Server-Side Request Forgery in Dell OpenManage Enterprise versions prior to 4.7.0 allows unauthenticated remote attackers to forge outbound HTTP requests from the server, exposing internal network resources and sensitive information. The CVSS scope-change indicator (S:C) confirms that forged requests can reach internal systems beyond the vulnerable host itself - a meaningful escalation for an enterprise IT management platform with privileged access to server infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis; Dell has released version 4.7.0 as the remediated build per advisory DSA-2026-359.
Server-Side Request Forgery in Animation Addons for Elementor WordPress plugin (versions before 2.7.2) permits unauthenticated remote attackers to coerce the WordPress server into issuing arbitrary HTTP requests to internal network hosts and relay the responses back to the attacker. The vulnerability stems from unsanitized user-supplied input being used directly to construct the host component of a server-side HTTP request. No public exploit or CISA KEV listing has been identified, and EPSS places exploitation probability at 0.15% (4th percentile), though SSVC notes the attack is automatable.
Improper access control in the Eventin WordPress plugin before 4.1.21 allows any authenticated user holding contributor-level access or higher to permanently delete arbitrary user accounts on the affected WordPress installation. The plugin's account deletion functionality omits both ownership verification and WordPress capability checks, meaning a low-privilege contributor can target and remove administrator accounts. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; however, the low technical barrier makes this a meaningful privilege-abuse risk on multi-author WordPress sites.
Remote code execution via server-side template injection (SSTI) in document-merge-service affects all versions before 9.1.0, exploitable by authenticated users with access to upload XLSX templates. The xltpl library processes XLSX templates through a non-sandboxed Jinja2 environment, allowing an attacker to embed Jinja2 expressions that execute arbitrary code server-side as the document-merge-server user (UID 901). No active exploitation (KEV) has been confirmed, but Jinja2 SSTI techniques are well-documented and HackTricks references are cited in the advisory, indicating the attack pattern is publicly known.
Broken authorization in Flow-Like's Azure presign endpoint allows authenticated app members holding only `ExecuteEvents` permission to obtain Azure Blob Storage SAS tokens with read, write, delete, and list (`sp=rwdl`) access to application content - permissions they explicitly should not possess. Only self-hosted Flow-Like deployments prior to version 1.0.4 using Azure Blob Storage are affected; the vendor's hosted services (Flow-Like Studio and the hosted Web App, both AWS-backed) are explicitly excluded. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the flaw is mechanically straightforward to abuse given that the credential overprovision is a direct API response to a single authenticated request.
Grafana OSS's Unified Alerting component allows a low-privileged authenticated organization member to query any datasource - including those they are explicitly denied access to - by setting the client-controlled queryType field to the reserved value __expr__ while supplying the UID of a real datasource in an alert rule. Authorization skips the datasources:query permission check when it sees __expr__, but the evaluator subsequently resolves and executes the query against the real datasource identified by datasourceUid, resulting in full data exfiltration through Grafana's configured credentials. Affected versions span Grafana OSS 8.4.0 through 13.1.1; no public exploit code or CISA KEV listing has been identified at the time of analysis, but the low attack complexity and confirmed reproduction under default OSS permissions make this a credible insider-threat and privilege-escalation vector.
Double-free heap corruption in FreeRDP's server-side audio redirection channel (rdpsnd) allows any authenticated RDP client to reliably crash the server and potentially corrupt heap memory in allocator-dependent ways. All FreeRDP server deployments prior to version 3.28.0 exposing the rdpsnd channel are affected. The attacker sends a single malformed Client Audio Formats PDU to leave a dangling pointer in the server context, which is then freed a second time during session teardown - guaranteeing a server crash and opening the door to further exploitation depending on the underlying allocator.
Non-blind SSRF in AIL Framework's crawler submission interface allows low-privileged authenticated users to pivot through the AIL server and reach internal networks, cloud metadata services (including 169.254.169.254), loopback addresses, and RFC1918 ranges. All versions covered by CPE cpe:2.3:a:ail-project:ail-framework:*:*:*:*:*:*:*:* are affected because manual crawler tasks bypass the existing domain blacklist via a priority-routing logic flaw, and crawled responses - including HTML, screenshots, and HAR data - are returned directly to the attacker, making exfiltration of cloud IAM credentials or internal service data straightforward. No public exploit has been identified and the vulnerability is not listed in CISA KEV; a vendor-released patch is available via upstream GitHub commit d7b60ff.
