Remote denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers via an integer overflow (CWE-190) in a network-reachable component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation requires no authentication and no special configuration, making all internet- or network-exposed instances directly at risk. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Denial of service via uncontrolled recursion affects IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1, enabling a remote unauthenticated attacker to crash affected systems with no authentication or user interaction required. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects low attack complexity and a fully network-exploitable path, making opportunistic or targeted disruption feasible against any exposed instance. IBM has released a patch via its support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers who send crafted IPsec packets that trigger an integer underflow (CWE-191) during decapsulation, causing an improper memory offset calculation that crashes the affected system. The CVSS vector confirms network-accessible, zero-authentication exploitation with low complexity, yielding a full availability impact with no confidentiality or integrity exposure. IBM has released a patch; no public exploit code or CISA KEV listing exists at time of analysis.
Remote code execution in Heimdall Data Database Proxy enables authenticated high-privilege attackers to run arbitrary code as root via a directory traversal flaw in the uploadJar method. The vulnerability, tracked as ZDI-CAN-28603 and published by Zero Day Initiative as ZDI-26-479, stems from the absence of proper path validation on user-supplied input before use in file operations, allowing arbitrary JAR placement on the underlying filesystem. No public exploit code and no CISA KEV listing are identified at time of analysis; exploitation is gated behind administrative authentication.
Stack buffer overflow in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote unauthenticated denial of service via network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication is required and exploitation is low-complexity, making the availability impact (A:H) readily achievable by any network-reachable attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the absence of authentication and complexity barriers makes this a meaningful operational risk for IBM Power environments where availability is typically mission-critical.
Denial of service via heap-based buffer overflow affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1, exploitable by remote unauthenticated attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making this a low-friction remote availability attack against IBM Power Systems infrastructure. No active exploitation or public exploit code has been identified at time of analysis; a vendor patch is available via IBM's support portal.
Sensitive information disclosure affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 via improper authentication (CWE-287), allowing unauthenticated remote attackers to obtain confidential data over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction, making it trivially reachable from any network-adjacent position. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE, but the automatable SSVC classification means scripted, mass-scanning attacks are plausible once a technique is known.
Information disclosure via improper input validation in Microsoft Office Word enables unauthenticated remote attackers to extract sensitive data across a broad product surface spanning Word 2016, Office 2019, multiple LTSC releases, and Microsoft 365 Apps for Enterprise on both Windows and macOS. The vendor-assigned CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no user interaction is required, though SSVC's 'Automatable: no' designation creates measurable tension with that assessment. No public exploit has been identified at time of analysis, and EPSS at 0.54% (43rd percentile) reflects low near-term exploitation probability despite the CVSS 7.5 rating.
Local File Inclusion in Events Made Easy WordPress plugin (all versions through 3.2.5) allows contributor-level authenticated attackers to inject path-traversal payloads into the eme_single_event_page_template function, causing the server to include and execute arbitrary PHP files. The attack is persistent and passive: once a malicious event is saved, the payload fires automatically for any visitor who loads the affected single-event page, requiring no further attacker interaction post-submission. If the environment permits PHP file uploads, this escalates to full remote code execution; even without upload capability, existing PHP files can be included to bypass access controls or exfiltrate sensitive data. No public exploit identified at time of analysis.
Write operations in Laravel Backpack CRUD bypass registered query scopes on Update, Delete, and Reorder paths, enabling any authenticated low-privilege user to modify or delete arbitrary records outside their authorized scope. Versions 6.x before 6.8.14 and 7.x before 7.0.38 of the Composer package backpack/crud are affected when the application uses addBaseClause() or addClause() for row-level access control such as multi-tenancy or per-user data isolation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivially guessable nature of sequential primary keys makes cross-tenant record manipulation straightforward for any authenticated session holder.
