Remote denial-of-service in IBM i 7.3 through 7.6 allows unauthenticated network attackers to crash a host server by submitting malformed requests that trigger an out-of-bounds write (CWE-787) in the server's client data validation logic. The CVSS vector confirms no credentials or user interaction are required, making the attack straightforward to attempt against any network-reachable IBM i host server. No public exploit code has been identified at time of analysis, and IBM has released a patch via their support portal.
Heap buffer overflow in IBM i 7.3 through 7.6 enables remote, unauthenticated attackers to crash affected systems via a network-reachable code path, resulting in a complete denial of availability. The vulnerability is rooted in CWE-787 (out-of-bounds write) and carries a CVSS 3.1 base score of 7.5 (High) with a fully unauthenticated network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch through its support portal.
IBM i 7.6 exposes a remotely exploitable denial-of-service condition via an out-of-bounds write (CWE-787) that can be triggered by an unauthenticated remote attacker over the network without user interaction. The vulnerability produces high availability impact with no confidentiality or integrity consequence, consistent with a crash or resource exhaustion outcome rather than code execution. No public exploit or active exploitation has been identified at time of analysis; a vendor patch has been released.
Denial of service in IBM i 7.3 through 7.6 allows remote unauthenticated attackers to crash or hang affected systems by triggering an infinite loop condition (CWE-835) over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication and minimal complexity, making automated exploitation straightforward. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Denial of service in IBM i 7.3 through 7.6 allows remote unauthenticated attackers to exhaust system resources through unbounded resource allocation, rendering the platform unavailable to legitimate users. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no user interaction, with low attack complexity over the network. No public exploit code and no CISA KEV entry have been identified at the time of analysis; a vendor patch is available.
Remote denial of service in IBM i 7.3 through 7.6 is achievable by an unauthenticated network attacker via a CWE-835 infinite loop condition. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires no authentication and no user interaction against affected systems. No public exploit code or active exploitation confirmed at time of analysis; IBM has released a patch.
Path traversal in the Do Lasso WordPress plugin (versions <= 358) allows authenticated subscribers to traverse the server file system beyond the intended directory scope, achieving high confidentiality, integrity, and availability impact. The vulnerability is exploitable by any authenticated WordPress user holding the subscriber role - the lowest privilege tier - over the network, making it accessible to any registered site user. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the Patchstack advisory signals a patched version is available.
Unauthenticated broken access control in the MultiVendorX WordPress plugin (versions 5.0.10 and earlier) exposes restricted marketplace data to any remote attacker without credentials. The flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints, allowing unauthenticated network requests to bypass access restrictions and retrieve sensitive information such as vendor orders, customer data, or marketplace configurations. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this a straightforward target for opportunistic scanning.
Unauthenticated arbitrary file download in OMGF Pro (versions 5.2.7 and earlier) allows any remote attacker to retrieve arbitrary files from the server filesystem without credentials, exposing sensitive data such as WordPress configuration files containing database credentials. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms trivial network-based exploitation with high confidentiality impact and zero authentication or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Patchstack advisory lowers the barrier for threat actor discovery significantly.
Polynomial regular expression denial-of-service in the crmne/ruby_llm Ruby gem allows remote unauthenticated attackers to exhaust CPU resources by submitting a crafted, excessively long class, agent, or tool name that triggers the inefficient regex in RubyLLM::Utils.underscore. The vulnerability is constrained to Ruby 3.1.x environments due to engine-specific regex behavior at that commit. A public proof-of-concept exists (hosted as a GitHub Gist), though no active exploitation has been confirmed by CISA KEV.
Denial of service affecting IBM i versions 7.3 through 7.6 stems from uninitialized memory consumption during ASN.1 length processing, reachable by remote unauthenticated attackers over a network path without user interaction. The vendor CVSS vector rates C:H/I:H/A:H despite the public description referencing only a DoS outcome, a discrepancy suggesting the vulnerability's full potential may extend to memory disclosure or integrity impacts - reviewers should consult IBM Support advisory 7283573 to resolve this conflict before prioritizing response. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the high-complexity network attack vector means adversaries with specific knowledge of the target's ASN.1 service exposure remain a realistic threat to unpatched systems.
