SQL injection in Delta DIAEnergie versions up to and including 1.11.00.002 enables low-privileged authenticated remote attackers to achieve full remote code execution on the host system. The flaw (CWE-89) is network-exploitable with low complexity, affecting an industrial energy management platform used in OT environments where RCE carries significant operational risk. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vendor has published a security advisory.
SQL injection in Delta DIAEnergie versions up to and including v1.11.00.002 enables authenticated network-based attackers to achieve remote code execution on the underlying server. Carrying a CVSS base score of 8.8 with low-privilege, low-complexity network access required, this flaw poses serious risk to operational technology environments that depend on this energy management platform for monitoring and control. No public exploit code or CISA KEV listing has been identified at time of analysis, though Delta Electronics has self-disclosed the issue via vendor advisory PCSA-2026-00015.
SQL Injection in Delta Electronics DIAEnergie versions up to and including 1.11.00.002 enables a low-privileged remote attacker to achieve full remote code execution on the underlying server. Confirmed by vendor advisory Delta-PCSA-2026-00015 and ENISA EUVD-2026-64760, the flaw (CWE-89) stems from unsanitized user input passed directly to backend SQL queries, with the database engine serving as the execution bridge to the OS. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible RCE impact in an industrial energy management context elevates this to a high-priority remediation target.
SQL injection in Delta DIAEnergie versions up to and including v1.11.00.002 enables authenticated network-accessible attackers to escalate from data manipulation to remote code execution on the underlying host. Confirmed by vendor advisory Delta PCSA-2026-00015 and EUVD-2026-64759, the vulnerability (CWE-89) carries a CVSS 3.1 score of 8.8, reflecting low attack complexity and full CIA impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the RCE pathway in an energy management system warrants priority remediation.
Remote code execution in Craft CMS control panel element-search condition handling affects authenticated low-privilege users across the 4.x and 5.x release lines. The root cause is a JSON cleanse bypass in the condition.config parameter that allows Yii framework behavior and event configuration keys to survive sanitization and be processed as live object-configuration directives after decoding, yielding arbitrary PHP code execution as the web server user. No CISA KEV listing exists and no confirmed public exploit code has been identified at time of analysis; however, the CVSS 4.0 score of 8.7 with PR:L correctly signals a genuine high-severity finding for any deployment where control panel credentials could be compromised.
Unauthenticated remote attackers can create crypto group entries in RansomLook by directly accessing the /admin/crypto/group/new endpoint, which lacked Flask-Login's login_required decorator that guards other admin routes. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, zero-complexity exploitation requiring no credentials or user interaction. No public exploit identified at time of analysis and no CISA KEV listing, but the trivially low barrier - any attacker who can reach the web interface qualifies - elevates practical risk for publicly exposed instances, with high availability impact (VA:H) suggesting unbounded entry injection could degrade application usability.
Three compounding authentication weaknesses in RansomLook's /login endpoint allow an unauthenticated remote attacker to enumerate valid usernames via response-time differences, conduct unlimited brute-force or credential-stuffing attacks against discovered accounts, and exhaust the application's synchronous Gunicorn worker pool through a sustained login flood causing application-wide denial of service. All versions matching cpe:2.3:a:ransomlook:ransomlook:*:*:*:*:*:*:*:* are affected prior to the upstream fix commit. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.8 is driven by the combination of confidentiality leakage (username enumeration) and high availability impact (worker exhaustion).
Unauthorized operation vulnerabilities in multiple DrayTek VigorSwitch managed switch models allow unauthenticated remote attackers to manipulate device state - including modifying configuration, restarting services, overwriting startup configuration, and clearing audit logs - without any authentication. Affecting at least 28 named VigorSwitch models across the G, P, PQ, Q, and FX series, the root cause is missing authorization checks in multiple syslog-related HTTP handler functions (CWE-862). The CVSS 4.0 score of 8.8 with AV:N/PR:N/UI:N confirms the full attack surface is exposed to any network-reachable attacker, with no public exploit or CISA KEV listing identified at time of analysis.