Local file disclosure in phpMyFAQ before 4.1.7 is triggered through unsanitized HTML in FAQ answers when PDF documents are generated via TCPDF. Any user holding FAQ creation or editing rights can embed an img tag whose src attribute references a local file within the content/ directory - when PDF export runs, TCPDF fails to parse the target as an image and raises an uncaught exception whose stack trace exposes a portion of the file's raw contents, potentially including database credentials stored in content/core/config/database.php. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 7.1 with high confidentiality impact accurately reflects the realistic severity given the potential for full credential exposure under permissive PHP runtime settings.
Arbitrary file read in GitPython versions through 3.1.57 allows low-privileged users who can influence kwargs passed to IndexFile.remove() or Head.checkout() to exfiltrate the complete contents of any file readable by the hosting process. The attack chains two unsanitized Git flags - --pathspec-from-file and --pathspec-file-nul - causing Git to return verbatim file contents through a GitCommandError exception that GitPython surfaces in-band. A detailed proof of concept is publicly available in the vendor GHSA advisory; this vulnerability is not currently listed in CISA KEV.
Format string injection in Coturn prior to 4.13.0 lets an authenticated TURN user crash the relay server or leak stack memory into Redis by embedding printf-style specifiers in STUN USERNAME or REALM attributes. At nine call sites in ns_ioalib_engine_impl.c, attacker-controlled values pass is_secure_string() validation and are embedded into Redis keys; send_message_to_redis() then passes the composite key as the format argument to redisAsyncCommand(), causing redisvFormatCommand() to read past the va_list. No public exploit identified at time of analysis and no CISA KEV listing; however, the attack surface is reachable by any valid TURN credential holder, including guest or externally-provisioned users in many WebRTC deployments.
Stored cross-site scripting in Splunk Enterprise's Dashboard Studio allows a user holding the 'power' role to persist a crafted workflow action URL that, when triggered by a separate authenticated victim, executes attacker-controlled JavaScript in the victim's browser session. All four actively maintained branches are affected: 10.4.x below 10.4.2, 10.2.x below 10.2.6, 10.0.x below 10.0.9, and 9.4.x below 9.4.14. No public exploit has been identified at time of analysis, and exploitation is constrained by a required internal 'power' role and mandatory victim social engineering, meaningfully limiting the realistic attacker population despite the high impact ratings.
Function library integrity in ArcadeDB 26.7.3 and earlier can be silently tampered by any authenticated low-privilege database user because the UPDATE_SCHEMA permission gate is bypassed when a DEFINE FUNCTION statement targets an already-existing library rather than creating a new one. Attackers holding only basic database credentials can overwrite or inject SQL or Cypher function logic authored by administrators, poisoning business logic, data transformations, or access-control routines that depend on those functions. No active exploitation is confirmed (no CISA KEV listing), but the low attack complexity and network reachability (CVSS 4.0 AV:N/AC:L/PR:L) make this a genuine priority for any multi-user ArcadeDB deployment.
SPL injection via Analytics Workspace in Splunk Enterprise allows an unauthenticated attacker to execute arbitrary Search Processing Language queries under the permissions of a phished authenticated user. Affected across four release trains - 9.4 below 9.4.14, 10.0 below 10.0.9, 10.2 below 10.2.6, and 10.4 below 10.4.2 - the flaw stems from insufficient input validation when Analytics Workspace constructs searches from URL-embedded data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though exploitation impact scales directly with the victim user's Splunk role and data access.
Reflected SPL injection in Splunk Enterprise's Monitoring Console allows an unauthenticated attacker to execute attacker-controlled Search Processing Language commands under the permissions of a phished authenticated victim. Affected versions span four active release trains: 9.4.x below 9.4.14, 10.0.x below 10.0.9, 10.2.x below 10.2.6, and 10.4.x below 10.4.2. No public exploit or CISA KEV listing exists at time of analysis, though successful exploitation grants full read and write access to all data and actions permitted by the victim's Splunk role.
