Unauthenticated reflected Cross-Site Scripting (XSS) in the Advance Product Search WordPress plugin (by ThemeHunk) through version 1.4.8 allows a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session without any authentication. The CVSS scope-change indicator (S:C) confirms the vulnerability crosses the plugin's security boundary to affect the authenticated user's browser context, enabling session hijacking, credential theft, or malicious redirect. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this straightforward to exploit once a victim is socially engineered.
Out-of-bounds read in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables local low-privileged attackers to either extract sensitive memory contents or crash the system, producing a denial of service. The flaw (CWE-125) requires only a standard local user account with no additional configuration, making it relevant to any multi-tenant AIX or VIOS deployment where untrusted users share system access. No public exploit code exists and EPSS sits at 0.15% (5th percentile), and SSVC confirms no known active exploitation at time of analysis.
Uncontrolled recursion in django CMS prior to 5.0.8 allows an authenticated staff user to corrupt the plugin tree and deny service by exploiting a missing cycle guard in the move_plugin endpoint. By supplying the plugin's own primary key or a descendant's ID as the plugin_parent value in a crafted POST request, the attacker creates a parent-child cycle that causes the _get_descendants_cte and _get_ancestors_cte recursive CTE queries to loop indefinitely, exhausting database recursion limits and consuming web request workers. The same 5.0.8 release also patches a related information disclosure path where clipboard copy operations lacked source-side permission checks, allowing a staff user to exfiltrate plugin content from placeholders they have no access to - consistent with the 'Information Disclosure' tag on this advisory. No public exploit identified at time of analysis.
Heap out-of-bounds read in NanaZip's SquashFS LZ4 decompression handler exposes adjacent heap memory contents when a user opens a crafted archive, affecting all stable releases from 1.0.88.0 through 6.0.1697.x and all preview releases through 6.5.1741.x on Windows. The flaw stems from a sign-conversion bug that causes the decompressor to trust an attacker-inflated block size, allowing a controlled memcpy to read beyond the allocated heap buffer and place internal heap data into the extracted file output, or crash the process entirely. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the memory disclosure primitive is meaningful for targeted attacks.
Unauthenticated cross-site scripting in the NotificationX Pro WordPress plugin (all versions through 3.1.4) allows a remote, unauthenticated attacker to inject malicious script into pages served to authenticated users, including administrators. The scope change (S:C) in the CVSS vector indicates the injected script executes in a browser context outside the plugin's own trust boundary, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing was identified at time of analysis, though Patchstack has published a database entry for this vulnerability.
Reflected Cross-Site Scripting in the Flatastic WordPress theme (all versions through 2.0) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS Scope:Changed metric confirms the injected script crosses trust boundaries, executing in the victim's browser context with access to session tokens and the ability to perform actions on behalf of authenticated users. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated reflected or stored cross-site scripting in Form Maker by 10Web WordPress plugin (versions <= 1.15.46) allows remote attackers to inject arbitrary JavaScript into pages viewed by other users. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates network-reachable, low-complexity exploitation requiring only victim interaction, with scope change affecting the browser context. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack has reported and documented the vulnerability.
Unauthenticated reflected cross-site scripting in Podlove Podcast Publisher for WordPress (versions 4.5.4 and below) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser of any authenticated user who can be tricked into clicking a crafted URL. The scope-changed CVSS vector (S:C) confirms the vulnerability crosses the trust boundary from the plugin's context into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions against the WordPress installation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-authentication prerequisite makes social-engineering-based delivery straightforward.
