Arbitrary file read in rsync before 3.5.0 enables attackers with local low-privilege access to read files accessible to the rsync daemon process by exploiting improper symlink resolution in input configuration file handling. The vulnerability affects --files-from, --password-file, and filter merge file paths, allowing placement of a symlink at a predictable argument path or supply of a --files-from path that escapes the daemon module root. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vendor has released a confirmed fix in rsync 3.5.0.
Supply chain compromise of Go module environments is possible when a malicious GOPROXY serves specifically crafted forged sumdb tile pairs, exploiting CWE-347 (improper cryptographic verification) in the cmd/go toolchain's tile-parent validation logic. Affected are cmd/go versions before 1.25.13, 1.26.6, and 1.27.0-rc.3 - any developer workstation or CI/CD pipeline using these versions and a non-default GOPROXY is at risk of silently caching attacker-controlled module content that cannot be distinguished from legitimate modules through normal transparency log evaluation. No public exploit has been identified and no CISA KEV listing exists; EPSS of 0.12% (3rd percentile) indicates low current exploitation probability, but the theoretical supply chain impact is severe.
Out-of-bounds write in rsync 3.2.3 through 3.4.x corrupts .bss-segment memory via misuse of snprintf() return semantics in parse_size_arg(), enabling remote denial-of-service and potential memory corruption with high availability impact. The CVSS 4.0 score of 8.3 with AV:N/PR:N reflects that an unauthenticated remote attacker can reach the vulnerable code path, though AC:H indicates the truncation condition requires a specifically crafted size argument. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. The fix is confirmed in v3.5.0, designated a major security release by the maintainers.
Credential plaintext exposure in Budibase before 3.40.0 allows any authenticated user with table read permissions to retrieve live MongoDB connection strings and Firebase private keys via the standard read API. The root failure is that STRING-typed datasource fields bypass the platform's credential redaction logic entirely, leaving secrets accessible through normal API calls. No public exploit code or active exploitation (CISA KEV) has been identified, but the CVSS 4.0 score of 8.3 correctly reflects that successful exploitation yields persistent access to backend databases and cloud service accounts well beyond the Budibase instance itself.
Unauthenticated API access in OpenChoreo's Backstage backend exposes all `/api/*` routes to any network-reachable attacker, enabling catalog enumeration, scaffolder log reads, and catalog location creation or deletion without credentials. The root cause is two Backstage safety flags - `dangerouslyDisableDefaultAuthPolicy` and `dangerouslyAllowOutsideDevelopment` - hardcoded to `true` in both `app-config.yaml` and `app-config.production.yaml`, effectively disabling Backstage's authentication layer in all pre-fix deployments. No public exploit identified at time of analysis; vendor-released patches are available at v1.0.4, v1.1.4, and v1.2.1.
Stack buffer overflow in PostgreSQL's argument name matching logic allows a database object creator to crash backend processes and achieve low integrity impact by supplying a crafted OUT parameter count. Affected are all active major branches: versions 14.x before 14.24, 15.x before 15.19, 16.x before 16.15, 17.x before 17.11, and 18.x before 18.5. No public exploit or CISA KEV listing has been identified at time of analysis; however, the constrained-write nature of the overflow (limited to 0x0 and 0x1 bytes) caps realistic impact at availability loss rather than arbitrary code execution, making this a high-priority patch rather than an emergency incident response trigger.
Unauthenticated remote exploitation of a buffer overflow in IBM i 7.3 through 7.6 allows attackers to cause denial of service and modify authentication metadata without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially reachable exploitation over the network against default-accessible services. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-tenant path traversal in Trigger.dev versions 4.4.2 through pre-4.5.0-rc.5 allows any authenticated tenant holding a valid environment API key to obtain presigned AWS S3 URLs scoped to another tenant's object-store keys, enabling unauthorized read and write access to task payloads. The flaw combines user-controlled packet path keys written directly into URL.pathname without dot-segment rejection and a stub ownership check (findResource: async () => 1) that unconditionally returns truthy for any requested resource. No public exploit code has been identified at time of analysis, though the mechanism is straightforward to reproduce from the CVE description alone, and the vendor has released a fix in v4.5.0-rc.5.