Unverified password change in Laravel Backpack CRUD's account-info endpoint allows any authenticated Backpack admin to permanently take over their own or a hijacked session's account by mass-assigning the `password` field without supplying the current password. Affected versions are backpack/crud < 6.8.11 and 7.0.0-alpha.1 through 7.0.33, running on Laravel 11 with the default `App\Models\User` model whose `$fillable` includes `password`. The attack converts time-limited stolen session access into permanent credential control, bypassing the dedicated change-password flow that enforces `old_password` verification. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially constructable given full public advisory detail.
Broken authentication in the Leyka WordPress donation plugin (versions <= 3.32.3) allows subscriber-level authenticated users to bypass access controls and access privileged functionality. The flaw is classified under CWE-288, indicating an alternate path or channel circumvents the plugin's authentication checks rather than defeating credentials directly. With a CVSS score of 7.6 (High) and high confidentiality impact, this enables disclosure of sensitive donation or user data to any authenticated subscriber on the WordPress installation. No public exploit or CISA KEV listing has been identified at time of analysis.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash affected systems via a buffer overflow. The flaw is classified as CWE-787 (out-of-bounds write), enabling complete availability impact with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Unauthenticated file read in Handlebars.java's Spring MVC integration module (all versions prior to 4.5.3) allows remote attackers to retrieve arbitrary files accessible to the JVM process. The HandlebarsViewResolver passes attacker-controlled view names to handlebars.compile() without path-containment validation, and a file: or classpath: URL with a trailing # fragment delimiter causes the appended .hbs suffix to be silently discarded during resource resolution, bypassing the intended extension check. No active exploitation is confirmed (no CISA KEV listing) and no public POC has been identified at time of analysis, but the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N) reflects meaningful risk for any deployment with user-influenced view name routing.
Memory exhaustion in libevent's WebSocket server (ws.c) allows unauthenticated remote clients to crash affected processes by sending an unbounded stream of fragmented WebSocket frames. Affected versions span 2.2.0-alpha-dev through pre-fix 2.2.2-alpha; the evws WebSocket API enforces WS_MAX_RECV_FRAME_SZ per individual frame but applies no cap to the total accumulated message size in evws->incomplete_frames, enabling heap growth without limit. No public exploit has been identified at time of analysis, and the vulnerability is absent from the CISA KEV catalog; however, exploitation is trivially simple for any WebSocket client.
DNS rebinding in link-preview-js prior to 4.0.4 allows unauthenticated remote attackers to bypass the library's built-in SSRF protections and reach internal HTTP resources from the server hosting the preview service. The resolveDNSHost callback resolves a hostname once for validation but passes the original hostname back to the fetch layer, creating a time-of-check/time-of-use window that an attacker-controlled DNS server can exploit by returning a legitimate public IP during validation and an internal or loopback address on subsequent resolution. Vendor-released patch 4.0.4 is available; no public exploit identified at time of analysis, though the full fix is publicly documented in GitHub PR #181 and the GHSA-cpjf-6666-r8fx advisory.
Memory exhaustion in FreeIPA's `/ipa/i18n_messages` endpoint allows a remote, unauthenticated attacker to crash identity services by sending an arbitrarily large HTTP request body. All RHEL-bundled FreeIPA deployments across RHEL 6 through RHEL 10 are affected per Red Hat CPE data. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the attack requires no authentication and no special configuration, making every internet-exposed FreeIPA instance a plausible target.
FreeIPA's migration endpoint on Red Hat Enterprise Linux 6 through 10 is exploitable by remote unauthenticated attackers who send oversized HTTP POST requests to `/ipa/migration/migration.py`, causing the server to buffer arbitrarily large request bodies fully into memory. This resource exhaustion (CWE-770) leads to degraded performance, memory pressure, and potential service disruption of the identity management service. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Stack memory corruption in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote denial of service by crashing the host kernel through a crafted IPsec ESP packet. The flaw (CWE-908: Use of Uninitialized Resource) resides in the ESP decapsulation handler, where uninitialized stack memory can be corrupted before proper validation, causing a system panic. No active exploitation is confirmed (absent from CISA KEV) and EPSS stands at 0.32%, but the PowerVM VIOS attack surface carries an amplified blast radius: a VIOS crash disrupts I/O services for all co-hosted logical partitions simultaneously.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables remote unauthenticated attackers to crash affected systems by sending crafted network input, resulting in a denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates straightforward network-reachable exploitation with no privilege or user interaction required. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows remote unauthenticated attackers to crash affected systems, producing a denial of service. The CVSS 3.1 vector scores this at 7.5 High with no authentication or user interaction required, targeting availability exclusively. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.29% (21st percentile) indicates low real-world exploitation probability at time of analysis.
