SPL injection in Splunk Enterprise's Job Details dashboard enables a low-privileged authenticated attacker to bypass Search Processing Language risky-command safeguards by embedding a malicious search identifier in a crafted dashboard URL and phishing an authenticated victim into opening it. The injected SPL executes under the victim's permissions, potentially exposing all data accessible to that user and compromising search integrity within those bounds. No active exploitation is confirmed and no public exploit code has been identified; a vendor patch is available across all four affected release trains per advisory SVD-2026-0801.
The Data Model Editor in Splunk Enterprise fails to apply SPL safeguards for risky commands when executing base searches for auto-extracted fields, allowing a low-privileged attacker (non-admin, non-power role) to craft a malicious request that executes arbitrary SPL commands under a victim's authenticated session via browser-based phishing. Affected branches span four active release lines - 9.4.x below 9.4.13, 10.0.x below 10.0.8, 10.2.x below 10.2.6, and 10.4.x below 10.4.1 - confirmed by vendor advisory SVD-2026-0801. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patches are available for all affected branches.
Stack-based buffer overflow in IBM PowerVM Hypervisor's host firmware configuration parsing allows authenticated service-level access holders to crash the firmware boot stack with possible memory corruption during system initialization, impacting integrity and availability of the managed Power system. Affected firmware spans three release trains: FW1060.00-FW1060.80, FW1110.00-FW1110.30, and FW1120.00. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7283238.
Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-level crashes triggered from guest partitions. An attacker holding root access within a guest partition can write a specially crafted NVRAM image that causes the host firmware boot stage to crash with possible memory corruption, taking down the managed system until an operator manually clears NVRAM via the service processor. No public exploit code has been identified and no active exploitation is confirmed, but the persistence of the availability impact and the cross-boundary scope change (guest-to-host) make this a meaningful risk in shared multi-tenant OpenPOWER environments.
Missing Authorization in Dell Command Update (DCU) versions prior to 5.7.1 permits a low-privileged local user to invoke protected application functions without adequate authorization checks, yielding full confidentiality, integrity, and availability impact on the vulnerable system. Rooted in CWE-862, the flaw bypasses expected access controls within the DCU client utility - a driver and firmware management tool deployed across Dell client hardware fleets. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Arbitrary code execution is possible in stigmem-node versions before 0.9.0a2 when a single configuration flag is used to disable plugin signature enforcement without a required second acknowledgment. Operators who carry this permissive setting from development into shared or production environments create a condition where any user with write access to the plugin directory can inject and execute unsigned, potentially malicious plugin code with the process's privileges. No public exploit code has been identified and no active exploitation is confirmed (not listed in CISA KEV); however, the resulting impact is full confidentiality, integrity, and availability compromise of the affected system.
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a local low-privileged attacker exploiting a Time-of-check Time-of-use (TOCTOU) race condition (CWE-367). The vulnerability allows an attacker who already has a local foothold on the system to manipulate a resource between the time it is checked and the time it is used by the update utility, resulting in full system compromise (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Path traversal in BuildKit prior to v0.31.2 enables an authenticated API client to escape the daemon's controlled state directory by submitting a crafted upload request containing traversal sequences. Affected parties include any deployment where multiple principals share BuildKit API access - such as multi-tenant CI/CD infrastructure or shared Docker build environments. The vulnerability grants a write primitive to arbitrary host filesystem locations, posing high integrity and availability risk; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in WP Statistics (all versions through 14.16.8) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into a WordPress site's database and have it execute in any privileged user's browser session when viewing the plugin's statistics dashboards. The vulnerability chain is precise: the REST API signature required to submit a hit request is exposed on the public homepage, and a base64-encoded page_uri POST parameter to the /wp-statistics/v2/hit endpoint overrides the previously sanitized REQUEST_URI, smuggling an unsanitized utm_campaign value into the database. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low exploitation complexity and large WordPress install base elevate practical urgency significantly.
Stored cross-site scripting in HumHub 1.18.4 lets a Space administrator embed arbitrary HTML or JavaScript into the deletion-reason field of a comment-removal notification sent to the comment's original author. When the victim renders the notification in their browser, the injected script executes within their authenticated HumHub session, enabling session-token theft or unauthorized actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis; an upstream patch is available as GitHub PR #8365, though a tagged release version has not been independently confirmed.