Unauthenticated remote access control bypass in the Portal Generator Addon for Priority ERP (developed by Soft Solutions) enables network-accessible exploitation with no authentication or user interaction required. The flaw, classified as CWE-284 Improper Access Control and tagged explicitly as an Authentication Bypass, allows attackers to circumvent access restrictions, resulting in high-impact confidentiality exposure and limited data integrity impact against affected ERP portal deployments. Reported by the Israel National Cyber Directorate (INCD), no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Authentication token validation flaws in IBM i 7.3 through 7.6 expose network-reachable systems to remote unauthenticated attackers capable of extracting sensitive information and performing limited unauthorized operations. The CWE-287 root cause (Improper Authentication) combined with a PR:N/AV:N CVSS vector confirms exploitation requires no credentials and no user interaction over the network. No active exploitation has been confirmed (not in CISA KEV), EPSS sits at 0.31% (23rd percentile), and SSVC marks exploitation status as 'none' - signals that collectively moderate urgency despite the 8.2 CVSS score.
Symlink race condition in rsync before 3.5.0 allows directory traversal beyond the configured module root during sender-side scanning. Attackers with write access to a path component of the scanned tree can exploit a TOCTOU window between lstat() and opendir() system calls to redirect traversal outside the module boundary, causing rsync to enumerate and transfer files from unintended filesystem locations. This affects both daemon-mode and non-daemon sender-side scanning configurations; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Remote code execution is achievable in Data::MuForm::Localizer for Perl (versions through 0.05) when an application passes user-supplied locale identifiers - such as an Accept-Language header or locale query parameter - directly to the load_lexicon function, and an attacker can also place a crafted .po file at a readable path on the server. The module constructs the catalog path by unsanitized interpolation of the language attribute, enabling directory traversal, then eval-executes the Plural-Forms header of the loaded catalog as live Perl code, giving the attacker arbitrary OS command execution as the application process user. No public exploit code is referenced in available sources and this CVE is not listed in CISA KEV; a vendor patch is available from CPANSec.
WP Helper Premium WordPress plugin before 4.7.6 exposes WooCommerce order data to unauthenticated network attackers via a missing order key authorization check on its custom order confirmation page and related AJAX handlers. Any unauthenticated user can enumerate order IDs to read other customers' personally identifiable information and arbitrarily change the state of any order. No public exploit has been identified at time of analysis, though the SSVC framework rates this as automatable, meaning scripted mass enumeration is technically feasible once the vulnerable module is enabled.
Command injection in the PostgreSQL psql client (versions before 18.5, 17.11, 16.15, 15.19, and 14.24) allows an attacker who controls both a malicious server and the supplied data rows to execute arbitrary psql meta-commands on the connecting client host. The flaw is triggered when a COPY FROM STDIN or \copy FROM STDIN operation fails with a premature server-side error - before the server signals readiness to receive data rows - causing psql to misinterpret the inline data stream as client-side command input rather than row data. No public exploit code has been identified at time of analysis, but the CVSS 8.1 score reflects the potential for full confidentiality, integrity, and availability impact when the dual-control preconditions are met.
PostgreSQL's ctid data type selectivity estimator mishandles non-ctid input through a type confusion flaw (CWE-843), enabling any low-privileged database user with object-creation rights to read approximately 4 bytes of arbitrary server memory per query. All supported major versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor explicitly acknowledges that substantial memory value recovery is possible.
Broken access control in the Travelfic Toolkit WordPress plugin (versions <= 1.5.1) permits subscriber-level authenticated users to execute privileged operations without proper authorization enforcement, yielding high integrity and availability impact on the affected installation. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails entirely to verify whether a requesting user holds the necessary capabilities before processing sensitive actions. No public exploit code and no active exploitation have been identified at time of analysis.
Unauthenticated Local File Inclusion (LFI) in the Biagiotti Core WordPress plugin versions up to and including 2.1.1 allows network-accessible attackers to include arbitrary local files on the server without any credentials. The CVSS 8.1 score with full C/I/A impact ratings reflects the potential to chain LFI into remote code execution via techniques such as log poisoning or session file inclusion, not merely passive file disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H metric signals that exploitation requires specific server-side preconditions to achieve full impact.