Unauthenticated cross-site scripting in SEO Plugin by Squirrly SEO versions 14.2.2 and below allows remote attackers without any credentials to inject and execute arbitrary JavaScript in the context of authenticated users who interact with crafted content. The vulnerability carries a CVSS 3.1 score of 7.1 (High) with a scope change flag, meaning successful exploitation crosses the trust boundary from the plugin into the victim's browser session. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated cross-site scripting in the Aora WordPress theme (all versions through 1.3.19) enables remote attackers to inject and execute arbitrary JavaScript in the browsers of site visitors without any prior authentication. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms this is network-reachable with low complexity, requiring only that a victim interact with a crafted link or page - a realistic bar for phishing-assisted delivery. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated nature and scope-changed impact (S:C) elevate real-world concern for sites running this theme.
Unauthenticated cross-site scripting in the Paymob for WooCommerce WordPress plugin (versions 4.1.10 and earlier) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The CVSS scope-change flag (S:C) indicates the injected script can operate across origins, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis; the primary risk vector is opportunistic phishing or malicious link delivery targeting WooCommerce store customers or administrators.
Unauthenticated cross-site scripting in the SmartSMTP WordPress plugin (versions 1.2.0 and below) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any authenticated user who views the malicious content. The scope change confirmed by the CVSS vector (S:C) means impact extends beyond the injecting session to other users, including administrators. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in Swatchly - WooCommerce Variation Swatches for Products (versions ≤ 1.4.13) permits remote unauthenticated attackers to inject arbitrary JavaScript that executes in the browser context of site visitors or administrators who interact with a crafted URL or page. The scope-changed CVSS vector (S:C, UI:R, PR:N) indicates the injected script escapes the plugin's security context and runs under the victim's session, enabling session hijacking, credential theft, or malicious redirects against WooCommerce storefronts. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept code has been identified at time of analysis.
Cross-site scripting in the GeoDirectory WordPress plugin (versions ≤ 2.8.173) enables unauthenticated remote attackers to inject arbitrary JavaScript payloads that execute in the browsers of users who visit affected pages, including authenticated administrators. The CVSS:3.1 scope-changed vector (S:C) confirms that the attacker's script runs in a different security context than the vulnerable plugin itself, meaning a successful attack can affect the victim's authenticated WordPress session rather than just the plugin's isolated output. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity historically make WordPress XSS vulnerabilities attractive targets for rapid weaponization.
Unauthenticated cross-site scripting in B2BKing Premium (WordPress/WooCommerce plugin) versions 5.6.07 and earlier allows network-based attackers to inject arbitrary JavaScript into victim browsers without any authentication. The CVSS scope change (S:C) confirms that exploit payloads escape the plugin's context and execute within the victim's browser session, enabling session hijacking, credential theft, or malicious redirects targeting WooCommerce store visitors or administrators. No public exploit code or CISA KEV listing appears in the available intelligence, though the unauthenticated, low-complexity attack surface makes payload crafting straightforward once a reflective input vector is identified.
Unauthenticated Cross-Site Scripting in the wpDataTables WordPress plugin (versions 6.5.1.4 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in victims' browsers upon page interaction. The CVSS scope change (S:C) indicates the injected script escapes the plugin's context and can access session cookies, perform authenticated actions, or redirect users within the broader WordPress site. No public exploit or CISA KEV listing is confirmed at time of analysis, though Patchstack has published the vulnerability details.
Unauthenticated XSS in the Tagembed WordPress plugin (versions 7.4 and earlier) enables a remote, unauthenticated attacker to inject malicious JavaScript into pages rendered to other users, including administrators. The CVSS 3.1 vector records a scope change (S:C), meaning injected scripts execute in the victim's browser context outside the plugin's own boundary, enabling session hijacking, credential theft, or escalated site compromise. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unauthenticated XSS in the TranslatePress WordPress plugin versions 3.3.2 and earlier allows remote, unauthenticated attackers to inject malicious JavaScript that executes in the browsers of visiting users. The CVSS 7.1 High rating reflects a scope change (S:C), meaning the injected script crosses the plugin's security boundary into the victim's authenticated WordPress session, enabling session hijacking or unauthorized actions on behalf of the victim. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in JetEngine (WordPress plugin by Crocoblock/JetImpex Inc.) versions 3.8.14.1 and earlier allows a remote, unauthenticated attacker to inject and execute malicious JavaScript in a victim's browser session when the victim interacts with crafted content or a malicious URL. The scope change (S:C) in the CVSS vector confirms the payload crosses the plugin's security boundary into the victim's browsing context, enabling session hijacking, credential theft, or unauthorized actions on behalf of authenticated users. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack vector lowers the bar for opportunistic targeting of WordPress sites running JetEngine.
