Unauthenticated remote attackers can overwrite administrator email addresses and abuse IBM Langflow OSS as an outbound mail relay by exploiting a missing authentication control on the registration endpoint, affecting versions 1.0.0 through 1.10.0. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms trivially reachable exploitation with no credentials or user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this viable for opportunistic exploitation once the endpoint is discovered.
Memory exhaustion denial of service in cockpit-ws affects Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Dev Spaces, exploitable by any remote unauthenticated attacker. The login page request handler leaks a heap allocation on every HTTP request that includes a CockpitLang cookie, with no authentication or special privilege required. Sustained request flooding with this cookie will exhaust host memory, crashing the cockpit-ws service and potentially destabilizing the underlying host; no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated remote disclosure of Edge Processor pipeline configurations in Splunk Enterprise 10.4.x exposes potentially sensitive data-processing logic to any network-accessible attacker. The REST API endpoint serving Edge Processor configuration lacks authentication controls (CWE-306), meaning any unauthenticated actor can retrieve pipeline details when the Edge Processor feature is enabled. No public exploit code has been identified at time of analysis, and the flaw is restricted to the 10.4.x branch - prior versions are unaffected.
Remote denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash or exhaust resources in the SSL subsystem by omitting an expected client certificate during the TLS handshake. The CVSS 7.5 rating (AV:N/AC:L/PR:N/UI:N) confirms low attack complexity with no authentication required, making exploitation straightforward against any exposed SSL service on affected systems. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the patch is available and should be prioritized for internet-facing AIX and VIOS deployments.
Null pointer dereference in Wireshark's X.509IF protocol dissector crashes the application across versions 4.6.0-4.6.7 and 4.4.0-4.4.18, enabling remote denial of service against any instance processing affected traffic. An unauthenticated network attacker can trigger the crash by injecting a malformed X.509IF packet into traffic being captured or analyzed, with no privileges or user interaction required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at the time of analysis, though the zero-complexity attack surface warrants prompt patching.
SQL injection in stigmem-node 0.9.0a1 stems from PostgreSQL schema identifiers being interpolated into SQL strings without defensive identifier quoting. Operators using the Postgres backend in affected versions are directly impacted; the CVSS 4.0 vector (PR:H, AT:P) reflects that the current vulnerable code path requires operator-level control over schema configuration, though the unsafe pattern creates latent risk if schema names are ever derived from tenant or request input. No public exploit code exists and no CISA KEV listing has been identified; the vendor-released patch in 0.9.0a2 resolves the issue by adding identifier quoting and regression coverage.
Wireshark's RRC protocol dissector crashes due to an out-of-bounds write (CWE-787) in versions 4.6.0-4.6.7 and 4.4.0-4.4.18, enabling denial of service against any instance actively capturing or replaying Radio Resource Control (LTE/5G) traffic. The CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector confirms an unauthenticated network-adjacent attacker can trigger the crash by injecting a malformed RRC packet into a monitored segment. No public exploit code has been identified at time of analysis, and impact is strictly availability - no confidentiality or integrity loss.
Wireshark's C12.22 protocol dissector crashes via a stack-based buffer overflow when processing malformed C12.22 packets, enabling unauthenticated remote denial of service against versions 4.4.0-4.4.18 and 4.6.0-4.6.7. An attacker who can inject crafted C12.22 traffic into a live capture session - or supply a malicious PCAP file - can crash the analyzer process, blinding the analyst to network activity. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in available intelligence.
Denial of service in the Wireshark ESS protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, allowing a remote unauthenticated attacker to crash Wireshark by injecting crafted packets into a network segment under active capture. The root cause is CWE-457 (use of an uninitialized variable) in the ESS dissector, which triggers an unhandled crash on malformed ESS traffic. No CISA KEV listing or public exploit has been identified; an EPSS score of 0.25% (16th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world exploitation likelihood despite the high CVSS base score.