Reflected cross-site scripting in HumHub Community Edition 1.18.4 allows a low-privileged attacker to inject arbitrary JavaScript into the browser session of an authenticated non-member by embedding malicious button configuration in the `options` query-string parameter of the `space/membership/request-membership-form` endpoint. When a social-engineering lure causes the victim to submit the membership request form, the server reflects attacker-controlled markup inside a script context, enabling account takeover-class impact. No active exploitation has been confirmed (no CISA KEV listing); an upstream patch is available as GitHub PR #8381, though a formally tagged release version has not been independently confirmed.
Privilege escalation in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote attacker already holding high-privileged console credentials to elevate their access further within the platform, achieving full confidentiality, integrity, and availability impact against the management system. The root cause is improper privilege management (CWE-269), where the application fails to enforce correct privilege boundaries for existing high-privileged sessions. No public exploit or CISA KEV listing has been identified at time of analysis; Dell disclosed and patched this vulnerability via advisory DSA-2026-359.
Arbitrary file overwrite in GitPython before 3.1.58 allows attackers who can influence treeish arguments passed to IndexFile.from_tree, IndexFile.reset, or IndexFile.merge_tree to clobber any file writable by the host process with a valid git-index blob. The three affected methods in git/index/base.py forward caller-controlled strings directly to git read-tree with no option sanitization and no -- argument terminator, enabling injection of --index-output=<path>; git's last-occurrence-wins behavior lets the injected flag override the library's internal temp path. A proof-of-concept is publicly documented in GHSA-4gmw-gg2m-w46p; no CISA KEV listing was present at time of analysis.
Cross-tenant broken object level authorization (BOLA) in stigmem-node's decay sweep endpoint allows any authenticated write-credentialed tenant to destroy or enumerate facts belonging to all other tenants. Specifically, POST /v1/decay/sweep with ttl_seconds=0 expires every tenant's facts globally due to missing tenant_id predicates in the candidate-selection queries. This vulnerability exclusively affects multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant; no public exploit or CISA KEV listing exists at time of analysis, but the integrity and availability impact against multi-tenant operators is critical.
Cross-tenant broken object level authorization in stigmem-node before 0.9.0a12 allows an authenticated tenant in a multi-tenant deployment to corrupt RTBF tombstone records and trigger tenant-blind fact suppression. The root cause is twofold: the issue_tombstone function hardcoded the tenant to 'default' instead of reading it from the caller's identity, and the tombstone read-suppression path lacked a tenant_id predicate, causing deletion records to be misattributed and tombstone filtering to operate across all tenants indiscriminately. The impact is limited to deployments running the opt-in stigmem-plugin-multi-tenant; a vendor-released patch exists at 0.9.0a12, and no public exploit has been identified at time of analysis.
Out-of-bounds read in FFmpeg's DASH demuxer (libavformat/dashdec.c) allows a malicious or compromised DASH streaming server to cause memory disclosure and process crashes in any application built on FFmpeg before commit 65b0dab. The flaw arises because a live manifest refresh that decreases the startNumber attribute drives the internal fragment sequence counter negative, and only an upper-bound check exists before the value is used as an array index. No public exploit has been identified and this CVE does not appear in the CISA KEV catalog, but the network-accessible trigger, low attack complexity, and dual high confidentiality and availability impact make prompt patching a priority for deployments that process live DASH streams.
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (versions up to and including 3.2.5) allows unauthenticated attackers to inject executable HTML into pages viewed in secondary languages by exploiting the plugin's internal translation marker system. Plain-text markers (#!trpst# / #!trpen#) pass through WordPress's wp_kses sanitizer undetected at comment submission, are stored in the database, and are unconditionally converted to angle brackets during page rendering - materializing attacker-controlled text as live HTML tags such as <img onerror=...>. No public exploit has been identified at time of analysis and the vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog, but the zero-privilege stored nature of the flaw and the plugin's broad WordPress deployment make it a credible priority for any multilingual site with public commenting enabled.