Off-by-one stack buffer overflow in Libevent's evdns component (versions prior to 2.1.13-stable and 2.2.2-alpha) enables remote attackers to crash or corrupt processes that use the library's DNS handling functions. The dnsname_to_labels() function in evdns.c mishandles the boundary check when writing DNS labels into a 64KB stack buffer - the terminating null byte is written one position past the allocated buffer to buf[buf_len] whenever a name-bearing record aligns precisely at the boundary. Any application embedding libevent's evdns module and querying an attacker-influenced DNS server is in scope; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Command injection in the Kenwood DNR1007XR automotive head unit's startUpdateProcess method allows physically present, unauthenticated attackers to execute arbitrary OS commands as root. The flaw stems from unsanitized user-supplied input passed directly to a system call inside the firmware update handler, granting full device compromise. No public exploit code has been identified at time of analysis, and exploitation is constrained by the requirement for physical device access.
Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 allows a low-privileged local attacker to gain elevated - potentially root-level - privileges by winning a time-of-check to time-of-use (TOCTOU) race condition. The vulnerability carries a CVSS 7.0 score reflecting high attack complexity due to the inherent timing constraints of race condition exploitation, though successful exploitation yields total CIA impact (full system compromise). No public exploit code has been identified and CISA SSVC classifies exploitation status as none, consistent with the extremely low EPSS score of 0.12%.
Local privilege escalation in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a low-privileged local attacker to gain root access by winning a time-of-check to time-of-use (TOCTOU) race condition. The attack requires local access and precise timing, reflected in the AC:H CVSS metric, which meaningfully constrains practical exploitability. No public exploit or active exploitation is identified; EPSS sits at 0.12% (2nd percentile), consistent with the SSVC 'Exploitation: none' classification, though SSVC also rates technical impact as total given that successful exploitation yields full root control.
Local arbitrary code execution is possible in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 through a TOCTOU race condition (CWE-367), where a low-privileged local attacker can manipulate a resource between its check and its use by a privileged process. The CVSS 7.0 score reflects high confidentiality, integrity, and availability impact, though the high attack complexity (AC:H) indicates the timing window must be won reliably. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; IBM has released a patch via its support advisory.
CRLF injection in the bandit Elixir HTTP server (versions 1.4.0 through 1.12.4) allows unauthenticated remote attackers to smuggle carriage-return, line-feed, or NUL characters into application-visible HTTP/2 request headers. Because HPACK carries arbitrary octets and bandit's HTTP/2 stream handler never validated field values for these control characters - unlike the HTTP/1 path which rejected them - a crafted HEADERS frame decodes cleanly and the malicious values reach downstream application logic unchanged. No public exploit or CISA KEV listing is identified; real-world impact is context-dependent and limited to how consuming application code handles raw header values (e.g., log injection, upstream request smuggling).
Cross-host redirect cookie leakage in Hurl ≤ 8.0.1 exposes session credentials to attacker-controlled redirect destinations when scripts use the dedicated [Cookies] section. Hurl's HTTP client correctly strips raw Cookie headers and Authorization credentials on host changes, but the separate RequestSpec.cookies pathway - populated by the [Cookies] section of .hurl files - bypasses this stripping logic, forwarding scoped cookies to the redirected host. No public exploit code is identified and this vulnerability is not in CISA KEV; the CVSS 4.0 score of 6.9 reflects high confidentiality impact gated by the requirement that a user actively runs the affected script.