Insufficient authorization in Splunk Enterprise's SPL2 module management REST API allows any authenticated low-privileged user - one without the 'admin' or 'power' role - to delete all SPL2 modules across every app and user on the instance. Affected versions are 10.2.x through 10.2.5 and 10.4.x through 10.4.1; versions below 10.2 are unaffected as SPL2 module management did not exist there. The resulting impact is high integrity loss (permanent deletion of exported datasets and functions) and partial service disruption, with no patch-confirmed active exploitation at time of analysis.
Insecure direct object reference in Snipe-IT prior to 8.6.3 allows any authenticated low-privilege user to read signed EULA documents belonging to other users by exploiting inconsistent authorization enforcement across two Laravel controllers. The attacker calls /api/v1/users/{target_id}/eulas to learn the target's randomized EULA filename, then retrieves the file via the /account/stored-eula-file/{filename} route, which bypasses the stricter checks enforced by the primary /stored-eula-file/{filename} endpoint. No public exploit has been identified at time of analysis, and the vendor has released a fix in version 8.6.3.
Missing authorization in the Splunk App for Splunk Observability Cloud exposes a stored Observability Cloud access token to any authenticated Splunk user lacking the admin or power role. Affected versions of Splunk Enterprise (below 10.4.2, 10.2.6, and 10.0.9) ship REST API endpoint handlers in the Observability Cloud integration app that fail to enforce the read_o11y_content capability before proxying requests - and the stored token - to Splunk Observability Cloud. Exploitation gives the low-privileged user full read access to all data visible to that token and limited write access to Observability Cloud content. No public exploit or KEV listing has been identified at time of analysis.
Null pointer dereference in the RTSP service of TP-Link Tapo C100 V5 and C101 V5 IP cameras allows an unauthenticated attacker on the same local network segment to crash the video streaming service and trigger a full device reboot. The flaw is rooted in improper pointer validation during RTSP request parsing (CWE-476), with impact limited strictly to availability - no data exfiltration or configuration tampering is possible. A vendor-released firmware patch is available; no public exploit code or CISA KEV listing has been identified at the time of analysis.
Availability disruption in stigmem-node 0.9.0a1 (pip package by eidetic-labs) allows authenticated federation peers to have their valid peer tokens incorrectly rejected as expired due to a timestamp-handling mismatch in the federation peer-token validation logic. Impacted deployments are Stigmem nodes operating federation peer authentication paths, where authenticated federation flows may fail non-deterministically depending on which token-minting path was used. No active exploitation has been identified (no KEV listing, no public exploit), and the fix is available in 0.9.0a2.
Reflected Cross-Site Scripting in the ProSolution WP Client WordPress plugin (versions before 2.0.11) allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser session of an authenticated WordPress administrator by inducing them to submit a specially crafted request targeting an affected administrative page. The unsanitized parameter is reflected directly into an HTML attribute without escaping, satisfying CWE-79. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS Scope:Changed rating reflects potential for cross-boundary impact within the WordPress installation.
Reflected Cross-Site Scripting in the ProSolution WP Client WordPress plugin before version 2.0.11 enables unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers via crafted URLs targeting public plugin pages. Multiple URL parameters are reflected unsanitized into HTML attributes, exposing any site visitor - including logged-in administrators - to session hijacking, credential theft, or unauthorized in-browser actions if tricked into clicking a malicious link. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.16% (6th percentile) indicates low opportunistic exploitation probability, though administrator-targeting scenarios carry elevated business risk.
Reflected Cross-Site Scripting in NextScripts Social Networks Auto-Poster WordPress plugin (all versions before 4.4.8) enables network-based attackers to inject and execute arbitrary JavaScript in the browsers of logged-in WordPress administrators by delivering a crafted URL. The plugin fails to escape query-string parameters before reflecting them in admin page output, a textbook CWE-79 failure. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Path containment bypass in FreeBSD's unlinkat(2) and funlinkat(2) syscalls allows a local low-privileged process to delete files outside its intended directory scope. The kernel validates AT_RESOLVE_BENEATH but silently discards it before handing off to the path resolution layer, making the flag a no-op security guarantee. Applications using this flag as a sandbox boundary for file deletion operations are exposed to unintended tree traversal, with impact on both filesystem integrity and availability. No public exploit code and no CISA KEV listing have been identified; EPSS is 0.13% (3rd percentile), indicating low observed exploitation probability.