Remote code execution within the Chrome sandbox is possible via a race condition (TOCTOU) in the V8 JavaScript engine, affecting Google Chrome prior to version 151.0.7922.173. An unauthenticated attacker who persuades a victim to visit a crafted HTML page can trigger the race condition during JavaScript execution, achieving high confidentiality, integrity, and availability impact within the renderer sandbox. No public exploit code has been identified and no CISA KEV listing exists at time of analysis; the EPSS score of 0.28% at the 20th percentile reflects limited observed exploitation activity, consistent with the High attack complexity required to win the race window reliably.
Hash flooding denial-of-service in libexpat 2.8.2 and 2.8.3 stems from an inverted boolean check on the return value of getentropy(), causing the library to silently proceed with a predictable hash seed whenever the entropy syscall fails. Any network-accessible application that passes attacker-controlled XML through the vulnerable libexpat versions is exposed, since an adversary can craft XML content whose keys collide in libexpat's hash tables, forcing O(n²) lookup behavior and CPU exhaustion. No active exploitation has been confirmed by CISA KEV and no public POC has been identified at time of analysis, but the unauthenticated network attack vector and libexpat's broad transitive footprint across runtimes and distributions make this a meaningful availability risk.
Missing authorization in the Mailu admin REST API allows unauthenticated remote attackers to strip IP-based access restrictions from any existing user token or alter its comment field, effectively neutralizing a key access-control layer on API tokens. All Mailu deployments running versions prior to 2024.06.52 with the admin REST API explicitly enabled are affected. No public exploit code or CISA KEV listing is identified at time of analysis, though the network-accessible, zero-authentication attack vector (PR:N, AC:L) makes this straightforward to leverage when the API is reachable.
Unauthenticated information disclosure in 100xdevs CMS v1.0 exposes sensitive data to remote attackers via two vulnerable components: src/middleware.ts and the mobile search API route at src/app/api/mobile/search/route.ts. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H) confirms that exploitation requires no authentication, no user interaction, and is reachable directly over the network, yielding high confidentiality impact. Despite the elevated CVSS score, EPSS sits at 0.22% (13th percentile), and no confirmed active exploitation (CISA KEV) has been recorded; no public exploit identified at time of analysis, though a researcher gist is referenced and may contain disclosure details.
Arbitrary file read in Apache InLong 2.0.0 through 2.3.x exposes the Agent host filesystem to unauthenticated remote attackers via a relative path traversal flaw. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no credentials or user interaction, making any network-exposed InLong Agent endpoint a direct confidentiality risk. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS sits at 0.21% (12th percentile), indicating low observed exploitation probability despite the high base score.
Unauthenticated information disclosure in The Library Corporation LS2 Admin (versions 5.7 through 5.8.0) exposes sensitive administrative export endpoints - including location configuration data - to any remote attacker without credentials. The root cause is CWE-306 (Missing Authentication for Critical Function), confirmed by a CVSS vector of AV:N/AC:L/PR:N/UI:N and the 'Authentication Bypass' tag. A GitHub gist reference may document the technique publicly, though confirmed active exploitation is absent from CISA KEV and EPSS sits at a low 0.17% (6th percentile).
Unbounded memory buffering in Apple's container runtime exposes host systems running versions prior to 1.2.0 to remote denial-of-service attacks via any published TCP port. The forwarding proxy that bridges client connections to backend containers accumulates client-supplied data without any cap on size or time, meaning a remote unauthenticated attacker can deliberately hold a connection open - sending data slowly or stalling backend establishment - until host memory is exhausted. No public exploit has been identified at time of analysis and EPSS is very low (0.14%, 4th percentile), but the attack is conceptually simple and requires no authentication.