Unauthenticated sensitive data exposure in the CMSMinds Pay with Contact Form 7 WordPress plugin (versions through 1.0.4) allows remote, unauthenticated attackers to retrieve sensitive information - likely payment-related or personal contact data - without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms a fully network-accessible attack path requiring zero privileges, yielding high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthorized access to user chat data in Bottinelli Informatica Vedo Suite 1.2.5 is possible via an Insecure Direct Object Reference (IDOR) flaw in the api_vedo/chat REST endpoint, where the utente_chat parameter is not validated against the requester's session or authorization context. The 'Authentication Bypass' tag alongside a PR:N CVSS vector indicates the endpoint may be reachable without any valid credentials, making this a high-confidence confidentiality breach for any network-accessible deployment. No public exploit code has been confirmed in automated exploit frameworks, and the EPSS score of 0.24% (16th percentile) indicates limited observed exploitation at time of analysis, consistent with a low-prevalence niche product.
Improper access control in Splunk AI Toolkit versions below 6.0.0 allows an authenticated user holding the schedule_search capability to deserialize arbitrary model files by invoking the apply search command via a scheduled search. Because the toolkit does not designate apply as a risky command, Splunk's built-in risky-command access controls are never triggered, enabling privilege escalation beyond what the role should permit. A vendor-released patch exists (version 6.0.0); no public exploit or CISA KEV listing has been identified at time of analysis.
Denial of service in RDK-B WebUI version rdkb-2025q4-kirkstone.04.10.26 is achievable by any remote unauthenticated attacker who submits an excessively large password value to the login handler, triggering uncontrolled resource consumption in the `check.jst` template. The flaw (CWE-400) requires no credentials, no user interaction, and no special configuration - any device with its WebUI reachable is vulnerable to availability loss. EPSS sits at 0.22% (13th percentile), and no active exploitation or public exploit code has been identified at time of analysis, keeping real-world urgency moderate despite the high CVSS base score.
Unauthenticated broken access control in the Outranking Plugin Options WordPress plugin (versions 1.1.3 and below) allows remote unauthenticated attackers to modify plugin options, resulting in high integrity impact. The root cause is CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user has permission before processing option-change requests. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the CVSS:3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N reflects a low-barrier, fully network-exploitable condition.
FreeBSD's wg(4) WireGuard kernel driver silently accepts packets bearing invalid Poly1305 authentication tags, completely defeating WireGuard's cryptographic integrity guarantee on affected FreeBSD versions. The driver dispatches decrypt operations to the OpenCrypto Framework (OCF) but never checks the returned MAC verification result, meaning tampered or forged ciphertext passes through as legitimate plaintext. Two distinct attack paths exist: an on-path attacker who can intercept WireGuard UDP traffic can modify ciphertext and authenticated data without detection, while a remote attacker with knowledge of the receiver's replay window bounds can inject forged transport data packets directly. No public exploit has been identified and EPSS sits at 0.18% (8th percentile), indicating no widespread automated exploitation at time of analysis.
Timing side-channel in Net::OAuth before 0.33 for Perl allows remote unauthenticated attackers to recover valid signatures byte-by-byte by measuring server response latency during signature rejection. For HMAC-SHA1 and HMAC-SHA256 methods the oracle yields a forged HMAC token; under the PLAINTEXT signature method the comparison is performed directly against the signature key, meaning the timing oracle exposes the raw consumer_secret and token_secret. No public exploit has been identified at time of analysis and EPSS is 0.17% (6th percentile), but the PLAINTEXT credential-exposure path is theoretically severe for any deployment relying on that method.
Open mail relay in the J-BusinessDirectory Joomla extension (versions 1.0.0-6.2.2) allows unauthenticated remote attackers to redirect business contact emails to arbitrary recipients by supplying an attacker-controlled email address in the contact_id_offer or contact_id_event request parameters. The extension incorrectly trusts client-supplied input for recipient resolution rather than performing a server-side lookup against the referenced offer or event record. No public exploit has been identified and EPSS is at the 5th percentile, but the zero-authentication requirement and trivial exploitation path make opportunistic abuse of the site's mail infrastructure realistic.
