Full site compromise in the Link Factory WordPress plugin stems from the plugin itself being a deliberate backdoor rather than a coding flaw. Marketed as a 'homepage sentence publisher', it silently exposes an operator-controlled REST API under /wp-json/link-factory/v1/ that grants the plugin's author covert command-and-control over any site that installs it. Publicly available exploit code exists (reported by WPScan); the endpoints require no WordPress authentication and are gated only by a detached Ed25519 signature tied to the operator's hardcoded public key, so the operator retains privileged access indefinitely.
Remote code execution in Velocity.js (npm 'velocityjs') versions <= 2.1.6 lets an attacker who controls template content reach the JavaScript Function constructor and run arbitrary code in the server process. The earlier CVE-2026-44966/GHSA-j658-c2gf-x6pq fix only filtered constructor/__proto__/prototype in the #set assignment target, leaving property-read expressions in references.ts unguarded, so this is a straightforward bypass. Publicly available exploit code exists (a working PoC is published in the GHSA advisory and was vendor-verified on v2.1.6); no confirmed active exploitation (not in CISA KEV).
Missing authentication on OpenChoreo's cluster-gateway (before 1.0.2 and 1.1.2) exposed caller-facing management APIs on the same externally reachable listener used for agent WebSocket traffic, letting network-reachable attackers hit /api/proxy/ and /api/exec/ without any credentials. In multi-cluster deployments this permits proxying the data-plane Kubernetes API and executing commands inside workload pods, effectively yielding cross-cluster control. No public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-qh9r-j7rp-4x2m) and CVSS 9.6 mark it as critical.
Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScript sandbox by abusing the /api/v1/node-custom-function endpoint. By passing attacker-controlled executablePath and args into puppeteer.launch(), the code reaches child_process.spawn() outside the sandbox, yielding arbitrary OS command execution as the Flowise process user (root in the official Docker image) and host file disclosure via Chromium's file:// handling. No public exploit is identified at time of analysis, but a vendor security advisory (GHSA-9gvv-qjj3-2p6g) and VulnCheck confirm the flaw; the CVSS 4.0 base score is 9.4.
Supply-chain backdoor in Fluent Forms Pro (Add-On Pack) 6.2.7 for WordPress was delivered as a tampered plugin build through a decommissioned update server, embedding malicious code (CWE-506) rather than a coding flaw. Any site that installed the poisoned 6.2.7 package gains a rogue license-sync PHP file that stands up an unauthenticated backdoor REST endpoint, creates a passwordless administrator, and drops persistent payloads that survive plugin removal. No CISA KEV entry or public exploit code is referenced, but the malicious build itself constitutes distributed attacker code, and VulnCheck plus the vendor (WPManageNinja) have publicly confirmed the incident.
Supply-chain compromise of the Ninja Tables Pro WordPress plugin (version 5.2.11) delivered a tampered build through a decommissioned vendor update server, embedding a backdoor that gives attackers full control of affected WordPress sites. Once installed, the rogue code stands up an unauthenticated REST API endpoint, plants a passwordless administrator account, and drops persistent PHP payloads that survive plugin removal. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no CISA KEV listing and no public exploit code identified at time of analysis, though the backdoor itself constitutes weaponized malicious code shipped to victims.
Predictable SM2 private-key and signing-nonce generation in the sm-crypto npm library (versions prior to 0.5.0) lets an attacker recover keys generated in Node.js. Because jsbn's SecureRandom checks window.crypto rather than Node's globalThis.crypto, the default sm2.generateKeyPairHex() falls back to seeding an ARC4 stream from Math.random() and the wall clock, so an adversary who observes a few Math.random() outputs and estimates the generation time can reconstruct private keys and forge signatures. Publicly available exploit code exists (reproduced end-to-end against the real npm packages), but no public exploit is identified as being used in active attacks and there is no CISA KEV listing.