Denial of service via buffer overflow in IBM i 7.3 through 7.6 exposes all supported release lines of IBM's midrange operating system to remote disruption. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms that an unauthenticated remote attacker can trigger the flaw with low complexity and no user interaction, resulting in high availability impact and limited integrity impact - consistent with an out-of-bounds write that can crash or destabilize a targeted component. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in IBM i 7.3 through 7.6 exposes sensitive memory contents to unauthenticated remote attackers over the network, with additional limited availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) confirms exploitation requires no authentication and no user interaction, lowering the barrier for opportunistic targeting. No public exploit code or CISA KEV listing has been identified at time of analysis, though a vendor patch is available.
Remote denial of service via stack-based buffer overflow affects IBM i versions 7.3 through 7.6, allowing unauthenticated network attackers to crash an affected service without any user interaction or elevated privileges. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation is straightforward from the network with no special conditions, making this a reliable availability threat against exposed IBM i systems. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the vendor has released a patch via the IBM support portal.
Out-of-bounds write (CWE-787) in IBM i versions 7.3 through 7.6 enables remote unauthenticated attackers to crash affected systems and cause denial of service. The CVSS 3.1 base score of 8.6 is backed by a network-reachable, zero-prerequisite attack vector spanning all four currently supported IBM i release lines, making the exposed attack surface broad. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog; however, a vendor-released patch is available and should be applied promptly given the unauthenticated network vector.
Unauthenticated sensitive data exposure in the iCARRY WordPress plugin (versions <= 2.9) allows any remote, unauthenticated attacker to retrieve sensitive information by interacting with the plugin's endpoints over a standard HTTP connection. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and no special preconditions, making every unpatched site trivially accessible. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity means discovery and abuse would be straightforward for any motivated attacker.
Sensitive data exposure in WooCommerce Appointments plugin (≤ 5.3.8) allows unauthenticated remote attackers to access confidential booking or customer information without any credentials or user interaction. Reported by Patchstack, this High-severity flaw (CVSS 7.5) requires no authentication, no special configuration, and no user interaction, making it trivially automatable by scanning tools. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-prerequisite attack surface warrants prompt remediation.
WPMobile.App plugin for WordPress, versions 11.77 and earlier, allows unauthenticated remote attackers to bypass authorization controls and access protected resources. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects full network exploitability with high confidentiality impact and no integrity or availability consequence, consistent with an unauthorized read-access scenario. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
IBM Storage Scale GUI versions 5.2.3.0-5.2.3.8 and 6.0.0.0-6.0.1.0 ship with a hardcoded authentication token embedded in source code, granting any network-reachable attacker the ability to authenticate to the REST API and inter-node cluster communication channels without valid credentials. The static nature of the token means it is identical across every affected deployment, making a single disclosure universally exploitable against all unpatched instances. IBM has released a patch via advisory 7283308, and no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated denial of service in @fastify/busboy versions 1.0.0 through 3.2.0 allows any network attacker to crash the Node.js process by submitting a multipart form with a header whose name collides with a prototype-inherited JavaScript property such as __proto__ or constructor. The internal header store uses a plain object inheriting from Object.prototype, so the inherited property resolves to a truthy non-array value that triggers a synchronous TypeError when array methods are invoked on it; in direct write/end usage paths this exception propagates uncaught and terminates the process. No public exploit code has been identified at time of analysis, but the attack is trivially constructable given the detailed advisory.
Unauthorized access to privileged system objects is possible in IBM i 7.3 through 7.6 via a time-of-check to time-of-use (TOCTOU) race condition exploiting symbolic links, reachable by remote authenticated low-privilege users. The CVSS scope change (S:C) combined with full C/I/A impact signals that successful exploitation can reach objects and resources beyond the attacker's normal privilege boundary, effectively enabling privilege escalation across the OS. No public exploit code or CISA KEV listing has been identified at time of analysis, but the patch is available via the IBM advisory.
SQL injection in WP Directory Kit versions 1.5.4 and earlier enables remote unauthenticated attackers to extract sensitive database contents, including WordPress user credentials and site configuration data, without any account or prior foothold. The CVSS 3.1 score of 7.5 includes a Scope Changed designation, reflecting that the shared WordPress MySQL database - reachable by all installed plugins - is exposed beyond the plugin's own schema. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated network attack path significantly lowers the barrier to exploitation.