Local File Inclusion in the Foton Core WordPress plugin (versions ≤ 1.1.1, developed by Mikado Themes) enables unauthenticated remote attackers to supply attacker-controlled file paths to PHP include/require functions, potentially exposing sensitive server files such as wp-config.php or enabling remote code execution via log-poisoning techniques. The CVSS vector confirms unauthenticated network-level access (AV:N/PR:N) with high confidentiality, integrity, and availability impact, though the AC:H rating signals that specific conditions must align for successful exploitation. No public exploit code or active exploitation has been confirmed at time of analysis; the Patchstack advisory is the sole disclosure source.
Local File Inclusion in the Barista WordPress theme (edge-themes) version 2.5.1 and earlier allows unauthenticated remote attackers to include arbitrary local files via crafted HTTP requests, with potential full confidentiality, integrity, and availability compromise. The CVSS 8.1 score reflects high impact across all three pillars, though the AC:H rating indicates exploitation requires elevated complexity - such as specific server conditions or chained techniques like log poisoning to escalate beyond file disclosure to code execution. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Unauthenticated Local File Inclusion in the Geo Mashup WordPress plugin (all versions through 1.13.18) enables a remote, unauthenticated attacker to include arbitrary local files from the server's filesystem, potentially exposing sensitive configuration data or achieving remote code execution through chained techniques such as log poisoning. Reported by Patchstack, the flaw is classified under CWE-98, targeting PHP's include/require mechanism within the plugin. No public exploit or CISA KEV listing has been confirmed at time of analysis, but the CVSS 8.1 score reflects a high-severity, zero-privilege-required attack path.
Path traversal in Trigger.dev's packet presign API routes (versions 4.4.2 through 4.4.x) allows a holder of any valid project API key to escape the intended packets/<projectRef>/<env>/ object-store prefix by injecting .. sequences into the caller-controlled filename parameter. On multi-organization self-hosted deployments, this enables cross-tenant reads and overwrites of offloaded task payloads and outputs. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS 8.1 (High) rating reflects high confidentiality and integrity impact reachable by any authenticated project member without elevated privileges.
Improper session management in IBM i 7.3 through 7.6 enables remote authenticated attackers to perform unauthorized operations and access sensitive information without elevated privileges. The vulnerability maps to CWE-294 (Authentication Bypass by Capture-replay), meaning valid but low-privileged credentials are sufficient to exploit weaknesses in how sessions are validated or managed. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS score of 8.1 reflects high confidentiality and integrity impact with low attack complexity.
Unauthenticated privilege escalation in the miniOrange SAML SP Single Sign On WordPress plugin (versions ≤ 5.4.3) allows network-accessible attackers to elevate their privileges without any prior authentication. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates exploitation is remotely achievable but requires specific conditions to be met - likely particular SAML configuration states or timing-sensitive request manipulation. Full confidentiality, integrity, and availability impact is reported, consistent with an attacker reaching WordPress administrator-level access. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated privilege escalation in the MStore API WordPress plugin (versions 4.20.0 and earlier) allows remote, unauthenticated attackers to gain elevated privileges on affected WordPress installations. Rooted in CWE-266 (Incorrect Privilege Assignment), the flaw is reachable over the network without any authentication or user interaction, though elevated attack complexity (AC:H) indicates a specific condition or race condition must be satisfied. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full-impact CVSS score of 8.1 reflects the severity of a complete privilege compromise if exploited successfully.
Missing Authorization in Kibana's Elastic Security module permits authenticated users holding detection rule authoring privileges to execute Osquery live queries and Elastic Defend response actions against enrolled managed endpoints without possessing the specific Osquery or Elastic Defend privileges that normally govern those capabilities. The CVSS 8.1 score reflects a network-accessible, low-complexity attack path with high confidentiality and integrity impact against enrolled host infrastructure. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but patch versions 8.19.20 and 9.4.5 are available per Elastic Security Advisory ESA-2026-96.