Remote code execution in Flowise before 3.1.3 lets authenticated users abuse the Custom MCP node - when CUSTOM_MCP_PROTOCOL is set to stdio - to run arbitrary OS commands on the host. By manipulating environment variables (PYTHONWARNINGS, BROWSER) passed to python3 or leveraging node with the root working directory, an attacker bypasses input validation and achieves command execution as the Flowise service account. Reported by VulnCheck with a CVSS 4.0 score of 9.0; no public exploit is identified at time of analysis, though the technique is documented in detail in the vendor advisory.
Remote code execution in Flowise before 3.1.3 lets authenticated users escape the vm2 JavaScript sandbox and run arbitrary code on the host. By abusing a moment.js locale-validation weakness, an attacker supplies a forged String object whose match function defeats the path-traversal check, causing Flowise to load and execute an attacker-planted JavaScript file from the document store outside the sandbox. Reported by VulnCheck and fixed by the vendor; no public exploit or CISA KEV listing was identified at time of analysis, though the CVSS 4.0 base score of 9.0 reflects full compromise of confidentiality, integrity, and availability.
Remote code execution and SSRF in FlowiseAI Flowise before 3.1.3 stems from a bypassable regex-based Python code validator in the CSV and Airtable Agent nodes, letting attackers smuggle malicious pandas calls through the unauthenticated prediction API via prompt injection. Because the validator blocklists rather than sandboxes, unblocked functions such as pd.read_json() can be abused to exfiltrate local datasets, reach internal services (SSRF), or execute arbitrary code. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the reporting vendor VulnCheck and a GitHub Security Advisory (GHSA-w7x8-q2gp-5cgg) document the issue.
Authenticated arbitrary Python code execution in FlowiseAI Flowise before 3.1.3 arises from the CSV Agent node's customReadCSV parameter, whose regex-based validator can be defeated with obfuscation to run attacker-supplied code inside an unsandboxed pyodide runtime with full host access. Any user able to build or edit a chatflow can escalate from application-level access to code execution on the server. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch exists in version 3.1.3.
Remote code execution in Flowise before 3.1.3 lets attackers run arbitrary Python on the host by abusing the Airtable Agent node. Crafted chatflow prompts carry obfuscated Python that slips past the pythonCodeValidator blocklist and executes inside an unsandboxed pyodide runtime with full access to the underlying OS. Reported by VulnCheck with a published GHSA advisory; no public exploit code is identified at time of analysis, and it is not listed in CISA KEV.
Missing authentication in OpenChoreo's cluster-gateway internal API lets any network-reachable caller invoke /api/proxy/, /api/exec/, and /api/wirelogs/ without a client certificate or token, exposing tenant Kubernetes Secrets and allowing workload mutation and arbitrary command execution across every connected data plane. All deployments before 1.0.3, 1.1.3, and 1.2.0-rc.2 are affected, and the fix introduces an opt-in --internal-mtls mode plus a dedicated internal CA. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; risk is amplified because the internal listener effectively brokers cross-tenant, multi-cluster control-plane access.
Remote code execution in the QA Analytics (QA Heatmap Analytics) WordPress plugin through version 5.2.0.0 lets unauthenticated attackers inject and execute arbitrary code on the hosting server, per a Patchstack advisory. The flaw is a CWE-94 code injection carrying a maximum CVSS 10.0 rating with a network attack vector requiring no privileges or user interaction. No public exploit has been identified at time of analysis, but the pre-auth nature and trivial complexity make it a top-tier patching priority for any WordPress site running the plugin.
Unauthenticated arbitrary code execution affects the WordPress plugin WP BASE Booking (of Appointments, Services and Events) in all versions up to and including 6.3.0, reported by Patchstack and classified as CWE-94 code injection. A remote attacker with no authentication can cause attacker-controlled code to execute on the hosting server, yielding full compromise of the site and its data. There is no public exploit identified at time of analysis and no CISA KEV listing, but the maximal CVSS rating and unauthenticated network vector make this a high-priority patch.