User enumeration via observable response discrepancy in Frappe's personal data download (GDPR) endpoint allows unauthenticated remote attackers to determine whether any email address corresponds to a registered account. The PersonalDataDownloadRequest handler in frappe/website/doctype/personal_data_download_request/personal_data_download_request.py returned the user_name field and persisted the document to the database only for known users, producing structurally distinct responses that an attacker could compare to systematically harvest registered email addresses. No public exploit has been identified at time of analysis; vendor-released patches exist at versions 15.115.0 and 16.27.0.
Path traversal in ATutor's error log viewer grants authenticated administrators read access to arbitrary files outside the intended logs directory, up to the web server process's permission boundary. Only version 2.2.4 has been confirmed vulnerable by CERT.pl, though other versions may also be affected. No patch will be issued - the product is end-of-life - making migration or decommissioning the only durable remediation.
Unauthenticated access to form submissions is possible in the Convert Forms extension for Joomla across all versions from 1.0.0 up to but not including 5.2.5, due to missing server-side access control on the front-end Submissions view. Any unauthenticated internet visitor can enumerate and retrieve form submission data without credentials, exposing whatever personally identifiable or business-sensitive information site visitors have submitted through forms built with this extension. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication attack surface makes this trivially exploitable by any actor who can reach the site.
Webhook signature bypass in the appwrite/templates github-issue-bot (≤ 1.1.2) allows any unauthenticated network caller to invoke the bot's comment-posting functionality without a valid GitHub HMAC signature. An inverted boolean condition in verifyWebhook causes requests lacking the X-Hub-Signature-256 header to short-circuit to success, so the body is processed as if it were a legitimate GitHub event. With attacker-controlled repository, issue, and author fields passed directly to postComment, the deployment's GITHUB_TOKEN is used to post arbitrary comments on any accessible GitHub repository and issue. No public exploit code is identified at time of analysis.
SQL injection in Apache InLong versions 2.0.0 up to (but not including) 2.4.0 allows attackers to inject attacker-controlled string values into a SQL statement, giving full read/write access to the backing database. The flaw carries a critical CVSS 3.1 score of 9.8 (network, no authentication, no user interaction) and is fixed in 2.4.0. No public exploit identified at time of analysis, and the EPSS probability is low (0.19%, 9th percentile), so despite the critical score there is no evidence of active exploitation yet.
Cross-Site Request Forgery in Frappe Framework 16.31.0 and earlier allows an unauthenticated attacker to forge workflow approval actions on behalf of any authenticated victim user, because the bulk_workflow_approval endpoint in frappe/model/workflow.py accepts state-mutating requests via safe HTTP methods (GET) in addition to POST. The attacker needs only to lure an authenticated user to a crafted page or link, causing their browser to silently submit an approval with the victim's session credentials. No released patched version is available at time of analysis; the upstream fix exists only as an unmerged PR and commit.
Unauthorized tag modification in YOOtheme Zoo for Joomla (all versions below 4.1.65) is fully exploitable by unauthenticated network attackers due to a missing ACL enforcement on the comment controller endpoint. Any remote party can send crafted requests to arbitrarily modify content tags without presenting credentials. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified; however, the attack complexity is trivially low given the complete absence of access controls on the affected endpoint.
Integer overflow to heap over-read in libvips prior to 8.18.3 crashes the image processing process when a crafted multi-page TIFF is loaded through the ImageMagick fallback path. The unchecked multiplication `out->Ysize *= magick->n_frames` in `vips_foreign_load_magick_parse()` wraps on attacker-controlled input, producing an underflowed buffer dimension that drives a subsequent heap over-read and process crash. This flaw is limited to the uncommon build configuration where libtiff support is absent and ImageMagick support is present; no public exploit identified at time of analysis.