Stack-based buffer overflow in the Native IBM i JSSE (Java Secure Socket Extension) provider enables local authenticated attackers with low privileges to execute arbitrary code or crash the JVM process on IBM i versions 7.3 through 7.6. The flaw is triggered during TLS session establishment via improper bounds checking against a fixed-length stack buffer. No public exploit or active exploitation has been identified at time of analysis - EPSS stands at 0.22% (12th percentile) and SSVC exploitation status is 'none' - but a vendor patch is available and should be applied given the high-impact code execution potential.
Arbitrary OS command execution in GitPython <= 3.1.53 is achievable during clone operations because the `unsafe_git_clone_options` denylist in `base.py` omits `--template`, allowing it to pass `check_unsafe_options` without error in the default `allow_unsafe_options=False` configuration. Callers who can influence `Repo.clone_from()` arguments can supply a `--template` path to an attacker-staged directory containing an executable `post-checkout` hook, which git automatically executes at checkout time. A live-verified proof-of-concept against tag 3.1.53 has been publicly disclosed; no active exploitation is confirmed in CISA KEV at time of analysis.
Missing length validation in the Linux kernel's s390/zcrypt CCA ECC private key handler allows a local low-privileged user on IBM Z (s390) systems to trigger a buffer overread or overflow in the CPRB parameter block. The `cca_ecc2protkey()` function blindly trusts the length field embedded in a caller-supplied key token when computing how many bytes to copy into a fixed-size parameter block, enabling a crafted oversized token to corrupt adjacent kernel memory. No public exploit has been identified at time of analysis, and this vulnerability is architecture-specific to IBM Z mainframe Linux deployments.
Kernel memory corruption in the Linux kernel's s390/zcrypt CCA AES cipher key handling path allows a local low-privileged user on IBM Z mainframe systems to trigger an out-of-bounds buffer operation with full confidentiality, integrity, and availability impact. The function `cca_cipher2protkey()` uses the length field from a user-supplied key token header to determine the copy size for the CPRB parameter block without validating it against the actual available buffer space, enabling adjacent kernel memory corruption. No public exploit exists and this is not in CISA KEV; vendor-released patches are available across multiple stable kernel branches including 6.6.151, 6.12.103, 6.18.44, and 7.1.8.
Arbitrary code execution in IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 on Windows is enabled by a publicly writable directory created when the application is installed in 'all users' mode. A local attacker with low privileges can plant malicious content in this directory, which the application subsequently loads with higher-privilege context, achieving full code execution. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.11% (2nd percentile) reflects low observed exploitation pressure, though the SSVC technical impact rating is 'total', underscoring the severity if exploited.
Local privilege escalation in IBM i 7.3 through 7.6 allows an authenticated local attacker with low-level privileges to gain fully elevated access by exploiting improper validation of the LANG environment variable (CWE-73). The failure to sanitize this locale-setting variable enables redirection of file or path resolution to attacker-controlled resources, which the system then processes with elevated authority - resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and CISA SSVC confirms zero known exploitation activity, though the SSVC technical impact rating of 'total' underscores the severity if successfully triggered by an insider or post-compromise attacker.
Arbitrary file ownership change in IBM i 7.3 through 7.6 enables local authenticated attackers to seize control of files outside their intended access scope by supplying a crafted, attacker-controlled path to a vulnerable ownership-change operation that lacks adequate validation. The flaw is rooted in CWE-73 (External Control of File Name or Path) and carries a CVSS 7.8 High score with full confidentiality, integrity, and availability impact, consistent with a local privilege escalation path to system-level control. IBM has released a patch via their support portal; no public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at the time of this analysis.
Local privilege escalation in IBM i versions 7.3 through 7.6 allows an authenticated local user with low-level system privileges to gain elevated authority due to improper privilege management (CWE-269). The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires no special conditions beyond existing local access, with full confidentiality, integrity, and availability impact upon success. No public exploit code has been identified at time of analysis, and IBM has released a patch via its support portal.
Path traversal exploitation in the AI Hub WordPress theme (versions <= 1.3.10) enables any authenticated subscriber to download arbitrary files from the web server, including sensitive configuration files outside the WordPress document root. With a Changed Scope designation in the CVSS vector, the attacker's reach extends beyond the WordPress application to the underlying server filesystem, enabling theft of database credentials, private keys, and system configuration data. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the low privilege requirement - a subscriber account - significantly lowers the bar for abuse on sites with open user registration.