Authentication bypass in the Priority Portal Generator add-on for Priority ERP (developed by Soft Solutions) lets remote unauthenticated attackers reach protected portal functionality and, because of a scope change, the underlying ERP data it fronts. The maximum CVSS 10.0 rating reflects network reach, no privileges, and high confidentiality and integrity impact. Reported to Israel's INCD; no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
Security-restriction bypass in IBM i (the operating system for IBM Power servers, formerly OS/400) versions 7.3 through 7.6 lets a remote attacker abuse improper validation of user-controlled addresses to elevate privileges and cross a security boundary. Vendor scoring rates this a maximum-severity, unauthenticated network flaw (CVSS 10.0, scope-changed), though there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.33%). IBM published a fix, and CISA's SSVC framework currently marks exploitation as 'none' with a 'total' technical impact.
Cross-tenant authorization bypass in Trigger.dev before 4.5.6 lets a caller holding a valid API key for one project act on another project's deployment. Because CreateDeploymentBackgroundWorkerServiceV4.call() looks up the deployment by friendlyId with no environmentId/tenant predicate, an attacker can attach an attacker-controlled background worker to a victim project's deployment and force it from BUILDING to DEPLOYING. No public exploit identified at time of analysis; the flaw is an insecure-direct-object-reference (IDOR) affecting the deployments API.
Privilege escalation in IBM i (7.3, 7.4, 7.5, 7.6) lets a remote, authenticated attacker gain elevated privileges by abusing improper validation of pointers read from Java-controlled addresses, giving full compromise of the affected component and a scope-changing impact beyond it. IBM assigned a critical CVSS 9.9 (S:C) despite requiring low privileges. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, so this is a patch-worthy critical without evidence of active abuse yet.
Remote code execution in IBM Documentation Offline 1.0.0 through 1.4.1 allows an attacker to run arbitrary code by abusing improper control of file paths (CWE-73). The flaw is reachable over the network without authentication or user interaction per the vendor-assigned CVSS 9.8 vector, giving an attacker full read/write/execution impact on the host. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Account takeover via broken authentication in the Cartify Multipurpose WooCommerce WordPress theme (versions <= 1.3.0.1) lets an unauthenticated remote attacker authenticate as an arbitrary user, including administrators, without valid credentials. Reported by Patchstack and rated CVSS 9.8, the flaw stems from an authentication logic error (CWE-288) that permits identity assertion through an alternate path. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in the Salon Booking System WordPress plugin (versions 10.30.26 and earlier) allows remote unauthenticated attackers to defeat the plugin's identity/verification logic (CWE-288) and gain access to protected functionality or data without valid credentials. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects network-reachable, low-complexity exploitation with high confidentiality, integrity, and availability impact; Patchstack tags it as Information Disclosure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in the miniOrange 'OAuth Single Sign On - SSO (OAuth Client)' WordPress plugin (versions 7.0.0 and earlier) lets an unauthenticated remote attacker defeat the OAuth login flow and authenticate as an arbitrary user, including administrators. The CVSS 3.1 base score is 9.8 with a network, no-privilege, no-interaction vector, and the issue is rooted in improper verification of the identity asserted during single sign-on (CWE-290). At the time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, but the combination of unauthenticated access and full account takeover makes it a high-priority patching target.
Authentication bypass in IBM i (OS/400) versions 7.3, 7.4, 7.5, and 7.6 allows a remote unauthenticated attacker to access server resources with the privileges of an authenticated user by exploiting improper authentication handling during NTLM session negotiation. The CVSS 3.1 base score is 9.8 (network vector, no privileges, no user interaction, total confidentiality/integrity/availability impact), though the EPSS exploitation probability is low (0.40%, 33rd percentile) and CISA's SSVC framework records exploitation status as 'none'. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated PHP object injection in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, enabling property-oriented programming (POP) gadget chains that can lead to remote code execution, data theft, or site takeover. The flaw carries a CVSS 9.8 rating with a fully remote, no-authentication, no-interaction vector and was reported by Patchstack; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because SSO plugins sit on the authentication path, a successful exploit can compromise the entire WordPress site.