CPU-exhaustion denial of service in netty-incubator-codec-ohttp's BinaryHttpParser permanently pins Netty event-loop threads at 100% CPU via an infinite loop in field-section decoding, reachable by any unauthenticated remote attacker. Because OHTTP gateways publish their HPKE public key by design, an attacker can encrypt a crafted ~17-byte Binary HTTP payload as a cryptographically valid OHTTP request, which passes decryption and reaches the vulnerable parser without any authentication barrier. A handful of such requests exhausts the entire fixed-size Netty event-loop thread pool, rendering the gateway or client fully offline until the process is restarted; no public exploit identified at time of analysis, though an empirically-reproduced proof-of-concept is documented in the advisory.
Infinite parse loop in netty-incubator-codec-bhttp's BinaryHttpParser allows any remote peer capable of sending Binary HTTP input to permanently pin a Netty event-loop thread, causing denial of service. The flaw exists in versions up to and including 0.0.22.Final and is triggered by a structurally valid known-length field section whose last field line ends exactly at the declared section boundary - no malformed framing is required. A public proof-of-concept is included in the GHSA advisory, and the condition is also reachable through the OHTTP inner parser after successful decryption, meaning authenticated OHTTP peers are a second exploitation path.
Heap exhaustion denial-of-service in the node-opcua npm library (versions ≤ 2.165.0) allows an unauthenticated remote attacker to crash the server process by repeatedly initiating OPC-UA sessions with unique nonces. The root cause is a process-global nonce cache (`g_alreadyUsedNonce`) that accumulates entries indefinitely with no TTL or eviction, causing unbounded heap growth measurable at approximately 1.23 MB per 5,000 nonces - achievable OOM under default Node.js heap limits. No public exploit code is identified beyond researcher-disclosed proof-of-concept details in GHSA-6wvw-vrw4-363w; exploitation requires only network access and a trivial script.
Rate-limit bypass in Monkeytype ≤ 26.26.0 allows unauthenticated remote attackers to neutralize all request throttling protections by rotating client-controlled `cf-connecting-ip` or `x-forwarded-for` HTTP headers, with each rotated value creating an independent rate-limit bucket and resetting the window. The affected middleware in `backend/src/middlewares/rate-limit.ts` trusts these client-supplied headers over Express's trust-proxy-derived `req.ip`, rendering `rootRateLimiter`, `badAuthRateLimiter`, `getKey()`, and `getKeyWithUid()` ineffective. Practical consequences include mail-bombing registered users via the `/users/forgotPasswordEmail` and `verificationEmail` endpoints, exhausting Firebase or SMTP quotas affecting all users, and evading brute-force credential protections. No public exploit has been identified at time of analysis; no fixed version is available.
Broken access control in the Koji WordPress theme (versions 2.2.1 and earlier) allows unauthenticated remote attackers to access content or functionality that should be restricted, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no special configuration, and no user interaction. No public exploit code has been identified at time of analysis and the vulnerability does not appear in CISA's KEV catalog, though the Patchstack disclosure confirms the flaw exists in the released theme.
Broken access control in the Chaplin WordPress theme (versions <= 2.6.8) allows unauthenticated remote attackers to access restricted content, resulting in high confidentiality impact. The flaw, classified as CWE-862 (Missing Authorization), means the theme fails to verify whether a requesting user holds the necessary permissions before granting access to protected resources. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, no-authentication-required attack surface makes this straightforward to exploit against any exposed WordPress installation running a vulnerable version of the theme.