Unauthenticated broken access control in the Arvow AI SEO Writer WordPress plugin (versions ≤ 1.5.3) exposes unprotected endpoints that allow remote unauthenticated attackers to perform privileged write-level operations due to missing authorization checks (CWE-862). The CVSS 3.1 vector (PR:N/I:H) confirms no authentication is required and integrity impact is high, indicating attackers can modify SEO configuration, inject content, or alter plugin-managed data without any credentials. No active exploitation has been confirmed via CISA KEV, and no public proof-of-concept has been identified at time of analysis.
Broken access control in the StoreGrowth: Smart Sales Booster for WooCommerce plugin (versions <= 2.1.1) permits unauthenticated remote attackers to bypass authorization checks and perform privileged store management actions. The root cause is a missing authorization gate (CWE-862), meaning certain plugin endpoints execute sensitive operations without verifying the caller's identity or permissions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-friction exploitation conditions - no authentication, no user interaction, network-accessible - make this a straightforward target for opportunistic scanning.
Unauthenticated payment bypass in SMEPay: UPI Gateway for WooCommerce plugin (versions <= 1.0.5) allows remote attackers to complete WooCommerce orders without valid UPI payment by exploiting missing authorization controls. The plugin fails to enforce access checks on payment-related endpoints, enabling an unauthenticated network attacker to manipulate transaction state with no user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this trivially abusable on any exposed WooCommerce storefront running the affected plugin.
Broken access control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) versions 1.0.7 and below exposes one or more plugin endpoints - almost certainly WordPress AJAX handlers or REST API routes - without the required capability checks, allowing unauthenticated remote attackers to perform privileged actions with high integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms no credentials are needed and exploitation requires no user interaction, making this trivially scriptable against any internet-facing WordPress store running the affected plugin. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the attack conditions are permissive enough to make opportunistic exploitation straightforward.
Broken access control in the Taxi Booking Manager for WooCommerce WordPress plugin (versions <= 2.0.3) allows unauthenticated remote attackers to perform privileged actions without authorization, resulting in high integrity impact. The vulnerability stems from missing authorization checks (CWE-862) on one or more plugin endpoints, enabling manipulation of booking data or plugin functionality without any credentials. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this straightforward to exploit once the affected endpoint is identified.
Resource exhaustion in Go's net/http package allows unauthenticated remote attackers to indefinitely hold server connections open when cleartext HTTP/2 (h2c) is enabled, causing denial of service. The root cause is that ReadHeaderTimeout - the safeguard meant to prevent slow-connection abuse - is not enforced during the HTTP/2 client preface detection phase unique to h2c. Affected deployments include Go net/http servers built with Go versions prior to 1.25.13, 1.26.6, or 1.27.0-rc.3; no public exploit has been identified and CISA KEV does not list this vulnerability.
Uncontrolled CPU exhaustion in Go's standard-library crypto/tls package allows remote unauthenticated attackers to send an unbounded stream of TLS 1.3 KeyUpdate messages, forcing the server to perform continuous HKDF key derivation operations and causing a denial of service. Affected versions span Go crypto/tls prior to 1.25.13, 1.26.6, and 1.27.0-rc.3 across all three active release branches. No public exploit has been identified and EPSS stands at a low 0.18%, but the zero-authentication network attack surface makes this trivially reachable against any internet-exposed Go TLS server without any special preconditions.
Stack exhaustion in Go's standard library encoding/xml package exposes any Go application parsing untrusted XML to remote denial of service. The DecodeElement function incorrectly resets an internal recursion depth counter on each invocation, neutralizing the depth-limit guard that exists to prevent unbounded stack growth from deeply nested XML documents. Unauthenticated remote attackers can trigger goroutine stack exhaustion and crash the affected process with no authentication required. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; EPSS is 0.18% (8th percentile), reflecting low near-term exploitation probability despite the straightforward attack primitive.
Stack exhaustion in Go's encoding/asn1 standard library package allows any caller of Unmarshal to crash the Go process by supplying a deeply-nested, recursive ASN.1 structure that exceeds the goroutine stack limit. Applications that parse ASN.1 data from untrusted sources - including TLS certificate validation, PKCS message handling, LDAP clients, SNMP agents, and custom cryptographic protocol implementations - are directly at risk of denial of service. No public exploit code has been identified at time of analysis; vendor-released patches are available in Go 1.26.6 and Go 1.25.13.
KiviCare WordPress plugin before version 4.5.2 exposes an unauthenticated registration endpoint that fails to enforce role restrictions, permitting any remote attacker to self-register a privileged clinic-staff (doctor) account without credentials. Once registered, the attacker gains full access to patient records, billing data, and clinic management functions. A vendor patch exists at version 4.5.2; no public exploit has been identified at time of analysis.
