows unauthenticated remote attackers to create confirmed hotel reservations for free or at an arbitrarily reduced price by submitting negative room quantities or manipulated cart totals. The plugin trusts client-supplied cart data without server-side validation, enabling financial fraud against any hotel or accommodation operator running the unpatched plugin. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the attack requires no authentication and low complexity, making it trivially reproducible by any motivated attacker.
Broken access control in the SureCart WordPress e-commerce plugin through version 4.6.2 permits unauthenticated remote attackers to access protected resources without credentials or user interaction, as confirmed by the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector and CWE-862 (Missing Authorization) classification. The impact is scoped to limited confidentiality exposure (C:L/I:N/A:N), consistent with unauthorized read access to restricted data such as order or customer records rather than write or execution capability. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog, though the zero-friction exploitation conditions mean any unpatched internet-facing SureCart installation is trivially reachable.
Unauthenticated IDOR in Mercado Pago payments for WooCommerce plugin (≤8.9.0) exposes order or payment objects to remote attackers without any authentication requirement. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible exploitation at low complexity with no credentials needed, resulting in limited confidentiality breach (C:L). No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry point makes enumeration of payment and order references realistic for opportunistic actors targeting WooCommerce storefronts.
Cross-tenant namespace disclosure in LangGraph's PostgreSQL and SQLite checkpoint stores allows an authenticated low-privileged user to read stored items belonging to other namespaces without any crafted input. The flaw arises from translating hierarchical namespaces into dot-joined strings and scoping reads with SQL LIKE patterns that have no understanding of the segment separator, so a query scoped to 'foo' also returns data from 'foobar' or 'foo2'. Exploitation requires the specific precondition of prefix-overlapping or wildcard-containing namespace labels; no public exploit code exists and the vendor confirms no evidence of in-the-wild exploitation.
Email header injection in Element Pack Addons for Elementor (versions up to and including 8.3.15) allows unauthenticated network attackers to append arbitrary headers to contact form emails by submitting newline characters via the `element_pack_contact_form` AJAX action. Insufficient sanitization of CRLF sequences in user-supplied input enables header manipulation - enabling BCC/CC abuse, From spoofing, or use of the site as a spam relay. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA KEV; however, exploitation requires no authentication and trivial technical skill, making opportunistic mass abuse realistic against any unpatched installation.
Unauthenticated sensitive data exposure in the Featured Video Plus WordPress plugin (versions <= 2.3.3) allows any remote attacker to retrieve sensitive information without credentials via a crafted network request. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable against any default installation of the plugin with no prerequisites beyond network access. Classified under CWE-201, the plugin inserts sensitive information into its sent data, making it passively harvestable. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated broken access control in the Profile Builder WordPress plugin (versions up to and including 3.16.5) allows remote, unauthenticated attackers to perform unauthorized write operations against plugin functionality - bypassing intended access restrictions without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms full network exploitability with no prerequisites, though impact is limited to low-severity integrity modifications with no confidentiality or availability consequences. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Dokan WordPress multi-vendor marketplace plugin (all versions through 5.0.10) allows network-accessible exploitation of its custom role permission system, enabling unauthorized integrity-affecting actions. The flaw stems from CWE-862 (Missing Authorization), where the plugin fails to verify whether a requester holds the appropriate capability before executing role-gated operations. No public exploit code or CISA KEV listing exists at time of analysis; CVSS rates this medium severity (5.3), with the original vector asserting no privileges required and no user interaction.
Unauthorized membership activation in the Simple Membership WordPress plugin (before version 4.7.7) lets unauthenticated attackers obtain paid membership access at no cost by exploiting the absence of PayPal merchant account verification during payment notification processing. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, unauthenticated network exploitation requiring no user interaction. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch (version 4.7.7) is available.
WP Travel Engine WordPress plugin before 6.8.2 allows unauthenticated attackers to fraudulently mark travel bookings as fully paid by exploiting missing PayPal IPN (Instant Payment Notification) validation. The plugin neither verifies that the incoming payment notification was directed to the site's configured merchant account nor confirms that the paid amount matches the booking total, enabling attackers to complete a minimal token payment to their own PayPal account and trigger a spoofed notification that the plugin blindly accepts. With a CVSS 5.3 and no public exploit or KEV listing at time of analysis, the technical severity appears moderate, but the business impact - obtaining travel services without payment - is materially higher than the base score reflects.