WildFly Elytron's password hashing and verification subsystem silently normalizes Unicode input via NFKC before hashing, collapsing fullwidth characters (e.g., U+FF21 'Ａ') to their ASCII equivalents (e.g., 'A'). This allows an unauthenticated remote attacker to authenticate against accounts whose owners believed their passwords contained unique non-ASCII characters by submitting a standard ASCII-only dictionary - the normalization makes the stored hash indistinguishable from its ASCII equivalent. Affected deployments span Red Hat JBoss EAP 7 and 8, Red Hat Build of Keycloak, Red Hat Data Grid 8, and several other Red Hat middleware products that share the Elytron security layer. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in n8n's custom project role management allows users holding only the narrow `role:manageProject` global scope to seize full administrative control over arbitrary projects across the entire instance. The root cause is a missing project-level authorization check in the role deletion-with-reassignment code path: the API validates only that the reassignment target role exists and is project-scoped, never verifying that the requesting user has any rights over the affected projects or their members. No public exploit has been identified and no CISA KEV listing exists at time of analysis; patches are confirmed available in versions 2.33.4 and 2.34.1.
Remote code execution in Adminer 5.4.2 allows authenticated high-privilege users to execute arbitrary code in the context of the web server by exploiting an incorrect function return value check in the multi_query method (CWE-253). The CVSS base score of 7.2 (High) reflects full confidentiality, integrity, and availability impact once authentication is satisfied. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in the category of a serious but not yet confirmed actively-exploited vulnerability.
Stored XSS in LinkAce's Bulk Link API allows any authenticated user to persist a javascript: URI that executes arbitrary JavaScript in a victim's browser when they click the stored link. All LinkAce instances prior to version 2.5.7 are affected via the POST /api/v2/bulk/links endpoint. No public exploit has been identified at time of analysis, though the attack path is straightforward - session cookie exfiltration and account takeover are the primary impacts. Vendor-released patch 2.5.7 is available.
Heap buffer overflow in Capstone's SuperH (SH) architecture floating-point disassembler affects all releases through 6.0.0-Alpha9, allowing a four-byte out-of-bounds write into heap memory when processing crafted SH instructions. The root cause is that opFADD, opFMUL, opFSUB, and related SH FPU decoders in arch/SH/SHDisassembler.c increment op_count as an array index into the fixed-size operands[] array without bounds checking, overflowing the 176-byte sh_info heap allocation. A process that disassembles attacker-controlled SH binary data with the affected mode flags can be crashed; code execution is possible but depends on heap layout. No public exploit has been identified at time of analysis, though a proof-of-concept test case is included in the upstream fix PR. The vendor-released patch is version 6.0.0-Alpha10.
Prototype pollution in n8n's JavaScript task runner sandbox allows an authenticated user with Code node access to escape VM isolation and execute arbitrary OS commands within the runner container. Affected versions span the v1.x branch before 1.123.69 and the v2.x branch before 2.33.4 and 2.34.1. The corruption is process-wide, meaning a single malicious execution can poison the prototype chain for all subsequent tenant Code node runs on the same shared runner; on v1.x instances without task runner isolation, the attack surface escalates to the main n8n process itself. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE.
Secret exfiltration from AWS Secrets Manager is enabled by incorrect privilege assignment in the ClickHouse connector deployment template for Amazon Athena Federated Query prior to v2026.17.1. An authenticated AWS user who can deploy or reconfigure the connector can craft a malicious connection string targeting any arbitrary Secrets Manager secret in the account and route it through a database endpoint under their control, causing the connector Lambda to fetch and transmit the secret value to that attacker-controlled host. Active exploitation has not been confirmed (absent from CISA KEV) and no public exploit code is referenced; the CVSS 4.0 score of 7.1 High reflects meaningful real-world risk due to the broad confidentiality impact against a centralized secrets store. Note: the 'RCE' tag applied to this CVE in the source intelligence appears to be a mislabel - the description and CVSS vector consistently describe confidentiality-only secret exfiltration with no code execution component.
Local privilege escalation in Kenwood DNR1007XR network video recorder devices allows a low-privileged local attacker to achieve root-level code execution by exploiting command injection in the JKGenService service. The flaw (CWE-78) exists because user-supplied input is passed without sanitization to a system call, enabling shell metacharacter injection. No public exploit has been identified at time of analysis, and the device is not listed in CISA KEV, but successful exploitation yields full system compromise on the affected hardware.