Unauthenticated account lockout in the User Verification by PickPlugins WordPress plugin (through version 2.0.47) enables remote attackers to reset the email-verification status of any WordPress account - including administrators - by exploiting two authorization failures simultaneously: the resend-verification endpoint neither validates that the requestor is authorized to act on the specified user ID, nor binds the protective token to the targeted user. This effectively provides a remote, zero-privilege mechanism to lock any site account out of access. No public exploit code exists at the time of analysis, though SSVC classifies the attack as automatable, meaning bulk account disruption campaigns are technically feasible.
Wireshark's H.245 protocol dissector crashes on malformed H.245 packets across versions 4.6.0-4.6.7 and 4.4.0-4.4.17, enabling unauthenticated remote denial of service against any analyst actively capturing H.323 multimedia traffic. The null pointer dereference (CWE-476) is triggered automatically during dissection, requiring no user interaction beyond running Wireshark on a monitored network. No active exploitation or public proof-of-concept has been identified; EPSS probability sits at 0.10% (1st percentile) and SSVC classifies exploitation as none.
Unauthenticated remote file disclosure in Cisco BroadWorks stems from the OCI XML Parser permitting external entity resolution by default, allowing an attacker to read arbitrary filesystem files with the privileges of the BroadWorks process account. The affected component is the Open Client Interface - Provisioning (OCI-P) service, reachable over the network with no authentication or user interaction required, yielding a CVSS 7.5 score with C:H. No public exploit has been identified at time of analysis, and this vulnerability has not been confirmed as actively exploited by CISA KEV.
Buffer management vulnerabilities (CWE-119) in Cisco Secure Workload enable unauthenticated remote attackers to cause a denial-of-service condition against the platform, with no confidentiality or integrity impact per Cisco's own CVSS assessment. An extremely broad range of versions from 1.x through 4.0.x are affected, spanning many years of releases, indicating this class of flaw was introduced early in the product lifecycle. No public exploit identified at time of analysis and no active exploitation confirmed; Cisco discovered these vulnerabilities internally during a proactive hardening review and issued a software hardening release.
Sensitive data exposure in the Track Geolocation Of Users Using Contact Form 7 WordPress plugin (versions <= 3.0.2) permits remote unauthenticated attackers to retrieve geolocation records collected from Contact Form 7 form submissions with no credentials or user interaction required. The vulnerability is rooted in CWE-201 - sensitive information returned in responses to unauthorized parties - yielding high confidentiality impact consistent with the CVSS vector (C:H/I:N/A:N). No public exploit code has been confirmed and the CVE does not appear in CISA KEV at time of analysis, though the trivial attack prerequisites (AV:N/AC:L/PR:N/UI:N) mean that exploitation would be straightforward once the plugin's vulnerable endpoint is identified.
Broken access control in the Stitch Express WordPress plugin (versions <= 1.9.0) allows unauthenticated network attackers to perform privileged operations by bypassing missing authorization checks (CWE-862). The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N confirms zero-friction remote exploitation with high integrity impact, meaning unauthorized data modification or administrative action is achievable without credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
Non-constant-time password hash comparison in Relay's authentication layer exposes a timing side-channel that allows credential inference via statistical analysis of response latencies. Attackers who can issue repeated authentication requests and measure response timing with sufficient precision can progressively reconstruct valid hashes or credentials byte-by-byte. No KEV listing exists and no public exploit has been identified at time of analysis, though timing oracle attacks of this class are well-understood with established methodology and tooling.
Authentication bypass in IBM System Storage DS8A00 (firmware 10.1.3.0-10.11.35.0) and DS8900F (firmware 89.40.83.0-89.44.25.0) exposes enterprise storage array management interfaces to network-reachable attackers who can circumvent security controls without valid credentials, enabling exfiltration of sensitive management data or availability disruption. The root cause is CWE-116 (Improper Encoding or Escaping of Output) in DSCLI command output processing, where encoding defects allow authentication logic to be bypassed. No public exploit code has been identified at time of analysis, and a vendor patch is available via IBM's security advisory.