Unauthorized XPC Mach service access in NoSleep 1.5.1 on macOS allows a local low-privileged attacker to send arbitrary dictionary messages - including attacker-controlled `command` and `NSBundlePath` values - to a privileged daemon without authorization. The root cause is CWE-862 (Missing Authorization), meaning the XPC service performs no caller identity check before processing requests. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated arbitrary JSON file read in the npm package next-video (versions ≤ 2.8.0) exposes cryptographic server secrets to any remote attacker who can reach the /api/video route. The /api/video request handler accepts a url query parameter and, for any value not beginning with https://, constructs a local filesystem path by appending .json and serving the file contents directly with no authentication, no path canonicalization, and no directory traversal guard. Applications following the documented one-liner setup are at risk of exposing the Next.js Server Actions AES encryption key, Preview/Draft Mode signing and encryption keys, internal build manifests, and Mux-specific asset metadata. No public exploit code or CISA KEV listing has been identified at time of analysis.
Root code execution on the Kenwood DNR1007XR in-vehicle navigation receiver is reachable by anyone with physical access to the device, requiring no authentication. The firmware update service improperly resolves symbolic links during file move operations (CWE-59), allowing an attacker who can write a symlink to the device filesystem to redirect that file operation to an arbitrary path and ultimately execute code with root privileges. No public exploit code or CISA KEV listing was identified at time of analysis; the ZDI advisory (ZDI-26-484) is the primary disclosure source.
Heap-based buffer overflow in the vCardParser class of the Kenwood DNR1007XR automotive multimedia receiver allows physically present, unauthenticated attackers to execute arbitrary code with root privileges. The flaw stems from missing bounds validation when copying attacker-controlled string data into a heap-allocated buffer during vCard contact parsing. No public exploit code or active exploitation has been identified at time of analysis; ZDI tracked this internally as ZDI-CAN-28974 and issued advisory ZDI-26-488.
Out-of-bounds write in Kenwood DNR1007XR firmware enables physically present, unauthenticated attackers to execute arbitrary code at root privilege via the tchdr_bytestream_read function. The device - an in-vehicle infotainment/navigation unit - fails to bounds-check user-supplied data during bytestream parsing, resulting in a heap or stack write past the allocated buffer. No public exploit or active CISA KEV listing has been identified at time of analysis, and real-world impact is materially constrained by the physical access prerequisite.
Out-of-bounds read in Capstone's SuperH (SH) architecture disassembler crashes the host process when fed crafted SH2A or SH4A bytecode. Versions 6.0.0-Alpha9 and earlier are affected when the library handle is configured with CS_ARCH_SH plus CS_MODE_SH2A or CS_MODE_SH4A and CS_MODE_SHFPU; the disassembler derives an idx value from a raw 16-bit instruction and dereferences a mode-specific decode[] function-pointer table without a bounds check. The demonstrated impact is limited to process termination - no code execution or information disclosure was shown - and a vendor-released patch is available in 6.0.0-Alpha10.
Path traversal in VictoriaMetrics vmrestore (prior to versions 1.122.25, 1.136.12, and 1.146.0) allows an attacker who controls or can modify a remote backup source - S3, GCS, Azure Blob Storage, or equivalent - to plant dot-dot sequences in object names, causing vmrestore to write restored files outside the configured -storageDataPath directory when an operator executes a restore operation. The CVSS Scope Changed metric (S:C) reflects that successful exploitation reaches beyond the vmrestore process boundary to the broader host filesystem, enabling potential overwrite of binaries, configuration, or credentials within the OS permissions of the process. Vendor-released patches are available across three maintained branches; no active exploitation has been identified at time of analysis.
Insufficient authorization on GutenKit REST API endpoints allows any WordPress user with Contributor-level access or above to read mailing-list audience metadata from marketing accounts connected to the site. Affected installations running GutenKit versions prior to 2.5.0 with an integrated email marketing platform (e.g., Mailchimp) are exposed to unauthorized data disclosure. A public proof-of-concept is available via WPScan, though SSVC confirms no active exploitation at time of analysis.