Improper transparency log verification in the Go module checksum database (GOSUMDB) client allows a coordinating malicious GOPROXY and GOSUMDB pair to serve arbitrary, tampered module content to developers without triggering any client-side integrity error. All cmd/go versions before 1.25.13, 1.26.6, and 1.27.0-rc.3, as well as golang.org/x/mod/sumdb before 0.40.0, are affected. No public exploit code has been identified at time of analysis and CISA has not listed this in KEV, but the supply chain attack surface means developers may have silently pulled poisoned dependencies before patching, making retrospective verification via re-fetching module sums mandatory.
Uncontrolled resource consumption in py-libp2p's yamux stream multiplexer allows any remote peer that completes a standard Noise handshake to permanently stall a connection using a single 12-byte frame. Affected versions 0.7.0 and earlier accept an attacker-controlled 32-bit DATA frame length before validating it against the receive window, so a frame claiming a 4 GB body with no body bytes delivered causes the sequential read loop to block indefinitely, freezing every stream on the connection. No patched release exists at time of analysis; a remediation commit is available upstream, and a proof-of-concept demonstrating the stall is documented in the GHSA advisory.
Unauthenticated sensitive data exposure in KiviCare WordPress plugin versions 4.5.1 and below allows remote, unauthenticated attackers to access protected clinic and patient data through an authentication bypass (CWE-288). The CVSS 3.1 vector confirms network-level, zero-complexity, credential-free exploitation with high confidentiality impact and no integrity or availability dimension. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack profile is inherently accessible to any opportunistic actor who can reach the WordPress installation.
Account takeover in Trigger.dev before 4.5.2 allows an unauthenticated remote attacker to hijack any existing user account that has not yet linked a Google OAuth identity, by presenting a Google profile whose email is unverified but matches the victim's registered address. The `addGoogleStrategy()` function in `apps/webapp/app/services/googleAuth.server.ts` omits the `email_verified` assertion before calling `findOrCreateGoogleUser()`, causing the server to bind the attacker's Google `authIdentifier` to the victim's account when the conditional `existingEmailUser && !existingUser` is satisfied. No public exploit has been identified at time of analysis, but the fix is available in v4.5.2 and the attack requires no Trigger.dev credentials.
Arbitrary file deletion in the Participants Database WordPress plugin (versions <= 2.7.8.4) allows remote unauthenticated attackers to delete files anywhere on the server filesystem by exploiting a path traversal flaw (CWE-22), subject to a user interaction requirement. The scope-changed CVSS vector (S:C/A:H) indicates that successful exploitation reaches beyond the plugin directory, threatening WordPress core files, server configuration, or other critical resources, with potential for complete site outage. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Improper authentication in IBM i 7.3 through 7.6 enables remote unauthenticated attackers to bypass authentication controls over the network, yielding access to sensitive information with additional low-level integrity and availability impact per the CVSS vector. The vulnerability is classified under CWE-287 (Improper Authentication) and tagged as an authentication bypass, indicating the platform's authentication mechanism can be circumvented without credentials. No public exploit code has been identified at time of analysis, and IBM has released a patch via their support portal.
Relative path traversal in Kibana's Fleet component allows an authenticated low-privileged user to delete arbitrary Kibana resources by supplying a crafted Fleet Server host configuration identifier containing traversal sequences. Elastic has confirmed the flaw in ESA-2026-94 and released patched versions 8.19.17, 9.3.6, and 9.4.3. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated broken access control in the Hydra Booking WordPress plugin by Themefic (versions ≤ 1.2.2) permits any remote, unauthenticated party to bypass authorization checks and interact with restricted plugin functionality. The CWE-862 root cause - missing authorization - means protected endpoints can be triggered by anonymous HTTP requests, enabling unauthorized reading, modification, or disruption of booking data. No public exploit code and no active exploitation have been confirmed at the time of analysis.
Improper anti-CSRF token validation in IBM i 7.3 through 7.6 enables remote authenticated attackers to bypass CSRF security controls, resulting in high confidentiality and integrity compromise (CVSS 8.1). The flaw is rooted in the server's failure to correctly validate CSRF tokens on state-changing requests, allowing a low-privileged authenticated attacker to forge or replay requests without victim interaction. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7283569.