Local File Inclusion in MagicAI for WordPress (versions up to and including 1.4) allows authenticated subscribers to include arbitrary PHP files from the server's filesystem by manipulating user-controlled input that is passed to a PHP file-inclusion function without adequate path validation. With CVSS 8.8 (High) and network-accessible exploitation requiring only subscriber-level authentication, this flaw grants attackers full confidentiality, integrity, and availability impact over the affected WordPress installation. No public exploit or CISA KEV listing has been identified at time of analysis.
Subscriber-level privilege escalation in the Booking Hub WordPress plugin (versions ≤ 1.3.0) allows authenticated users with only subscriber-level access to elevate their privileges to administrator-equivalent roles. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N) confirms network-accessible exploitation with full confidentiality, integrity, and availability impact once a low-privilege account is obtained. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this a realistic priority for any WordPress site running the affected plugin with user registration enabled.
Use-after-free memory corruption in WebKitGTK exposes Red Hat Enterprise Linux 6 through 9 systems to potential arbitrary code execution when users process attacker-controlled web content. The flaw (CWE-416) stems from improper memory management in the web engine's content rendering pipeline, where a freed heap allocation is subsequently accessed, enabling heap corruption. No public exploit code or CISA KEV listing has been identified at time of analysis; operational urgency derives from the CVSS 8.8 score, the broad RHEL deployment footprint, and the well-understood exploitability of use-after-free conditions in browser engines.
Remote buffer overflow in Zscaler Client Connector on Windows enables a network-accessible attacker with low privileges to crash the local system at the kernel level, producing a denial-of-service condition. The provided CVSS vector (C:H/I:H/A:H) signals potential confidentiality and integrity impact beyond what the vendor description explicitly states, a discrepancy that warrants verification - kernel-level buffer overflows frequently allow code execution, not merely DoS. No public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in RansomLook's cryptocurrency wallet detail view allows attacker-controlled JavaScript to execute in the security context of any user who clicks the CSV export button on an affected wallet record. The root cause is insertion of externally-sourced wallet addresses and blockchain names directly into an inline JavaScript onclick handler, where Jinja2's HTML autoescaping is bypassed because the browser's HTML parser decodes entities such as ' back to quote characters before the JavaScript engine processes the attribute value. Because RansomLook ingests data from the public crowd-sourced ransomwhe.re feed without prior validation, exploitation may not require an authenticated RansomLook account - an attacker who can introduce a crafted wallet record into that upstream feed can reach the vulnerable rendering path. No public exploit code or active exploitation has been identified at time of analysis; a patch is available via a confirmed vendor commit.
Control-flow hijack in the Zephyr RTOS virtio driver (versions 4.2.0 through pre-4.4.2) allows a malicious or compromised virtio backend - such as an untrusted hypervisor or an untrusted PCI/MMIO virtio device - to invoke an arbitrary function pointer inside the Zephyr guest's interrupt handler. The root cause is a missing bounds check in virtio_isr() (drivers/virtio/virtio_common.c): the 16-bit descriptor-chain head ID written by the device into the used ring is consumed directly as an index into heap-allocated recv_cbs[] and desc[] arrays, each sized exactly vq->num, enabling an out-of-bounds read that returns an attacker-shaped {function pointer, argument} pair which is then called. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the primitive - arbitrary code execution in interrupt context triggered entirely from the backend - is high-severity and the vendor-confirmed patch is available in Zephyr 4.4.2.
Privilege escalation from userspace to kernel level is possible in Google's Fuchsia OS via a Use-After-Free condition in the Zircon kernel pager proxy component, affecting Android F30.1.1. An attacker with low-privileged code execution on the device can exploit the memory corruption flaw to gain kernel-level control, achieving full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and SSVC assessment indicates no current active exploitation.