Heap-based buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a local authenticated attacker with high privileges to execute arbitrary code on affected systems. The vulnerability is rooted in improper memory management (CWE-787) and carries a CVSS 3.1 score of 6.7, reflecting the local access requirement and elevated privilege prerequisite that constrain real-world exploitability. IBM has released a patch via its support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in the `apport-unpack` utility of Canonical Apport enables arbitrary file creation and overwrite by exploiting attacker-controlled key names embedded in crafted crash report files. Affected versions span all Apport releases before 2.28.4, 2.34.2, and 2.36.0 - software that ships by default with Ubuntu desktop and server editions. An attacker who delivers a malicious `.crash` file and induces a user or automated pipeline to unpack it can write files to any location accessible by the executing user, creating a realistic privilege-escalation primitive on multi-user or developer Ubuntu systems. No public exploit is identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Ghidra's PDB parser (all versions before 12.1.3) crashes when processing a crafted PDB file containing an oversized parameters section, enabling denial-of-service against security analysts. The AbstractPdb deserialization routine accumulates all parameters from the PDB stream into an unbounded heap list without size validation; the resulting OutOfMemoryError is a JVM Error subclass that bypasses standard exception handling, causing uncontrolled process termination. No public exploit code exists and no CISA KEV listing is present; exploitation requires a victim analyst to open a malicious file, limiting real-world impact to targeted disruption of reverse-engineering workflows.
Remote code execution in EMQX's plugin installation API allows an attacker who has obtained a compromised dashboard administrator credential or plugin-install-capable API key to upload and execute arbitrary Erlang code with full EMQX process privileges. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, installation grants issued via `emqx ctl plugins allow` had no expiration and no cryptographic binding to specific package bytes, meaning a stale permit could be reused with attacker-controlled .tar.gz content submitted to POST /api/v5/plugins/install. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Privilege escalation to root on the Kenwood DNR1007XR car navigation/dashcam device is possible for physically present attackers who already hold low-privileged code execution on the device. The USB filesystem mount point is configured with incorrect default permissions (CWE-276), allowing a low-privileged process to write to or manipulate that directory and escalate to root with full code execution capability. No public exploit code or active exploitation has been identified at time of analysis; the attack surface is inherently constrained by the physical access prerequisite and the embedded nature of the device.
Privilege escalation in HCL IntelliOps Event Management (IEM) allows an authenticated, high-privileged attacker to access resources beyond their original authorization boundary, achieving confidentiality impact against protected data. The vulnerability is classified as CWE-272 (Least Privilege Violation) with a Changed scope in CVSS, indicating the attacker can reach resources outside their normal privilege domain within the application. No public exploit code or active exploitation has been identified at time of analysis; the EPSS signal was not provided.
Heap buffer overflow in SumatraPDF 3.6.1 and earlier enables an attacker who delivers a crafted CHM file to corrupt parser heap memory via malformed LZX Huffman code lengths. The PRETREE path in make_decode_table writes internal Huffman tree nodes beyond the 104-entry PRETREE_table boundary into adjacent struct LZXstate heap memory, reachable through the chm_open → chm_retrieve_object → LZXdecompress → BUILD_TABLE call chain. No public exploit or active exploitation is confirmed; arbitrary code execution has not been demonstrated, though the upstream fix commit validates that reliable heap corruption is achievable.
Path traversal in Cesanta Mongoose's SSI processing allows an authenticated network attacker to read arbitrary files accessible to the Mongoose process by embedding directory traversal sequences in #include file or #include virtual SSI directives. The mg_ssi() function in src/ssi.c constructs filesystem paths from directive arguments without invoking the existing mg_path_is_sane() validation, bypassing the only guard against traversal. Exploitation is constrained to deployments compiled with MG_ENABLE_SSI and a configured ssi_pattern; no public exploit has been identified at time of analysis.