Stored XSS in HumHub Community Edition 1.18.4 and 1.18.4-pl1 allows authenticated low-privilege users to inject arbitrary HTML and JavaScript into the oEmbed confirmation prompt rendered for other users. The attacker-controlled URL prefix was passed unencoded into the HTML consent dialog via Html::tag() in UrlOembed.php, and a secondary code path flaw allowed confirmation content to flow through a CSP nonce injection routine - meaning embedded markup could acquire a valid nonce and bypass Content Security Policy. No public exploit identified at time of analysis, though Fluid Attacks has published a coordinated disclosure advisory with proof-of-concept detail.
Denial of service via use-after-free in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated attacker on an adjacent network to crash affected systems by triggering a memory corruption condition. The scope change (S:C) in the CVSS vector is significant in virtualization contexts: a successful attack against PowerVM VIOS could cascade to hosted virtual machines, amplifying the availability impact beyond the directly targeted component. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
OS command injection in Dell RecoverPoint for Virtual Machines versions 6.0.3 and 6.0.3.1 enables a high-privileged remote attacker to execute arbitrary operating system commands on the underlying host. The vulnerability stems from improper neutralization of special elements passed to OS commands (CWE-78), resulting in full confidentiality, integrity, and availability impact per the CVSS vector. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the vendor self-disclosed this via Dell Security Advisory DSA-2026-096, indicating a confirmed code-level flaw.
Certificate validation bypass in Splunk Connect for Kafka below version 2.2.7 allows a network-positioned unauthenticated attacker to intercept and modify event data in transit to Splunk Enterprise's HTTP Event Collector when Kerberos authentication is configured. The Kerberos code path fails to apply the connector's configured TLS certificate validation options when constructing the HTTP client, effectively negating transport security despite HEC's TLS configuration. No active exploitation has been identified (not in CISA KEV), but the confidentiality and integrity impact on Splunk-ingested telemetry data is high.
Improper TLS certificate validation in Splunk SOAR's CyberArk REST client exposes all credential vault traffic to interception and tampering by a network-positioned attacker. Versions below 8.6.0 are affected when a CyberArk REST credential manager integration is configured; the client accepts any server certificate without verification, making TLS sessions transparent to a man-in-the-middle. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA KEV catalog, but the high confidentiality and integrity impact on privileged credential data warrants priority remediation in environments relying on CyberArk for SOAR playbook secrets.
FreeBSD's ELF core dump subsystem contains a TOCTOU race condition that allows an unprivileged local user sharing an address space via rfork(2) to trigger a kernel heap out-of-bounds write, potentially escalating privileges to root. Affected releases are FreeBSD 14.4-RELEASE prior to p8, 15.0-RELEASE prior to p12, and 15.1-RELEASE prior to p2, as confirmed in FreeBSD Security Advisory FreeBSD-SA-26:55.elf. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated SPL injection in Splunk Enterprise's nearby-event search feature allows remote attackers to execute arbitrary Search Processing Language queries without authorization across versions 9.4.x, 10.0.x, 10.2.x, and 10.4.x. The root cause is a two-pronged failure: Splunk Web does not consistently escape caller-supplied values when constructing SPL for nearby-event searches, and the embedded report access endpoint accepts those crafted requests without performing the expected authorization check. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the unauthenticated network vector and wide enterprise deployment of Splunk make this a priority patch.
Stored cross-site scripting in Splunk Enterprise allows a 'power' role user to persist a malicious ui-tour knowledge object that executes arbitrary JavaScript in the browser of any authenticated user who visits an affected Splunk Web page. Affected are all Splunk Enterprise deployments running versions below 10.4.2, 10.2.6, 10.0.9, or 9.4.14, a broad multi-branch footprint reported via Cisco and confirmed by Splunk advisory SVD-2026-0801. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 7.3 rating and high confidentiality and integrity impact scores reflect meaningful lateral risk within an enterprise's Splunk deployment.