Payment bypass in RegistrationMagic WordPress plugin before 6.0.9.5 enables unauthenticated attackers to finalize arbitrarily-priced paid registrations using any previously-completed PayPal capture, regardless of its amount, currency, or intended payee. The plugin's server-side verification confirms only that a PayPal capture carries COMPLETED status, entirely omitting validation that the captured amount matches the registration fee, that the payee is the site's own account, or that the capture has not already been consumed. Because captures are not deduplicated, a single low-value legitimate capture can be replayed indefinitely to enroll unlimited users in high-value paid registrations at no cost - constituting scalable financial fraud. No public exploit or CISA KEV listing has been identified at time of analysis.
Payment notification forgery in WP Hotel Booking WordPress plugin before 2.3.2 allows unauthenticated remote users to obtain confirmed hotel bookings without submitting any real payment. The plugin fails to validate two critical conditions when processing inbound payment notifications: that the notification originates from the site's own merchant account, and that the reported payment amount matches the actual booking total. An attacker can exploit this by submitting a crafted payment callback (e.g., a fake IPN-style webhook) to have any booking marked as fully paid. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated payment notification forgery in the Five Star Restaurant Reservations WordPress plugin (all versions before 2.7.23) enables remote attackers to fraudulently mark arbitrary pending reservations as paid and confirmed without completing actual payment. The plugin's payment webhook handler accepts incoming IPN-style callbacks without verifying the notification's cryptographic authenticity, recipient identity, payment amount, transaction status, or binding to a specific booking - every control that prevents payment bypass is absent. No public exploit has been identified and this vulnerability is not listed in CISA KEV, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the attack is network-accessible, requires zero privileges and zero user interaction, making it accessible to unsophisticated actors.
CatchPulse's named pipe IPC interface exposes internal security functions without adequate caller authentication, enabling a low-privileged local attacker to invoke privileged operations within the endpoint security product. The vulnerability carries a CVSS 3.1 score of 5.2 (Medium) with a scope change component, indicating the attacker can affect the higher-privileged CatchPulse service process from a low-privilege context. No public exploit code or CISA KEV listing exists at time of analysis; impact is bounded by the vendor description to operations that apply more restrictive security policies, limiting the severity.
Stored Vue template injection in CTI-Transmute ≤ 1.5.0 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser of any user who views a compromised public conversion detail page. The attack bypasses Jinja2 HTML escaping because server-rendered values are injected into DOM regions subsequently compiled by Vue's runtime engine, which interprets the attacker-controlled `[[ ... ]]` expressions as live template code. The application's nonce-based CSP provides no protection because Vue's runtime compiler requires the `unsafe-eval` exception, permitting Function constructor escalation; no public exploit code beyond the proof-of-concept payload technique described in the advisory has been identified at time of analysis, and this CVE is not listed in CISA KEV.
URL path injection in GitHub CLI (gh) prior to version 2.97.0 allows attacker-controlled repository names or resource values containing URL path metacharacters to redirect the tool's REST API requests to unintended GitHub API endpoints. The root cause is that HTTP request paths are assembled via Go's fmt.Sprintf by interpolating untrusted values - such as repository owner, name, or branch - without percent-encoding, enabling path traversal through the API surface. No public exploit has been identified at time of analysis, and the vulnerability requires active user interaction with an attacker-controlled repository.
Workspace Save API in Frappe prior to version 16.18.0 permits any authenticated user to overwrite another user's private workspace by supplying an arbitrary workspace identifier, and to inject persistent malicious scripts into that workspace. The root cause is a missing ownership check in the `save_page` handler in `frappe/desk/doctype/workspace/workspace.py`, confirmed by the vendor fix and classified as stored XSS (CWE-79). No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the low exploitation complexity for any authenticated user and the persistent, targeted nature of the injection make it a meaningful risk in all multi-user Frappe and ERPNext deployments.
Stored cross-site scripting in Frappe's Data Import feature allows an authenticated user with import permissions to inject persistent script payloads via maliciously crafted column headers in imported files. The unescaped headers are rendered in import preview and warning messages, causing script execution in the browser of any other user who subsequently views the import interface. Affected are all Frappe deployments on the 15.x branch prior to 15.109.0 and the 16.x branch prior to 16.19.0; no active exploitation has been confirmed (no CISA KEV listing) and no public exploit code has been identified at time of analysis.
Cross-site request forgery in Hubzilla 11.2.1 and earlier allows a remote unauthenticated attacker to register arbitrary OAuth2 applications under an authenticated victim's account by inducing the victim to visit a malicious page containing an auto-submitting HTML form. The OAuth2 /authorize endpoint handler (Zotlabs\Module\Authorize::post()) performs no CSRF token validation and no Origin or Referer header checks, so a forged cross-origin POST carrying attacker-chosen client_id, client_secret, redirect_uri, and scope parameters is processed silently. The persistence of the rogue OAuth2 registration means the victim's future OAuth2 authorization codes can be intercepted via the attacker-controlled redirect_uri, yielding delegated account access well after the initial attack. No public exploit code or CISA KEV listing has been identified at time of analysis, though a screen recording referenced in the advisory may constitute a functional demonstration.