Remote code execution in IBM i (formerly OS/400) releases 7.3 through 7.6 stems from a buffer overflow (out-of-bounds write) that a remote, unauthenticated attacker can trigger to run arbitrary code on the host. IBM has published a fix, and while the CVSS base score is 9.8, there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at only 0.37% (30th percentile). CISA's SSVC framing rates exploitation as none and the vulnerability as not automatable, tempering the raw-score urgency.
Authentication bypass in IBM i (the operating system for IBM Power/AS-400 midrange systems) versions 7.3, 7.4, 7.5, and 7.6 allows remote attackers to circumvent security restrictions because the system improperly validates a client-asserted identity (CWE-287). Because a caller's claimed identity is trusted without adequate verification, an attacker can impersonate another principal and gain unauthorized access to protected resources with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.34%, 27th percentile), but the CVSS 9.8 rating and network-reachable, unauthenticated vector make this a high-priority patch.
Broken access control in the Nokri WordPress job board theme (versions 1.6.6 and earlier by ScriptsBundle) lets remote unauthenticated attackers bypass authorization controls to access or manipulate resources that should be restricted, with the CWE-640 mapping indicating a weakness in the account/password recovery mechanism. Rated CVSS 9.8 with a full network/no-privilege/no-interaction vector implying full confidentiality, integrity, and availability impact, this issue is reported by Patchstack and tagged as information disclosure. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Privilege escalation in the WooCommerce-focused "SMS Alert Order Notifications" WordPress plugin (versions 3.9.7 and earlier) lets an unauthenticated remote attacker gain elevated privileges on the site. The flaw stems from incorrect privilege handling (CWE-266) and, per its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), is remotely reachable without authentication or user interaction, yielding full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.8 base score and unauthenticated nature make it a serious, near-full-compromise risk.
Privilege escalation in the miniOrange OTP Verification WordPress plugin (versions 5.5.1 and earlier) allows unauthenticated remote attackers to elevate their privileges, per a Patchstack advisory. The flaw is rooted in a weak account/OTP verification mechanism (CWE-640) that can be abused without any credentials, and carries a CVSS 9.8 rating reflecting full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the unauthenticated network vector makes this a high-priority patching candidate.
SQL injection in IBM i 7.6, 7.5, and 7.4 lets a remote attacker submit specially crafted SQL statements that read, insert, alter, or delete data in the back-end database. The flaw is vendor-reported by IBM and carries a 9.8 CVSS with a network, unauthenticated vector, though no public exploit identified at time of analysis and EPSS exploitation probability is low (0.27%, 19th percentile).
Remote code execution in IBM Documentation Offline 1.0.0 through 1.4.1 stems from improper neutralization of output written to logs (CWE-117), which a remote attacker can leverage to run arbitrary code with total impact to confidentiality, integrity, and availability. IBM has published a fix, and the vendor CVSS of 9.8 reflects an unauthenticated network-reachable vector; however, EPSS is low (0.27%, 19th percentile) and there is no public exploit identified at time of analysis, so exposure appears theoretical rather than active. Note a signal conflict: the root-cause weakness is log injection, yet the stated impact is code execution - the intermediate mechanism is not documented in the available data.
Authentication bypass in LemonLDAP::NG (CWE-305) allows remote unauthenticated attackers to defeat a primary authentication control and access protected resources, tagged by the reporter as leading to information disclosure. All maintained branches are affected, with fixes shipped in 2.23.3, 2.21.5, and 2.16.9; the issue was disclosed via oss-security and packaged by Ubuntu. There is no public exploit identified at time of analysis, and EPSS is low at 0.27% (18th percentile) despite the 9.8 CVSS.