Decrypted credential secrets are exposed in execution logs in n8n workflow automation software across versions before 1.123.69, 2.33.4, and 2.34.1. The GraphQL node fails to wrap connection-level HTTP client errors in n8n's standard error type, propagating raw error objects - which carry decrypted credential headers - directly into the persistent execution record. Any authenticated user with read access to workflow execution history can recover those plaintext secrets. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the low-privilege access requirement and direct credential exposure make this a high-priority remediation target for shared or multi-tenant deployments.
Unauthenticated denial-of-service in TP-Link TL-MR100, TL-MR150, TL-MR6400, and Archer MR600 routers allows an adjacent-network attacker to crash the HTTP management service by sending a specially crafted HTTP request that triggers a NULL pointer dereference (CWE-476). Exploitation requires only network adjacency and no credentials, resulting in the web management interface and any HTTP-dependent functionality becoming temporarily unavailable until the service restarts. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the low attack complexity makes this straightforward to trigger for any attacker already on the local or adjacent network.
Mass assignment of protected fields in Frappe Framework 16.31.0 and earlier allows authenticated low-privilege users to overwrite standard and child-table fields - including ownership, timestamps, and system metadata - via a type confusion bug in the `frappe.client.set_value` endpoint. When `fieldname` is passed as a JSON dictionary rather than a string, the pre-parse forbidden-field guard evaluates the dict object itself against the protected-field list (where it never matches), then parses the dict into individual assignments that bypass protection entirely. No released patched version is available at time of analysis; only an upstream commit and open PR exist. No public exploit identified at time of analysis.
PostgREST filter injection in n8n's Supabase integration node exposes any connected Supabase database to full-table disclosure, deletion, or modification across versions before 1.123.69, 2.33.4, and 2.34.1. The Row Get Many, Delete, and Update operations concatenate expression-bindable values into filter queries without sanitization, allowing an attacker who can supply input to a workflow to widen a scoped filter into an unfiltered full-table operation. No public exploit identified at time of analysis, but the CVSS 4.0 subsequent-system impact is rated high across confidentiality, integrity, and availability, reflecting the catastrophic downstream database risk.
NoSQL injection in n8n's MongoDB integration node (Find, Delete, and Aggregate operations) allows an attacker who can supply externally-controlled data into a workflow query to inject MongoDB operators such as $ne or $where, transforming an intended single-document lookup into full-collection disclosure, mass deletion, or arbitrary database operations. Versions prior to 1.123.69 (v1 branch) and 2.33.4 / 2.34.1 (v2 branch) are affected, per vendor advisory GHSA-953p-jm2c-8h5j. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 subsequent-system impact is rated High across confidentiality, integrity, and availability.
Windows Remote Help versions 5.0.0.0 through below 5.2.1040.0 is vulnerable to an uncontrolled search path element (CWE-427), enabling a locally authenticated attacker to conduct spoofing attacks with high confidentiality and integrity impact. The flaw stems from the application resolving executables or libraries from attacker-controllable directory paths, a class of vulnerability commonly manifesting as DLL or binary planting on Windows. No public exploit has been identified at time of analysis, and Microsoft has released a patch as of the advisory publication.
Sensitive deployment variables in Octopus Server can be exposed in clear-text within the deployment variable snapshot under certain unspecified circumstances, allowing authenticated users to read secrets that should remain masked. The vulnerability affects all versions of Octopus Server per CPE wildcard and carries a CVSS 4.0 score of 7.1 with high confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis, and the conditional nature of the exposure suggests the blast radius is context-dependent rather than universal across all deployments.
Broken access control in the EPROLO Dropshipping WordPress plugin (versions <= 2.4.2) allows network-based attackers to bypass authorization checks and access restricted functionality without proper permission validation. The CWE-862 (Missing Authorization) root cause means the plugin fails to verify whether a requestor has rights to perform certain actions, enabling high-impact confidentiality exposure (C:H) and limited integrity impact (I:L). No public exploit code or active KEV listing is identified at time of analysis, though the unauthenticated nature of the bypass - per the CVE title - makes this accessible to a wide attacker pool.