Privilege escalation in XWiki Platform's Live Data Live Table Connector allows any authenticated user with edit access to a page to elevate themselves to script right by sending crafted requests to the Live Data REST API. Script right in XWiki permits execution of arbitrary Velocity code and injection of unfiltered HTML and JavaScript into page content, enabling stored XSS against other users and bypassing extension-level security listeners. The vulnerability spans a wide version range from 13.4-rc-1 through 18.0.x, and no public exploit has been identified at time of analysis.
Unauthenticated cross-site scripting in the SimplyRETS Real Estate IDX WordPress plugin (versions 3.2.8 and earlier) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. Exploitation is gated on user interaction - the victim must visit a crafted URL - which limits automated mass exploitation but still enables session hijacking, credential theft, or malicious redirects targeting site visitors or administrators. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated reflected or stored Cross-Site Scripting in the Global Gallery WordPress plugin (versions up to and including 11.1.2) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by authenticated users - most critically administrators. With scope changed in the CVSS vector (S:C), successful exploitation can result in session hijacking, credential theft, or unauthorized administrative actions within the WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but unauthenticated XSS in a WordPress plugin is a well-understood attack class with a low exploitation barrier.
Unauthenticated Cross-Site Scripting in the BBQ Pro WordPress firewall plugin (versions 3.9 and earlier) allows remote attackers to inject and execute arbitrary JavaScript in the browsers of victims who interact with a crafted URL, with no authentication required. The CVSS Scope:Changed metric confirms the injected payload crosses browser security boundaries, enabling attacks such as admin session hijacking, credential theft, or malicious redirects even though the attacker requires no WordPress account. No active exploitation or public proof-of-concept has been identified at time of analysis, but the unauthenticated attack vector and low complexity lower the barrier for exploitation significantly.
Unauthenticated cross-site scripting in the WordPress Newsletter plugin (versions 9.3.3 and earlier) allows remote unauthenticated attackers to inject arbitrary JavaScript into pages served to authenticated site visitors. With a Changed scope (S:C in the CVSS vector), the malicious script executes in the victim's browser context rather than being confined to the vulnerable plugin component, enabling session hijacking, credential theft, or administrative action impersonation. No public exploit code or active CISA KEV listing has been identified at the time of analysis, but the zero-authentication barrier and widespread WordPress deployment surface make this a meaningful risk for any site running the affected plugin.
Cross-site scripting in Contest Gallery (WordPress plugin, versions 30.0.5 and earlier) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in victims' browser sessions. The CVSS scope-change metric (S:C) confirms the payload can break out of the plugin's own trust boundary and affect the broader WordPress administrative context, enabling session token theft or unauthorized admin actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero authentication requirements and low attack complexity lowers the barrier to exploitation significantly.
Privilege escalation in the Windows Telephony Service (TapiSrv) allows an authenticated local attacker with low-privilege access to gain SYSTEM-level privileges by exploiting a race condition in how the service handles concurrent access to shared resources. Affected products span Windows 10 (multiple feature releases), Windows 11, and Windows Server 2012 through 2025, representing a broad swath of the Microsoft ecosystem. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but a vendor patch is available via the Microsoft Security Response Center.
TOCTOU race condition in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 permits a local, low-privileged user to overwrite critical system files or extract sensitive information by exploiting the timing gap between a file-check and file-use operation. The attack is constrained to local access with high exploitation complexity, yet the potential impact spans full confidentiality, integrity, and availability compromise of the affected system. No public exploit or CISA KEV listing exists at time of analysis; IBM has released a vendor patch.
Heap-based buffer overflow in Wireshark's RDP protocol dissector (CWE-122) crashes the application when processing malformed RDP traffic, causing denial of service across two active release branches. Affected versions span 4.4.0-4.4.17 and 4.6.0-4.6.7 of the Wireshark Foundation's Wireshark (CPE: cpe:2.3:a:wireshark_foundation:wireshark). A proof-of-concept exists per SSVC data, though EPSS (0.17%, 7th percentile) and SSVC's 'Automatable: no' assessment indicate real-world mass exploitation is not occurring; no public exploit identified at time of analysis beyond the poc designation, and the flaw is absent from CISA KEV.