Remote code execution in GitLab CE/EE package registry exposes instances across three active version branches to full host compromise by an authenticated low-privilege user. Path traversal (CWE-22) in the package registry component allows directory escape and arbitrary file write under certain server-side conditions, with CVSS scope change (S:C) confirming that impact extends beyond the GitLab application to the underlying host. A publicly available exploit exists via HackerOne report 3754194, though this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Uncontrolled recursion in the justhtml Python HTML parsing library (all versions through 1.9.1) allows any remote unauthenticated attacker who can supply HTML input to trigger a denial of service via stack exhaustion. Approximately 1,000 nested HTML elements (~11 KB of crafted input) are sufficient to exceed CPython's default recursion limit of 1,000 frames during DOM traversal in TreeBuilder._find_elements(), raising an unhandled RecursionError that can abort parsing, fail requests, or terminate a worker process depending on framework error handling. Vendor patch 1.10.0 is available; no public exploit code or CISA KEV listing has been identified at time of analysis, though the advisory's code-level detail makes independent reproduction trivial.
PHP Object Injection in PPWP - Password Protect Pages (WordPress plugin, versions up to and including 1.9.18) permits authenticated attackers holding Contributor-level roles or higher to deserialize attacker-controlled data via the 'post_protection_roles' parameter, injecting arbitrary PHP objects into the application. Real-world impact is fully contingent on a Property-Oriented Programming (POP) chain being present in another co-installed plugin or theme - absent that chain, the vulnerability has no exploitable effect, but where one exists, outcomes can include arbitrary file deletion, sensitive data retrieval, or remote code execution. No public exploit code or active exploitation has been identified at time of analysis; however, a Wordfence advisory and a WordPress SVN changeset (3567221) both indicate a fix has been committed.
Privilege escalation in the Security Hardener WordPress plugin (all versions up to and including 2.4.4) allows any authenticated Subscriber-level user to create new Administrator accounts or reset existing Administrator passwords by sending crafted REST API requests. The plugin's user-enumeration blocking feature inadvertently replaces WordPress Core's granular capability checks on the /wp/v2/users REST endpoints with a bare is_user_logged_in() check, completely stripping create_users, edit_users, and delete_users enforcement. Because block_user_enum is enabled by default, this authorization bypass is active on every site immediately after plugin installation with no additional configuration required; no public exploit has been identified at time of analysis.
Uncontrolled resource consumption in justhtml before 1.18.0 enables denial-of-service conditions through CPU and memory exhaustion when processing attacker-controlled CSS selectors, large untrusted documents, cyclic DOM graphs, or linkification input. The impact is strictly availability - the advisory explicitly confirms no script execution, data disclosure, or sanitizer bypass is possible. No public exploit has been identified at time of analysis, and default JustHTML(sanitize=True) configurations are not expected to be exposed; risk is confined to applications that forward untrusted input into selector-evaluation or linkification APIs.
Eval injection in chirpmyradio CHIRP's Kenwood ITM driver allows arbitrary Python code execution when a user opens a specially crafted CSV file. The vulnerable `_clean_tmode` function in `drivers/kenwood_itm.py` passes untrusted TXSIG and RXSIG CSV column values directly to Python's built-in `eval()` without sanitization, confirmed by the upstream commit diff. A proof-of-concept repository exists publicly, though no active exploitation is confirmed in CISA KEV. All CHIRP builds prior to commit 39178dbfc4fece083ab9ed20286d6ae3a91a718e are affected.
Reflected cross-site scripting in the Brave Popup Builder WordPress plugin (versions up to 0.8.5) allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's browser by crafting a malicious URL containing unsanitized UTM query parameters that are reflected directly into popup form HTML. Exploitation requires the victim to follow a crafted link, making phishing the primary delivery mechanism. No public exploit code or CISA KEV listing has been identified at time of analysis, and the low EPSS score (0.21%, 11th percentile) suggests limited real-world exploitation activity; nonetheless, the fix is available and upgrade is straightforward.