Privilege escalation in the Directories Pro WordPress plugin (versions <= 2.0.5) allows a subscriber-level authenticated user to gain higher-level privileges within the WordPress installation. Reported by Patchstack and classified under CWE-266 (Incorrect Privilege Assignment), this flaw exposes sites using the plugin for directory listings to unauthorized data access and content manipulation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible attack surface warrants prompt patching.
Elastic Kibana's Elastic Security endpoint policy editor exposes sensitive Elastic Defend telemetry through a privilege escalation in the field value suggestion feature. Authenticated users holding Kibana Elastic Security feature privileges - but lacking Elasticsearch index-level read access to Elastic Defend event indices - can retrieve field values including process command line arguments, which routinely contain credentials, API tokens, and connection strings harvested from protected endpoints. No public exploit has been identified at time of analysis, but the low attack complexity and scope change across the Kibana-to-Elasticsearch authorization boundary make this straightforward to abuse by any user with a qualifying Kibana role.
Arbitrary OS command injection in FreePBX Music on Hold module versions 17.0.1 through 17.0.6 allows an authenticated administrator to execute commands as the asterisk service user by supplying dangerous player arguments through the custom application configuration interface. The validateCustomConfiguration() function in Music.class.php accepted player command-line options for mpg123, mpg321, madplay, ogg123, and cvlc without blocking file-write, FIFO, or network control flags, because the applicationUsesDisallowedPlayerOption() function lacked the blocklist logic needed to reject them. No public exploit code or active exploitation has been identified at time of analysis; the issue is patched in version 17.0.7.
SQL injection via MySQL backtick escape failure in Budibase's schema discovery feature allows an attacker with MySQL table-creation privileges to achieve arbitrary SQL execution on the underlying database. Affected versions prior to 3.39.18 interpolate raw table names into DESCRIBE queries while the MySQL connection has multipleStatements enabled, meaning a maliciously named table breaks out of the backtick-quoted identifier and executes attacker-controlled SQL when a Budibase administrator next triggers schema introspection. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the GHSA advisory provides a detailed step-by-step reproduction sufficient for exploit development.
SQL injection in the MailChimp For WooCommerce WordPress plugin (all versions prior to 6.2) allows authenticated administrators to submit unsanitized input through the plugin's administrative interface, triggering arbitrary database queries against the underlying WordPress database. The CVSS scope change (S:C) indicates that successful exploitation reaches beyond the plugin's own data, potentially exposing customer PII, order records, and other WooCommerce data stored in shared database tables. No public exploit has been identified at time of analysis, and exploitation is gated behind WordPress administrator-level authentication.
Missing authorization on Kibana's Observability Onboarding API routes allows any authenticated low-privilege user sharing a Kibana space to enumerate, read, and overwrite the onboarding flow state of other users in that space. Affected installations include all Kibana versions prior to 8.19.19 and 9.4.5 across both self-managed and Elastic Cloud deployments. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS high integrity impact (I:H) reflects an attacker's ability to corrupt another user's onboarding progress and trigger persistent server errors in the victim's Observability Onboarding view.
TLS certificate validation bypass in rsync enables on-path attackers to intercept and tamper with encrypted file transfer sessions. Affected are rsync 3.2.0-3.2.3 in openssl mode and rsync-ssl through 3.4.4 in stunnel mode; both fail to validate server certificates against a trusted CA and perform no hostname verification, allowing a self-signed or otherwise invalid certificate to be accepted silently. No public exploit has been identified at time of analysis, and a vendor-released patch (v3.5.0, designated a major security release) is available.
Bluetooth LE legacy pairing authentication in Silicon Labs RS9116W and SiWx917 wireless modules (WiseConnect SDK) can be bypassed by manipulating the Temporary Key (TK) value during Passkey Entry association, allowing an adjacent unauthenticated attacker to pair with the target device without possessing the correct passkey. Successful exploitation yields high confidentiality and integrity impact on the vulnerable system. The vulnerability is academically documented as B-E3 in a published research paper (arxiv.org/pdf/2409.02905); no public exploit tool or CISA KEV entry has been identified at time of analysis.
