Broken Object Level Authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 through 9.6) permits any authenticated employee (provider) to read and modify the stored personal data of arbitrary customers by incrementing sequential record identifiers in the Employee Panel. The plugin fails to verify that the requesting employee has a legitimate relationship with the customer being accessed, enabling horizontal privilege escalation across all customer records. A publicly available exploit exists per WPScan, though EPSS of 0.13% (3rd percentile) suggests exploitation has remained uncommon; no CISA KEV listing has been confirmed at time of analysis.
Payment amount validation bypass in the Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin (all versions through 3.1.0) enables any customer to complete a purchase by paying less than the full order total, with the order subsequently marked as fully paid by the merchant system. The flaw lies in the PayPal Data Transfer (PDT) return handler, which processes the post-payment callback without performing server-side reconciliation of the amount actually transferred against the stored order total. A publicly available exploit is documented by WPScan, though EPSS at 0.14% indicates exploitation has not yet scaled to widespread automated abuse; the real risk is deliberate buyer fraud rather than opportunistic scanning.
LearnPress WordPress plugin before version 4.4.4 exposes a blind, bounded server-side request forgery (SSRF) exploitable by users holding the instructor role, allowing the WordPress server to issue HTTP requests to arbitrary external hosts chosen by the attacker. Reported by WPScan and tracked under CWE-918, the flaw stems from absent URL validation on a user-controllable input. A public proof-of-concept exists; however, EPSS at 0.14% (4th percentile) and the absence of a CISA KEV listing indicate negligible observed exploitation activity, consistent with the high-privilege requirement.
Unrestricted file upload via shell_exec in SaiAdmin up to version 5.0.1 exposes the Plugin Upload Endpoint (/app/saipackage/install/upload) to potential remote code execution by authenticated high-privilege users. The affected function passes uploaded plugin content through shell_exec without adequate file-type validation, a pattern consistent with CWE-434 that typically enables server-side code execution beyond simple file storage. A proof-of-concept exploit has been publicly disclosed on GitHub (CVE-2026-19383 issue), raising the operational risk above what the conservative VulDB-assigned CVSS 4.0 score of 5.1 might suggest; no vendor patch has been identified at time of analysis.
Memory leak exploitation in Almico Speedfan 4.52 is constrained to local, high-privilege access and produces limited availability degradation via the speedfan.sys kernel driver's MSR Index Handler. The vulnerability resides in the KiSystemCall64 handler path within speedfan.sys, where kernel pool memory is allocated but never released during MSR index processing, enabling gradual resource exhaustion on affected Windows hosts. A publicly available proof-of-concept exists, no vendor patch has been issued, and the vendor has not responded to coordinated disclosure.
Local availability degradation in Mullvad's wireguard.sys kernel driver 0.10.1 stems from improper reference count management (CWE-911) within the AdapterState function of the IOCTL handler. An attacker with high local privileges can trigger this defect to cause driver instability or crash the WireGuard adapter, impacting VPN connectivity. A public proof-of-concept exploit exists; however, this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog and carries a CVSS 4.0 score of 4.6, reflecting its constrained impact and access prerequisites.
NULL pointer dereference in the shim application's dp.c library exposes Red Hat Enterprise Linux 7, 8, and 9 systems using UEFI Secure Boot to a local denial-of-service condition. An attacker with high local privileges and the ability to interact with the shim boot path can trigger the missing NULL pointer check, potentially disrupting the boot process. No public exploit code has been identified at time of analysis, and the low CVSS score of 3.9 reflects the constrained attack prerequisites, though the changed scope (S:C) signals that the impact crosses from the shim component into the broader boot environment.
Uninitialized-memory and out-of-bounds read in the UpdateHub OTA client of Zephyr RTOS allows a malicious or on-path UpdateHub server to crash the device update thread via a crafted probe response, producing a network-triggerable denial of service. The flaw exists in z_impl_updatehub_probe() within subsys/mgmt/updatehub/updatehub.c, where metadata_copy is allocated with k_malloc (leaving heap unzeroed) and filled via memcpy without a NUL terminator; a subsequent strlen() then scans into uninitialized heap, producing an over-long length fed to json_obj_parse(). No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but it is remotely triggerable against Zephyr devices running UpdateHub without DTLS transport protection.
Socket descriptor exhaustion in Zephyr RTOS's UpdateHub OTA client allows a network on-path attacker - or simply an unreachable update server - to gradually deplete the device's shared net_context pool, causing device-wide networking degradation until reboot. The defect is a resource-management bug (CWE-772) in start_coap_client(): ret was set to -1 immediately after socket creation, making the ret > 0 cleanup gate permanently unreachable, so cleanup_connection() was never invoked on any DTLS or connect failure path. No public exploit exists and the upstream fix is confirmed via Zephyr Project commit and security advisory.