SPL injection in Splunk Enterprise's Job Details dashboard enables a low-privileged authenticated attacker to bypass Search Processing Language risky-command safeguards by embedding a malicious search identifier in a crafted dashboard URL and phishing an authenticated victim into opening it. The injected SPL executes under the victim's permissions, potentially exposing all data accessible to that user and compromising search integrity within those bounds. No active exploitation is confirmed and no public exploit code has been identified; a vendor patch is available across all four affected release trains per advisory SVD-2026-0801.
The Data Model Editor in Splunk Enterprise fails to apply SPL safeguards for risky commands when executing base searches for auto-extracted fields, allowing a low-privileged attacker (non-admin, non-power role) to craft a malicious request that executes arbitrary SPL commands under a victim's authenticated session via browser-based phishing. Affected branches span four active release lines - 9.4.x below 9.4.13, 10.0.x below 10.0.8, 10.2.x below 10.2.6, and 10.4.x below 10.4.1 - confirmed by vendor advisory SVD-2026-0801. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patches are available for all affected branches.
Stack-based buffer overflow in IBM PowerVM Hypervisor's host firmware configuration parsing allows authenticated service-level access holders to crash the firmware boot stack with possible memory corruption during system initialization, impacting integrity and availability of the managed Power system. Affected firmware spans three release trains: FW1060.00-FW1060.80, FW1110.00-FW1110.30, and FW1120.00. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7283238.
Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-level crashes triggered from guest partitions. An attacker holding root access within a guest partition can write a specially crafted NVRAM image that causes the host firmware boot stage to crash with possible memory corruption, taking down the managed system until an operator manually clears NVRAM via the service processor. No public exploit code has been identified and no active exploitation is confirmed, but the persistence of the availability impact and the cross-boundary scope change (guest-to-host) make this a meaningful risk in shared multi-tenant OpenPOWER environments.
Missing Authorization in Dell Command Update (DCU) versions prior to 5.7.1 permits a low-privileged local user to invoke protected application functions without adequate authorization checks, yielding full confidentiality, integrity, and availability impact on the vulnerable system. Rooted in CWE-862, the flaw bypasses expected access controls within the DCU client utility - a driver and firmware management tool deployed across Dell client hardware fleets. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Arbitrary code execution is possible in stigmem-node versions before 0.9.0a2 when a single configuration flag is used to disable plugin signature enforcement without a required second acknowledgment. Operators who carry this permissive setting from development into shared or production environments create a condition where any user with write access to the plugin directory can inject and execute unsigned, potentially malicious plugin code with the process's privileges. No public exploit code has been identified and no active exploitation is confirmed (not listed in CISA KEV); however, the resulting impact is full confidentiality, integrity, and availability compromise of the affected system.
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a local low-privileged attacker exploiting a Time-of-check Time-of-use (TOCTOU) race condition (CWE-367). The vulnerability allows an attacker who already has a local foothold on the system to manipulate a resource between the time it is checked and the time it is used by the update utility, resulting in full system compromise (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Path traversal in BuildKit prior to v0.31.2 enables an authenticated API client to escape the daemon's controlled state directory by submitting a crafted upload request containing traversal sequences. Affected parties include any deployment where multiple principals share BuildKit API access - such as multi-tenant CI/CD infrastructure or shared Docker build environments. The vulnerability grants a write primitive to arbitrary host filesystem locations, posing high integrity and availability risk; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in WP Statistics (all versions through 14.16.8) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into a WordPress site's database and have it execute in any privileged user's browser session when viewing the plugin's statistics dashboards. The vulnerability chain is precise: the REST API signature required to submit a hit request is exposed on the public homepage, and a base64-encoded page_uri POST parameter to the /wp-statistics/v2/hit endpoint overrides the previously sanitized REQUEST_URI, smuggling an unsanitized utm_campaign value into the database. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low exploitation complexity and large WordPress install base elevate practical urgency significantly.
Stored cross-site scripting in HumHub 1.18.4 lets a Space administrator embed arbitrary HTML or JavaScript into the deletion-reason field of a comment-removal notification sent to the comment's original author. When the victim renders the notification in their browser, the injected script executes within their authenticated HumHub session, enabling session-token theft or unauthorized actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis; an upstream patch is available as GitHub PR #8365, though a tagged release version has not been independently confirmed.