Server-Side Request Forgery in Dell OpenManage Enterprise versions prior to 4.7.0 allows unauthenticated remote attackers to forge outbound HTTP requests from the server, exposing internal network resources and sensitive information. The CVSS scope-change indicator (S:C) confirms that forged requests can reach internal systems beyond the vulnerable host itself - a meaningful escalation for an enterprise IT management platform with privileged access to server infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis; Dell has released version 4.7.0 as the remediated build per advisory DSA-2026-359.
Server-Side Request Forgery in Animation Addons for Elementor WordPress plugin (versions before 2.7.2) permits unauthenticated remote attackers to coerce the WordPress server into issuing arbitrary HTTP requests to internal network hosts and relay the responses back to the attacker. The vulnerability stems from unsanitized user-supplied input being used directly to construct the host component of a server-side HTTP request. No public exploit or CISA KEV listing has been identified, and EPSS places exploitation probability at 0.15% (4th percentile), though SSVC notes the attack is automatable.
Improper access control in the Eventin WordPress plugin before 4.1.21 allows any authenticated user holding contributor-level access or higher to permanently delete arbitrary user accounts on the affected WordPress installation. The plugin's account deletion functionality omits both ownership verification and WordPress capability checks, meaning a low-privilege contributor can target and remove administrator accounts. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; however, the low technical barrier makes this a meaningful privilege-abuse risk on multi-author WordPress sites.
Remote code execution via server-side template injection (SSTI) in document-merge-service affects all versions before 9.1.0, exploitable by authenticated users with access to upload XLSX templates. The xltpl library processes XLSX templates through a non-sandboxed Jinja2 environment, allowing an attacker to embed Jinja2 expressions that execute arbitrary code server-side as the document-merge-server user (UID 901). No active exploitation (KEV) has been confirmed, but Jinja2 SSTI techniques are well-documented and HackTricks references are cited in the advisory, indicating the attack pattern is publicly known.
Broken authorization in Flow-Like's Azure presign endpoint allows authenticated app members holding only `ExecuteEvents` permission to obtain Azure Blob Storage SAS tokens with read, write, delete, and list (`sp=rwdl`) access to application content - permissions they explicitly should not possess. Only self-hosted Flow-Like deployments prior to version 1.0.4 using Azure Blob Storage are affected; the vendor's hosted services (Flow-Like Studio and the hosted Web App, both AWS-backed) are explicitly excluded. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the flaw is mechanically straightforward to abuse given that the credential overprovision is a direct API response to a single authenticated request.
Grafana OSS's Unified Alerting component allows a low-privileged authenticated organization member to query any datasource - including those they are explicitly denied access to - by setting the client-controlled queryType field to the reserved value __expr__ while supplying the UID of a real datasource in an alert rule. Authorization skips the datasources:query permission check when it sees __expr__, but the evaluator subsequently resolves and executes the query against the real datasource identified by datasourceUid, resulting in full data exfiltration through Grafana's configured credentials. Affected versions span Grafana OSS 8.4.0 through 13.1.1; no public exploit code or CISA KEV listing has been identified at the time of analysis, but the low attack complexity and confirmed reproduction under default OSS permissions make this a credible insider-threat and privilege-escalation vector.
Double-free heap corruption in FreeRDP's server-side audio redirection channel (rdpsnd) allows any authenticated RDP client to reliably crash the server and potentially corrupt heap memory in allocator-dependent ways. All FreeRDP server deployments prior to version 3.28.0 exposing the rdpsnd channel are affected. The attacker sends a single malformed Client Audio Formats PDU to leave a dangling pointer in the server context, which is then freed a second time during session teardown - guaranteeing a server crash and opening the door to further exploitation depending on the underlying allocator.
Non-blind SSRF in AIL Framework's crawler submission interface allows low-privileged authenticated users to pivot through the AIL server and reach internal networks, cloud metadata services (including 169.254.169.254), loopback addresses, and RFC1918 ranges. All versions covered by CPE cpe:2.3:a:ail-project:ail-framework:*:*:*:*:*:*:*:* are affected because manual crawler tasks bypass the existing domain blacklist via a priority-routing logic flaw, and crawled responses - including HTML, screenshots, and HAR data - are returned directly to the attacker, making exfiltration of cloud IAM credentials or internal service data straightforward. No public exploit has been identified and the vulnerability is not listed in CISA KEV; a vendor-released patch is available via upstream GitHub commit d7b60ff.