Authentication bypass in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) allows unauthenticated remote attackers to forge or manipulate JWTs and assume the identity of any user, including administrators. The CWE-347 root cause (improper verification of a cryptographic signature) combined with a network attack vector yields a critical 9.8 CVSS. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in the rtCamp "Log in with Google" WordPress plugin (versions <= 1.4.2) lets unauthenticated remote attackers assume the identity of legitimate users because the plugin insufficiently verifies the authenticity of the Google OAuth login response. Rated CVSS 9.8, the flaw permits full account takeover without credentials or user interaction; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the Patchstack advisory confirms the vulnerability class.
Account takeover in the Customer Email Verification for WooCommerce WordPress plugin (versions 2.4.0 through 3.2.5) lets unauthenticated attackers hijack any registered user who has not yet confirmed their email. The plugin validates the email-activation code with a loose (type-juggling) comparison, so a crafted value type satisfies the check without knowing the real code, marking the target account as verified under attacker control. Rated CVSS 9.8 with a patch available in 3.2.6; no public exploit is identified at time of analysis and EPSS is low (0.15%).
Remote code execution in WebErpMesv2 (SMEWebify) versions 1.19 and prior lets a self-registered user upload an arbitrary PHP file through the HR Expense 'scan_file' parameter, which the vulnerable HumanResourcesController wrote directly into the web-served public/file/Expense directory with no extension or MIME validation. Because registration is open (no invite) and the CheckUserRole middleware silently swallows RouteNotFoundException, the privilege barrier collapses into effectively unauthenticated RCE against a default install. There is no public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-chhq-7p67-2ff9) and fixing commit confirm the flaw and its exploitability.
Improper authentication in IBM i (IBM's integrated midrange operating system, formerly OS/400) versions 7.3, 7.4, 7.5 and 7.6 allows a remote attacker to bypass authentication controls to execute arbitrary code or read sensitive data, provided a legitimate user is induced to interact (UI:R). IBM has published a fix (support node 7283292) and rates it 9.6 critical; there is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS score of 0.41% (34th percentile) indicating no observed mass exploitation yet.
Arbitrary file read in HashiCorp Vault Secrets Operator versions 1.3.0 through 1.4.1 lets a low-privileged Kubernetes tenant abuse the AppRole authentication's SecretIDPath configuration to read files from the operator pod's filesystem and exfiltrate their contents to an attacker-controlled endpoint, enabling privilege escalation across the cluster. Because the operator pod typically holds credentials and tokens spanning multiple tenants, a single limited-RBAC tenant can cross trust boundaries (CVSS scope change), yielding a 9.6 rating. No public exploit identified at time of analysis, but the low attack complexity and multi-tenant blast radius make this a high-priority patch.
Authorization bypass in Open Identity Platform OpenDJ before 5.1.2 lets any authenticated account holding the proxied-auth privilege impersonate arbitrary non-root directory users during a SASL PLAIN bind. The PlainSASLMechanismHandler validated only the PROXIED_AUTH privilege but skipped the mayProxy ACI scope check, so the proxy ACIs meant to constrain which identities may be assumed were not enforced (CVSS 9.6). No public exploit has been identified at time of analysis, but the flaw is confirmed by the vendor GHSA advisory and fixed in 5.1.2.
Path traversal in Vitest Browser Mode (@vitest/browser) lets any client reachable via the Browser Mode API read, create, overwrite, or delete arbitrary files on the host running the test process, bypassing the allowWrite permission gate entirely. Affected are Vitest before 3.2.7, 4.x before 4.1.10, and the 5.0.0-beta line before 5.0.0-beta.6, where provider commands (upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, annotateTraces) accept browser-supplied paths without confining them to the project root. There is no public exploit identified at time of analysis and it is not in CISA KEV; the highest-impact primitive is the upload command's arbitrary file read.