Privilege escalation via symlink following in Lenovo Vantage and Lenovo Commercial Vantage allows a local authenticated user to execute arbitrary code with elevated privileges on affected Lenovo systems. Discovered during an internal Lenovo security assessment, the flaw (CWE-59) arises when a privileged Vantage component resolves attacker-controlled symbolic links without validation, enabling redirection of file operations to security-sensitive targets. No public exploit code or active exploitation has been confirmed at time of analysis; CVSS 4.0 scores this at 7.3 with a local attack vector and specific attack requirements present.
Privilege escalation in Kibana arises from insufficient CSRF protection in the Vega visualization engine, affecting all versions prior to 8.19.20 and 9.4.5. Any Kibana user with visualization creation rights can embed a specially crafted Vega specification that, when rendered by a higher-privileged user's browser, silently issues authenticated HTTP requests to Kibana under the victim's session credentials. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, though the low attack complexity and widely deployed nature of the product make this a meaningful remediation priority.
Lenovo System Update contains an authentication bypass (CWE-290) that permits a locally authenticated standard user to circumvent privilege checks and execute arbitrary code with elevated system privileges. Affected products span all tracked versions per CPE data, with Lenovo confirming the issue and releasing a patch under advisory LEN-213316. No public exploit code or CISA KEV listing has been identified at time of analysis, limiting immediate threat to environments where adversaries already have local user access.
Arbitrary file write in rsync before 3.5.0 allows attackers who control --temp-dir or --link-dest option values to escape the intended destination tree by supplying absolute paths, bypassing the rename-confinement security boundary. Any filesystem location writable by the rsync process can be targeted, enabling overwrite of system files, configuration, or planted malicious content. No public exploit identified at time of analysis, but the CVSS 4.0 score of 7.2 with high integrity and availability impact reflects serious real-world risk in server environments where option values are externally influenced.
Remote code execution in Apache Shindig (all versions) is reachable via the project's REST API, where deserialization of attacker-controlled input allows server-side arbitrary code execution. The vulnerability requires high-privilege API access (CVSS PR:H), limiting opportunistic exploitation, but every deployed instance is permanently exposed because the Apache Software Foundation has retired the project and will not release a fix. No public exploit or KEV listing has been identified at time of analysis, but the combination of RCE impact and no-patch status makes any continued deployment a long-term liability.
Remote code execution in PostgreSQL logical decoding (versions before 18.5, 17.11, 16.15, 15.19, and 14.24) allows any database user holding REPLICATION privilege - a role explicitly below superuser - to load arbitrary shared libraries via dlopen by specifying a malicious logical decoding plugin name, executing arbitrary code as the OS account running the server. This is a missing authorization flaw (CWE-862): the REPLICATION privilege was not intended to grant the ability to load native code. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high-impact CVSS 7.2 vector and RCE outcome make this a high-priority patching target for any deployment that grants REPLICATION to non-superusers.
PHP Object Injection in the Car Rental Manager WordPress plugin (versions ≤ 1.3.9, by MagePeople Team) enables authenticated editor-level users to supply malicious serialized PHP payloads that are deserialized without validation, potentially triggering arbitrary code execution on the host server. The CVSS 7.2 score reflects the high-privilege prerequisite (PR:H), yet all three impact dimensions — confidentiality, integrity, and availability — score High, meaning successful exploitation can yield full environment compromise. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Stored Cross-Site Scripting in the Fluent Forms WordPress plugin (all versions through 6.2.11) allows unauthenticated attackers to inject arbitrary JavaScript via form submission fields that are referenced by administrator-configured Notification Smartcodes, with payload execution occurring in the WordPress admin dashboard when Submission Logs are viewed. The root cause is insufficient sanitization and output escaping in ShortCodeParser.php and the EmailNotification component, confirmed by Wordfence and traceable to specific source-level references. A patch was released in version 6.2.12; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unguarded git option forwarding in GitPython before 3.1.57 allows low-privileged attackers to inject unsafe options into two git subcommands via kwargs, achieving arbitrary file overwrite or arbitrary file read. Specifically, IndexFile.checkout() forwards caller-controlled kwargs to git checkout-index without invoking check_unsafe_options(), enabling the --prefix flag to write repository-tracked content to any path the process can write. TagReference.create() similarly exposes the -F/--file option of git tag, allowing arbitrary file contents to be read in-band. A working proof-of-concept is documented in the GHSA advisory. No active exploitation has been confirmed in CISA KEV at time of analysis.