Local file disclosure in phpMyFAQ before 4.1.7 is triggered through unsanitized HTML in FAQ answers when PDF documents are generated via TCPDF. Any user holding FAQ creation or editing rights can embed an img tag whose src attribute references a local file within the content/ directory - when PDF export runs, TCPDF fails to parse the target as an image and raises an uncaught exception whose stack trace exposes a portion of the file's raw contents, potentially including database credentials stored in content/core/config/database.php. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 7.1 with high confidentiality impact accurately reflects the realistic severity given the potential for full credential exposure under permissive PHP runtime settings.
Arbitrary file read in GitPython versions through 3.1.57 allows low-privileged users who can influence kwargs passed to IndexFile.remove() or Head.checkout() to exfiltrate the complete contents of any file readable by the hosting process. The attack chains two unsanitized Git flags - --pathspec-from-file and --pathspec-file-nul - causing Git to return verbatim file contents through a GitCommandError exception that GitPython surfaces in-band. A detailed proof of concept is publicly available in the vendor GHSA advisory; this vulnerability is not currently listed in CISA KEV.
Format string injection in Coturn prior to 4.13.0 lets an authenticated TURN user crash the relay server or leak stack memory into Redis by embedding printf-style specifiers in STUN USERNAME or REALM attributes. At nine call sites in ns_ioalib_engine_impl.c, attacker-controlled values pass is_secure_string() validation and are embedded into Redis keys; send_message_to_redis() then passes the composite key as the format argument to redisAsyncCommand(), causing redisvFormatCommand() to read past the va_list. No public exploit identified at time of analysis and no CISA KEV listing; however, the attack surface is reachable by any valid TURN credential holder, including guest or externally-provisioned users in many WebRTC deployments.
Stored cross-site scripting in Splunk Enterprise's Dashboard Studio allows a user holding the 'power' role to persist a crafted workflow action URL that, when triggered by a separate authenticated victim, executes attacker-controlled JavaScript in the victim's browser session. All four actively maintained branches are affected: 10.4.x below 10.4.2, 10.2.x below 10.2.6, 10.0.x below 10.0.9, and 9.4.x below 9.4.14. No public exploit has been identified at time of analysis, and exploitation is constrained by a required internal 'power' role and mandatory victim social engineering, meaningfully limiting the realistic attacker population despite the high impact ratings.
Function library integrity in ArcadeDB 26.7.3 and earlier can be silently tampered by any authenticated low-privilege database user because the UPDATE_SCHEMA permission gate is bypassed when a DEFINE FUNCTION statement targets an already-existing library rather than creating a new one. Attackers holding only basic database credentials can overwrite or inject SQL or Cypher function logic authored by administrators, poisoning business logic, data transformations, or access-control routines that depend on those functions. No active exploitation is confirmed (no CISA KEV listing), but the low attack complexity and network reachability (CVSS 4.0 AV:N/AC:L/PR:L) make this a genuine priority for any multi-user ArcadeDB deployment.
SPL injection via Analytics Workspace in Splunk Enterprise allows an unauthenticated attacker to execute arbitrary Search Processing Language queries under the permissions of a phished authenticated user. Affected across four release trains - 9.4 below 9.4.14, 10.0 below 10.0.9, 10.2 below 10.2.6, and 10.4 below 10.4.2 - the flaw stems from insufficient input validation when Analytics Workspace constructs searches from URL-embedded data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though exploitation impact scales directly with the victim user's Splunk role and data access.
Reflected SPL injection in Splunk Enterprise's Monitoring Console allows an unauthenticated attacker to execute attacker-controlled Search Processing Language commands under the permissions of a phished authenticated victim. Affected versions span four active release trains: 9.4.x below 9.4.14, 10.0.x below 10.0.9, 10.2.x below 10.2.6, and 10.4.x below 10.4.2. No public exploit or CISA KEV listing exists at time of analysis, though successful exploitation grants full read and write access to all data and actions permitted by the victim's Splunk role.