Reflected cross-site scripting in HumHub Community Edition 1.18.4 allows a low-privileged attacker to inject arbitrary JavaScript into the browser session of an authenticated non-member by embedding malicious button configuration in the `options` query-string parameter of the `space/membership/request-membership-form` endpoint. When a social-engineering lure causes the victim to submit the membership request form, the server reflects attacker-controlled markup inside a script context, enabling account takeover-class impact. No active exploitation has been confirmed (no CISA KEV listing); an upstream patch is available as GitHub PR #8381, though a formally tagged release version has not been independently confirmed.
Privilege escalation in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote attacker already holding high-privileged console credentials to elevate their access further within the platform, achieving full confidentiality, integrity, and availability impact against the management system. The root cause is improper privilege management (CWE-269), where the application fails to enforce correct privilege boundaries for existing high-privileged sessions. No public exploit or CISA KEV listing has been identified at time of analysis; Dell disclosed and patched this vulnerability via advisory DSA-2026-359.
Arbitrary file overwrite in GitPython before 3.1.58 allows attackers who can influence treeish arguments passed to IndexFile.from_tree, IndexFile.reset, or IndexFile.merge_tree to clobber any file writable by the host process with a valid git-index blob. The three affected methods in git/index/base.py forward caller-controlled strings directly to git read-tree with no option sanitization and no -- argument terminator, enabling injection of --index-output=<path>; git's last-occurrence-wins behavior lets the injected flag override the library's internal temp path. A proof-of-concept is publicly documented in GHSA-4gmw-gg2m-w46p; no CISA KEV listing was present at time of analysis.
Cross-tenant broken object level authorization (BOLA) in stigmem-node's decay sweep endpoint allows any authenticated write-credentialed tenant to destroy or enumerate facts belonging to all other tenants. Specifically, POST /v1/decay/sweep with ttl_seconds=0 expires every tenant's facts globally due to missing tenant_id predicates in the candidate-selection queries. This vulnerability exclusively affects multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant; no public exploit or CISA KEV listing exists at time of analysis, but the integrity and availability impact against multi-tenant operators is critical.
Cross-tenant broken object level authorization in stigmem-node before 0.9.0a12 allows an authenticated tenant in a multi-tenant deployment to corrupt RTBF tombstone records and trigger tenant-blind fact suppression. The root cause is twofold: the issue_tombstone function hardcoded the tenant to 'default' instead of reading it from the caller's identity, and the tombstone read-suppression path lacked a tenant_id predicate, causing deletion records to be misattributed and tombstone filtering to operate across all tenants indiscriminately. The impact is limited to deployments running the opt-in stigmem-plugin-multi-tenant; a vendor-released patch exists at 0.9.0a12, and no public exploit has been identified at time of analysis.
Out-of-bounds read in FFmpeg's DASH demuxer (libavformat/dashdec.c) allows a malicious or compromised DASH streaming server to cause memory disclosure and process crashes in any application built on FFmpeg before commit 65b0dab. The flaw arises because a live manifest refresh that decreases the startNumber attribute drives the internal fragment sequence counter negative, and only an upper-bound check exists before the value is used as an array index. No public exploit has been identified and this CVE does not appear in the CISA KEV catalog, but the network-accessible trigger, low attack complexity, and dual high confidentiality and availability impact make prompt patching a priority for deployments that process live DASH streams.
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (versions up to and including 3.2.5) allows unauthenticated attackers to inject executable HTML into pages viewed in secondary languages by exploiting the plugin's internal translation marker system. Plain-text markers (#!trpst# / #!trpen#) pass through WordPress's wp_kses sanitizer undetected at comment submission, are stored in the database, and are unconditionally converted to angle brackets during page rendering - materializing attacker-controlled text as live HTML tags such as <img onerror=...>. No public exploit has been identified at time of analysis and the vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog, but the zero-privilege stored nature of the flaw and the plugin's broad WordPress deployment make it a credible priority for any multilingual site with public commenting enabled.