Authenticated path traversal in OpenList's batch rename API allows any user with rename permission to move files outside their authorized storage boundary. The `/api/fs/batch_rename` endpoint in `server/handles/fsbatch.go` validates `src_dir` and `new_name` against path traversal, but leaves `src_name` unchecked before concatenating it with the authorized path and passing the result to `fs.Rename`. A detailed proof-of-concept is embedded in the GHSA advisory; no CISA KEV listing exists, but the low privilege bar (any authenticated user with rename permission) makes cross-user file integrity loss and file-existence disclosure realistically exploitable in multi-tenant deployments. The issue is fixed in version 4.2.4.
CPU exhaustion in @fastify/busboy 3.1.0-3.2.0 allows a remote unauthenticated attacker to stall the Node.js event loop by sending a single crafted multipart request. The parser's vendored streaming search algorithm stores its Boyer-Moore-style skip table in a fixed 256-entry byte array; supplying a boundary of exactly 252 bytes causes the computed search needle to reach 256 bytes, collapsing the skip distance to zero and converting an O(n) search into an unbounded CPU-bound loop. Because Node.js is single-threaded and event-driven, one stalled core prevents all other requests from being processed by the same worker, achieving denial of service with minimal bandwidth. No public exploit has been identified at time of analysis, but the attack primitive is trivially reproducible from the advisory.
QUIC server listener in OpenSSL 3.5.x through 4.0.x allows remote unauthenticated denial of service through unbounded memory growth when processing QUIC Initial packets. Remote peers can flood the listener with Initial packets carrying novel Destination Connection IDs faster than the application drains the queue via SSL_accept(), causing per-channel state objects to accumulate without limit and exhausting process memory. No public exploit code or CISA KEV listing has been identified; vendor-confirmed patches are available in OpenSSL 3.5.8, 3.6.4, and 4.0.2.
Path traversal in IBM Documentation Offline 1.0.0 through 1.4.1 enables unauthenticated remote attackers to read arbitrary files from the underlying server filesystem. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N vector confirms fully network-accessible exploitation with no privileges or user interaction required, resulting in high confidentiality impact but no integrity or availability loss. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the trivial attack complexity and zero-authentication requirement make exposed instances an immediate patching priority.
CPU exhaustion denial of service in Netty's XmlFrameDecoder allows an unauthenticated remote attacker to hang a server's EventLoop thread by trickle-feeding repeated `</` byte sequences to any port where XmlFrameDecoder is in the pipeline. Because the decoder fails to save parser state between `decode()` invocations, each new call rescans the entire accumulated buffer from scratch, producing O(n²) CPU growth that can fully pin a thread with as little as 1 MB of malformed XML data. No public exploit code has been identified at time of analysis, though the GitHub Security Advisory GHSA-v74w-7mr3-4qg3 supplies sufficient technical detail to reproduce the attack. Vendor-released patches are available as Netty 4.1.136.Final and 4.2.16.Final.
Authenticated OS command injection in the FreePBX Text-To-Speech module allows an administrator-level attacker to execute arbitrary operating-system commands as the asterisk service user on installations running branch 16 prior to version 16.0.6 or branch 17 prior to 17.0.5.4. The root cause is unsanitized administrator-controlled input - specifically a TTS destination name - flowing through HTML decoding during dialplan generation and into multiple PHP exec() call sites inside agi-bin/propolys-tts.agi without shell escaping across all supported TTS engine backends. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated sensitive data exposure in the REST API Log WordPress plugin (versions <= 1.7.1) allows any remote actor to query the plugin's log storage and retrieve recorded REST API request and response data without credentials. Reported by Patchstack and scored CVSS 7.5 (High) with AV:N/AC:L/PR:N/UI:N, the exposure is trivially reachable across the network with no authentication or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Sensitive data exposure in WPJAM Basic (WordPress plugin, versions ≤ 7.0.2.1) allows unauthenticated remote attackers to retrieve subscriber private information without credentials or user interaction. Classified under CWE-1258, the root cause is a failure to restrict access to private user data at the plugin level, exposing information that should be gated by authentication. No public exploit code has been identified at time of analysis, though the absence of any authentication or complexity barrier makes this straightforward to abuse once the vulnerable endpoint is known.