Authentication bypass in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8) allows remote attackers to circumvent authentication controls when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled, exposing protected real-time communication functions. The CVSS 3.1 base score is 9.4 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:L), reflecting high confidentiality and integrity impact reachable over the network without credentials. A vendor patch is available; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
SQL injection in the FreePBX missedcall module (versions 16.0.0 through 16.0.10 and 17.0.0 through 17.0.3) lets an unauthenticated caller inject SQL via a crafted SIP From-header Caller ID name that is written unescaped into the missedcalllog INSERT in agi-bin/missedcallnotify.php. When a monitored extension goes unanswered, the injected payload executes against the FreePBX database, enabling corruption of records and modification of administrator accounts to gain unauthorized remote admin access. Rated CVSS 4.0 9.3; no public exploit identified at time of analysis, though the fixing commits are public and clearly reveal the vulnerable code path.
Arbitrary file write in Budibase before 3.40.0 allows authenticated users holding the builder role to plant files with path-traversal sequences that survive the workspace export process, letting them write attacker-controlled content to any location writable by the Budibase server process. The flaw stems from unsanitized S3 object keys whose `..` segments escape the temporary export directory, and successful abuse can pivot to remote code execution or configuration tampering. This is a CVSS 4.0 9.4 issue with no public exploit identified at time of analysis and no CISA KEV listing.
Privilege escalation to root in luci-app-lxc, the LXC container management app for OpenWrt's LuCI web interface, allows low-privileged authenticated users to reach backend container-management routes they should not be authorized for due to an ACL inconsistency, then abuse a path-traversal flaw in the lxc_name parameter to hijack host-side container hooks. Chaining the authorization gap with the traversal yields arbitrary code execution as root on the OpenWrt host. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.4 and full host compromise make this critical.
Arbitrary file write in OpenWrt's luci-app-openvpn (the LuCI web-interface plugin for managing OpenVPN) lets an authenticated web user smuggle a path-traversal sequence through the instance_name2 upload parameter to write files anywhere on the device filesystem. Because OpenWrt processes run as root, an attacker can drop an SSH key into a system directory and obtain persistent root code execution across reboots. No public exploit has been identified at time of analysis, but the CVSS 4.0 base score of 9.4 and root-level impact make this a high-priority patch for exposed OpenWrt routers.
Unauthenticated remote code execution in AgenticSeek (commit fc242c7) lets any network-adjacent attacker run arbitrary OS commands by POSTing crafted queries to the /query API endpoint, which the autonomous agent turns into shell commands executed via BashInterpreter (subprocess.Popen with shell=True and safety=False). The endpoint listens on 0.0.0.0:7777 with wildcard CORS and no authentication, so a single crafted HTTP request yields full host-level command execution, and an incomplete command blocklist fails to contain it. Rated CVSS 4.0 9.3 (critical); no public exploit identified at time of analysis and not listed in CISA KEV, but exploitation is trivial once the port is reachable.
Unauthenticated remote root compromise affects CyberPanel before 3.0.0 through a hard-coded JWT signing secret in the WebTerminal FastAPI SSH service. Because the secret is baked into the code, an attacker can mint a valid token specifying ssh_user=root and connect to the WebSocket terminal on TCP 8888 with no credentials, receiving a fully interactive root shell. No public exploit identified at time of analysis, but the trivial exploitation path (known secret, single forged token) makes reliable weaponization straightforward for any actor who reads the source.
Authentication bypass in the Portal Generator Addon (developed by Soft Solutions) for Priority ERP allows remote, unauthenticated attackers to invoke a critical function that should be gated behind authentication, exposing sensitive ERP data. Rated CVSS 9.3 with a scope change, the flaw stems from a missing authentication check (CWE-306) on a network-reachable function. It was reported by Israel's National Cyber Directorate (INCD); no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in File Browser (filebrowser) through version 2.63.16 lets unauthenticated attackers self-register accounts that inherit the server's root scope with full create, modify, delete, rename, share, and download permissions, granting complete access to every file the server can reach. The flaw only manifests when the optional self-signup feature is enabled together with the default CreateUserDir behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 9.3 reflects trivial, unauthenticated exploitation once signup is exposed.