Concurrent access to an unprotected singleton context structure in Zephyr RTOS's UpdateHub OTA subsystem enables two independent callers - the background autohandler and user-triggered update operations - to race through prepare_fds(), producing an out-of-bounds write that corrupts adjacent struct members and disables the firmware-update path. Affected are embedded systems running Zephyr with the UpdateHub subsystem enabled, particularly those built with CONFIG_USERSPACE where unprivileged userspace threads can invoke update syscalls and actively compete with the workqueue handler. No public exploit has been identified at time of analysis, the CVSS base score is 2.5, and the vendor commit confirms no demonstrated path to code execution - impact is limited to availability of the OTA update mechanism.
Physical access to the TBEA TLogger V2.1.0.0B0.0.0.0 (Communication Box 3rd Generation) PCB exposes an unprotected UART debug interface, allowing a physically proximate attacker to intercept the device boot process and runtime debug output without any authentication. Disclosed data - including OS version strings, software versions, network configuration, filesystem paths, and implementation internals - provides a reconnaissance foundation that can materially assist subsequent compromise of the device or connected infrastructure. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Super-linear regular-expression complexity in CPython's csv.Sniffer.sniff() allows CPU exhaustion when applications pass attacker-controlled, unbounded CSV input to dialect detection. Any Python application that auto-detects CSV formats from user-supplied data without input length limits is potentially affected across all CPython versions predating the 3.16 fix. No public exploit is identified at time of analysis, and the CVSS 4.0 score of 2.4 reflects a low-severity, local-context vulnerability with limited availability impact.
Man-in-the-middle interception of ECOVACS PRO app traffic is possible due to improper TLS server certificate validation (CWE-295) in both the Android and iOS versions of the application, published by ECOVACS Robotics and coordinated by JPCERT under JVNVU92804348. An attacker with a network-positioned MITM capability can present a rogue certificate that the app accepts without proper validation, enabling retrieval and alteration of all app-server communications, which may include device control commands, account credentials, and home telemetry. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Improper TLS certificate validation in Ecovacs Robotics DEEBOT PRO M1 and K1VAC robot vacuums exposes both devices to man-in-the-middle interception and manipulation of all outbound wget communications. Because certificate verification is disabled, a network-positioned attacker can impersonate any remote server the device contacts, injecting malicious content the device will accept and act upon. Per the vendor description, successful exploitation may result in arbitrary code execution with administrative privileges on the device; no public exploit has been identified at time of analysis.
Cross-site scripting in code-projects Task Management System 1.0 allows remote, unauthenticated attackers to inject malicious JavaScript via at least six unsanitized parameters processed by /user/CommentSave.php, including comment, task_id, mineId, recId, myName, and myImage. When a victim views the affected page or comment, the injected script executes in their browser context, enabling session hijacking, credential theft, or UI redirection. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed via CISA KEV listing.
Open redirect in Phoenix LiveView's redirect/2 allows an unauthenticated remote attacker to send a victim's browser to an arbitrary external origin by embedding ASCII tab (\t), line feed (\n), or carriage return (\r) in the :to path argument. The private validate_local_url!/2 guard in lib/phoenix_live_view.ex rejects leading double-slashes and backslashes but does not strip or reject these whitespace control characters; browsers silently discard them before URL resolution, so a payload such as /<TAB>/example.com validates as a local path yet resolves to the scheme-relative URL //example.com. Affected versions span three release trains: 0.5.0–1.0.18, 1.1.0-rc.0–1.1.32, and 1.2.0-rc.0–1.2.8. No public exploit code or CISA KEV listing has been identified at time of analysis.
Uninitialized memory exposure in GNU C Library (glibc) versions 2.0 through 2.43 corrupts the we_wordv member of the wordexp_t structure when wordexp is called with the WRDE_APPEND flag under specific conditions, causing a subsequent wordfree call to abort the calling process. Disclosed by the glibc project as GLIBC-SA-2026-0014 and rooted in CWE-908 (Use of Uninitialized Resource), the flaw carries a CVSS 4.0 base score of 2.1, reflecting meaningful exploitation constraints including a local attack vector and high complexity. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-site scripting in Discourse's discourse-local-dates plugin allows an authenticated attacker to inject arbitrary HTML by embedding crafted markup in local-date format attributes (data-format, data-displayed-timezone, data-timezone), which were interpolated directly into the DOM via template literals instead of safe DOM text APIs. Exploitation is gated by a non-default condition: the site's Content Security Policy must be modified or disabled from the default. No public exploit independent of the vendor fix commits exists at time of analysis, and this is not listed in CISA KEV. The CVSS 4.0 score of 2.0 reflects the constrained attack requirements (AT:P, PR:L, UI:A).