Token invalidation failure in WSO2 products allows authenticated users whose internal roles have been revoked to retain those privileges until their existing tokens naturally expire. The flaw means that administrative role-removal actions have no immediate security effect - a revoked user continues to hold a valid, exploitable credential granting access to resources they are no longer authorized to reach. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV, but the business impact of failed privilege revocation can be significant in environments where timely access termination is a compliance requirement.
eta-otp-lock before version 1.0.4 exposes sensitive information - likely OTP codes or credentials - as visible process arguments during invocation, enabling local system footprinting by other users. The vulnerability maps to CWE-214, where secrets passed via command-line arguments or process environment can be read by any local user through standard OS interfaces such as /proc or ps. No public exploit code exists and the product is not listed in CISA KEV, but the high confidentiality impact reflects the sensitivity of OTP material if intercepted.
html_sanitize_ex's HTML5 scrubber (versions 0.3.1 through 1.5.2) permits the `form` and `formaction` attributes to survive sanitization on `<input>` elements, enabling unauthenticated remote attackers to silently hijack existing page forms and redirect victim submissions - including credentials - to an attacker-controlled endpoint. The attack exploits HTML's native form association model (no script required), but succeeds only when the rendering page already contains a form with a known or guessable `id` attribute. No active exploitation or CISA KEV listing has been identified at time of analysis, and no EPSS score was included in source data.
Shortcode injection in the Ninja Forms WordPress plugin (versions before 3.14.10) allows unauthenticated network attackers to execute arbitrary WordPress shortcodes registered on a target site by supplying crafted query-string parameters that are processed without sanitization as form field default values. Exploitation is constrained by a non-default site configuration requirement - a form must be configured with query-string pre-population and embedded on a public page - which the CVSS AC:H rating reflects. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor-supplied patch (3.14.10) is available.
Path traversal in NocteDefensor LudusMCP up to version 1.0.24 allows a low-privileged local user to read files outside the intended directory by manipulating the guide_name argument in the ludus_environment_guides_search tool component (src/tools/ludusEnvironmentGuidesSearch.ts). All 25 tracked releases from 1.0.0 through 1.0.24 are affected. No patch has been released - the vendor was notified via GitHub issue but has not responded at time of analysis. No public exploit identified at time of analysis, though a separate public exploit report issue exists on GitHub (gongyaugugyy/public_exp), indicating the finding has been disclosed beyond the vendor.
Sensitive information disclosure in WSO2's Carbon Event Publisher Core affects nine WSO2 platform products, including API Manager, Identity Server, and Open Banking components. When an Event Publisher output adapter is misconfigured with extraneous or irrelevant properties, those property values - which may include user credentials or confidential data - are written to the wso2carbon log files without sanitization or masking (CWE-532). A local, high-privileged actor with read access to those log files can extract the inadvertently logged secrets and leverage them for unauthorized access. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Missing authorization in eScriptorium's WebSocket consumer (all versions through 26.04.1) allows any authenticated user to subscribe to arbitrary document event streams without access verification. By supplying a target document's object_cls and object_pk in a join-room WebSocket message, an attacker's connection is added to that document's channel group via group_add with no permission check, exposing real-time segmentation, transcription, import, export, and AI training activity belonging to other users. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS data was not provided in the available intelligence.
User enumeration via the Statamic CMS Control Panel exposes registered email addresses to any authenticated CP user, regardless of whether they hold the 'view users' permission. The `user.exists` POST endpoint - designed for the user creation wizard - returns a boolean confirming whether a given email is registered, allowing low-privileged CP accounts to enumerate the user directory without authorization. Affected versions are composer/statamic/cms below 5.74.1 (5.x branch) and 6.0.0-6.24.0 (6.x branch); no public exploit has been identified at time of analysis.
WSO2 Identity Server's implicit-association resolver incorrectly initializes from a secondary user store rather than the primary store when multiple user stores are configured, causing identity confusion during external IDP authentication flows. When the same lookup claim - such as a username or email address - exists in both the primary and a secondary store, an external IDP subject is silently associated with the wrong local account, either denying legitimate users their expected access level or, in adversarially constructed scenarios, potentially hijacking an IDP association intended for a primary-store user. The vulnerability is only triggered when secondary user stores are active, implicit association is enabled, and duplicate claim values exist across stores - deployments not meeting all three conditions are unaffected. No public exploit code has been identified at time of analysis and the issue is not listed in the CISA KEV catalog.