Insufficient authorization in Splunk Enterprise's SPL2 module management REST API allows any authenticated low-privileged user - one without the 'admin' or 'power' role - to delete all SPL2 modules across every app and user on the instance. Affected versions are 10.2.x through 10.2.5 and 10.4.x through 10.4.1; versions below 10.2 are unaffected as SPL2 module management did not exist there. The resulting impact is high integrity loss (permanent deletion of exported datasets and functions) and partial service disruption, with no patch-confirmed active exploitation at time of analysis.
Insecure direct object reference in Snipe-IT prior to 8.6.3 allows any authenticated low-privilege user to read signed EULA documents belonging to other users by exploiting inconsistent authorization enforcement across two Laravel controllers. The attacker calls /api/v1/users/{target_id}/eulas to learn the target's randomized EULA filename, then retrieves the file via the /account/stored-eula-file/{filename} route, which bypasses the stricter checks enforced by the primary /stored-eula-file/{filename} endpoint. No public exploit has been identified at time of analysis, and the vendor has released a fix in version 8.6.3.
Missing authorization in the Splunk App for Splunk Observability Cloud exposes a stored Observability Cloud access token to any authenticated Splunk user lacking the admin or power role. Affected versions of Splunk Enterprise (below 10.4.2, 10.2.6, and 10.0.9) ship REST API endpoint handlers in the Observability Cloud integration app that fail to enforce the read_o11y_content capability before proxying requests - and the stored token - to Splunk Observability Cloud. Exploitation gives the low-privileged user full read access to all data visible to that token and limited write access to Observability Cloud content. No public exploit or KEV listing has been identified at time of analysis.
Null pointer dereference in the RTSP service of TP-Link Tapo C100 V5 and C101 V5 IP cameras allows an unauthenticated attacker on the same local network segment to crash the video streaming service and trigger a full device reboot. The flaw is rooted in improper pointer validation during RTSP request parsing (CWE-476), with impact limited strictly to availability - no data exfiltration or configuration tampering is possible. A vendor-released firmware patch is available; no public exploit code or CISA KEV listing has been identified at the time of analysis.
Availability disruption in stigmem-node 0.9.0a1 (pip package by eidetic-labs) allows authenticated federation peers to have their valid peer tokens incorrectly rejected as expired due to a timestamp-handling mismatch in the federation peer-token validation logic. Impacted deployments are Stigmem nodes operating federation peer authentication paths, where authenticated federation flows may fail non-deterministically depending on which token-minting path was used. No active exploitation has been identified (no KEV listing, no public exploit), and the fix is available in 0.9.0a2.
Reflected Cross-Site Scripting in the ProSolution WP Client WordPress plugin (versions before 2.0.11) allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser session of an authenticated WordPress administrator by inducing them to submit a specially crafted request targeting an affected administrative page. The unsanitized parameter is reflected directly into an HTML attribute without escaping, satisfying CWE-79. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS Scope:Changed rating reflects potential for cross-boundary impact within the WordPress installation.
Reflected Cross-Site Scripting in the ProSolution WP Client WordPress plugin before version 2.0.11 enables unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers via crafted URLs targeting public plugin pages. Multiple URL parameters are reflected unsanitized into HTML attributes, exposing any site visitor - including logged-in administrators - to session hijacking, credential theft, or unauthorized in-browser actions if tricked into clicking a malicious link. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.16% (6th percentile) indicates low opportunistic exploitation probability, though administrator-targeting scenarios carry elevated business risk.
Reflected Cross-Site Scripting in NextScripts Social Networks Auto-Poster WordPress plugin (all versions before 4.4.8) enables network-based attackers to inject and execute arbitrary JavaScript in the browsers of logged-in WordPress administrators by delivering a crafted URL. The plugin fails to escape query-string parameters before reflecting them in admin page output, a textbook CWE-79 failure. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Path containment bypass in FreeBSD's unlinkat(2) and funlinkat(2) syscalls allows a local low-privileged process to delete files outside its intended directory scope. The kernel validates AT_RESOLVE_BENEATH but silently discards it before handing off to the path resolution layer, making the flag a no-op security guarantee. Applications using this flag as a sandbox boundary for file deletion operations are exposed to unintended tree traversal, with impact on both filesystem integrity and availability. No public exploit code and no CISA KEV listing have been identified; EPSS is 0.13% (3rd percentile), indicating low observed exploitation probability.
Privilege escalation in XWiki Platform's Live Data Live Table Connector allows any authenticated user with edit access to a page to elevate themselves to script right by sending crafted requests to the Live Data REST API. Script right in XWiki permits execution of arbitrary Velocity code and injection of unfiltered HTML and JavaScript into page content, enabling stored XSS against other users and bypassing extension-level security listeners. The vulnerability spans a wide version range from 13.4-rc-1 through 18.0.x, and no public exploit has been identified at time of analysis.
Unauthenticated cross-site scripting in the SimplyRETS Real Estate IDX WordPress plugin (versions 3.2.8 and earlier) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. Exploitation is gated on user interaction - the victim must visit a crafted URL - which limits automated mass exploitation but still enables session hijacking, credential theft, or malicious redirects targeting site visitors or administrators. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated reflected or stored Cross-Site Scripting in the Global Gallery WordPress plugin (versions up to and including 11.1.2) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by authenticated users - most critically administrators. With scope changed in the CVSS vector (S:C), successful exploitation can result in session hijacking, credential theft, or unauthorized administrative actions within the WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but unauthenticated XSS in a WordPress plugin is a well-understood attack class with a low exploitation barrier.
Unauthenticated Cross-Site Scripting in the BBQ Pro WordPress firewall plugin (versions 3.9 and earlier) allows remote attackers to inject and execute arbitrary JavaScript in the browsers of victims who interact with a crafted URL, with no authentication required. The CVSS Scope:Changed metric confirms the injected payload crosses browser security boundaries, enabling attacks such as admin session hijacking, credential theft, or malicious redirects even though the attacker requires no WordPress account. No active exploitation or public proof-of-concept has been identified at time of analysis, but the unauthenticated attack vector and low complexity lower the barrier for exploitation significantly.
Unauthenticated cross-site scripting in the WordPress Newsletter plugin (versions 9.3.3 and earlier) allows remote unauthenticated attackers to inject arbitrary JavaScript into pages served to authenticated site visitors. With a Changed scope (S:C in the CVSS vector), the malicious script executes in the victim's browser context rather than being confined to the vulnerable plugin component, enabling session hijacking, credential theft, or administrative action impersonation. No public exploit code or active CISA KEV listing has been identified at the time of analysis, but the zero-authentication barrier and widespread WordPress deployment surface make this a meaningful risk for any site running the affected plugin.
Cross-site scripting in Contest Gallery (WordPress plugin, versions 30.0.5 and earlier) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in victims' browser sessions. The CVSS scope-change metric (S:C) confirms the payload can break out of the plugin's own trust boundary and affect the broader WordPress administrative context, enabling session token theft or unauthorized admin actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero authentication requirements and low attack complexity lowers the barrier to exploitation significantly.
Privilege escalation in the Windows Telephony Service (TapiSrv) allows an authenticated local attacker with low-privilege access to gain SYSTEM-level privileges by exploiting a race condition in how the service handles concurrent access to shared resources. Affected products span Windows 10 (multiple feature releases), Windows 11, and Windows Server 2012 through 2025, representing a broad swath of the Microsoft ecosystem. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but a vendor patch is available via the Microsoft Security Response Center.
TOCTOU race condition in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 permits a local, low-privileged user to overwrite critical system files or extract sensitive information by exploiting the timing gap between a file-check and file-use operation. The attack is constrained to local access with high exploitation complexity, yet the potential impact spans full confidentiality, integrity, and availability compromise of the affected system. No public exploit or CISA KEV listing exists at time of analysis; IBM has released a vendor patch.
Registration bypass and authentication bypass in Talebook (MyBooks) 3.41.2 and earlier allow an unauthenticated remote attacker to create accounts on instances where the administrator has disabled public registration, and then immediately authenticate with those unactivated accounts to access user-level API functionality. The root cause is a server-side enforcement gap: the POST /api/user/sign_up handler in user.py ignores the ALLOW_REGISTER configuration flag entirely, relying on the frontend to suppress the UI - a classic CWE-602 client-side enforcement failure. A second flaw in process_auth_header (base.py) compounds the issue by skipping verification of the account active flag, so the freshly created account can authenticate without email confirmation. No public exploit code or CISA KEV listing has been identified at time of analysis. The issue is fixed in version 3.42.0.