Insecure Direct Object Reference (IDOR) in the Colissimo Officiel WooCommerce shipping plugin (≤2.10.0) enables authenticated low-privileged customers to access shipping or order objects belonging to other users by manipulating controllable object references in plugin requests. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms network-exploitable, low-complexity exploitation limited to authenticated WooCommerce customer accounts, with impact confined to limited confidentiality exposure of delivery data. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Tenant isolation failure in WSO2 Identity Server allows authenticated low-privilege users to disclose personally identifiable information belonging to users in separate tenants. The vulnerability exists specifically when Email OTP, SMS OTP, or Magic Link are configured as first-factor authenticators - authentication requests processed through these flows lack sufficient validation to enforce organizational tenant boundaries, exposing data such as mobile numbers. No public exploit code or CISA KEV listing exists at time of analysis, but the low-complexity, network-accessible attack vector (CVSS PR:L/AV:N/AC:L) makes this a credible insider threat and compromised-account scenario for multi-tenant deployments.
WSO2 API Manager's Swagger UI Try-out console in the API Publisher portal accepts an externally supplied OpenAPI/Swagger definition URL, allowing that definition to override the legitimate API specifications rendered to users. An attacker who tricks an API Publisher user into visiting a crafted URL can substitute attacker-controlled backend endpoints for real ones, potentially harvesting authentication tokens, credentials, or other sensitive payloads submitted via the Try-out console. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; exploitation requires user interaction, confining realistic risk to targeted social engineering against developer or API management personnel.
Tutor LMS WordPress plugin before 3.9.14 fails to correctly scope enrollment checks when gating access to protected course content, meaning any authenticated subscriber enrolled in at least one course can freely access paid lessons, quizzes, and assignments from courses they never purchased. This breaks the revenue model of any site selling course content through the plugin, as a single free or low-cost enrollment grants lateral access across the entire content library. No public exploit code has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog.
Broken access control in the Advanced Custom Fields: Font Awesome Field WordPress plugin (versions up to and including 6.1.1) permits contributor-level authenticated users to perform privileged operations beyond their intended role. The CWE-862 root cause indicates the plugin fails to enforce proper authorization checks before executing certain functionality, allowing lower-privileged users to read data or invoke actions restricted to higher roles. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible attack vector and low privilege requirement make this exploitable by any user with a contributor account on affected WordPress installations.
Sensitive data exposure in the Gutenberg Blocks by Kadence Blocks WordPress plugin (versions <= 3.7.8) allows authenticated Contributor-level users to access information they should not be permitted to view. The CVSS vector (PR:L/C:L) confirms this is a low-privilege, partial confidentiality breach rather than a full data dump, limiting its severity to medium-low. No public exploit code has been identified and CISA KEV does not list this vulnerability, indicating no confirmed active exploitation at time of analysis.
Unauthorized plugin installation in the ThemeGrill Accelerate WordPress theme (versions up to and including 1.5.3) is possible because the enqueue_scripts() function performs no WordPress capability check before triggering ThemeGrill Demo Importer plugin installation. Any user holding at least a Subscriber-level account on the affected site can exploit this to install and activate an additional plugin, expanding the attack surface. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Cross-Site Request Forgery in the Theme My Login WordPress plugin (versions ≤7.1.14) enables unauthenticated attackers to trigger unauthorized state-changing actions on behalf of authenticated victims. The CVSS vector (PR:N/UI:R/I:L) confirms no attacker authentication is needed, though a victim must be lured to a malicious page - limiting mass exploitation but still representing a realistic social-engineering attack path for sites using this plugin to customize their authentication flows. No public exploit identified at time of analysis, and no CISA KEV listing is present.
Path traversal in the BOSH agent on Ubuntu allows an attacker positioned to manipulate IaaS metadata to cause the agent to write a root-owned file with partially attacker-controlled content to any filesystem path ending in '.network', while also creating missing parent directories with insecure 0777 permissions. All BOSH agent versions prior to v2.847.0 on Ubuntu jammy (<=v1.1202) and noble (<=v1.364) are affected. No public exploit has been identified and this is not listed in CISA KEV; however, the root-write primitive combined with 0777 directory creation warrants prompt patching in any Cloud Foundry or BOSH-managed deployment.
openvpnserv on Windows insufficiently validates command line arguments received from its control socket before passing them to the openvpn.exe process, allowing a low-privileged local user to circumvent administrator-defined restrictions on permitted OpenVPN configuration directories. Affected installations span OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 on Windows; fixed releases 2.6.22 and 2.7.6 shipped August 5, 2026. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 SC:H metric indicates that bypassing config directory controls could allow rogue VPN configurations to be loaded, with high downstream confidentiality impact on subsequent network systems.