Remote code execution in Xinference (all versions before 2.12.0) allows any user with model-launch access to execute arbitrary Python code on the server at worker-process privilege level. Six model loader call sites across the rerank, embedding, and LLM subsystems hardcode trust_remote_code=True when invoking Hugging Face AutoTokenizer.from_pretrained, meaning a registered model with an attacker-controlled path can ship a malicious tokenizer_config.json whose auto_map entries are imported and executed unconditionally upon model load. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but any Xinference deployment that permits user-defined model registration is exposed without the 2.12.0 patch.
Local privilege escalation in Zscaler Client Connector enables a standard (non-administrative) local user to execute arbitrary code in a privileged context via multiple improper privilege handling flaws (CWE-280). The scope change captured in the CVSS vector (S:C) reflects that exploitation breaks the security boundary of the Client Connector's privileged agent process, extending impact beyond the attacker's initial user context to full High-rated confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote file read in 4MOSAn Management Center (all versions prior to build 20260621) allows any network-reachable attacker to download arbitrary system files via a Relative Path Traversal flaw (CWE-23). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) confirms no authentication, no user interaction, and no special configuration is required to trigger the vulnerability. A vendor-issued patch was released as of build 20260621 per TWCERT advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in the Mercado Pago Node.js SDK allows attackers who can influence payment, refund, or disbursement identifiers handled by merchant applications to redirect outbound API calls to unintended Mercado Pago endpoints, carrying the merchant's own access token. The affected clients - payment (get, capture, cancel), paymentRefund (create, total, list, get), advancedPayment (get, capture, cancel, update, updateReleaseDate), and disbursementRefund (create, createAll, listAll) - construct API paths via unencoded template literals, allowing dot-dot sequences and question marks to traverse to alternate endpoints or append attacker-chosen query parameters. No public exploit has been identified at time of analysis, and exploitation is conditional on merchant applications forwarding unvalidated, user-supplied identifiers directly to the SDK.
Sensitive scraping credentials and bypass logic were exposed to unauthenticated callers through multiple RansomLook API endpoints. Location records associated with monitored ransomware groups and markets were returned verbatim - including the `header` field containing authentication tokens and session cookies, the `init_script` field holding CAPTCHA and anti-bot bypass logic, and `browser` metadata revealing the scraping environment - whenever a location was not explicitly marked private. The patch, confirmed via GitHub commit cc9182930306ff36c7b3424817d49f18df3c85d1, introduces a strict field allowlist and a sanitization function applied across all three affected API routes; no public exploit or KEV listing has been identified at time of analysis.
Denial of service in multiple DrayTek VigorSwitch managed switch models can be triggered remotely without authentication via the setget.cgi web management interface. The root cause is a null pointer dereference (CWE-476) triggered when the `pass` field is absent from a crafted request, crashing the CGI service. The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial remote exploitability with no prerequisites; no public exploit or CISA KEV listing has been identified at time of analysis.
Unbounded xlsx decompression in exceljs-hardened before 5.0.0 allows unauthenticated remote attackers to exhaust server memory and cause denial of service by uploading a crafted zip-bomb workbook. The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) reflects that exploitation requires no authentication, no special configuration, and no victim interaction beyond the server automatically parsing the uploaded file. No active exploitation has been confirmed (no CISA KEV listing) and no public exploit has been identified at time of analysis, but the zip-bomb technique targeting archive parsers is well-documented and requires minimal attacker skill.
Path traversal in exceljs-hardened before 5.0.0 allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying crafted paths to the Workbook.addImage() function, which performs no input validation before passing the value to Node.js file system APIs. Any Node.js application that exposes this function to user-controlled input is at risk of exposing secrets, credentials, configuration files, and any other content readable by the process. No public exploit has been identified at time of analysis; vendor-released patch is available as version 5.0.0.
PHP object injection in Combodo iTop's user preference functionality prior to version 3.2.3 enables authenticated remote attackers to achieve remote code execution on the underlying server. The vulnerability stems from deserializing attacker-controlled PHP objects without validation, with the CVSS Scope:Changed metric reflecting that successful exploitation escapes the application boundary to compromise the host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CWE-502 vulnerability class is well-understood and the attack complexity is rated Low once an authenticated session is obtained.
Cross-organization IDOR in Label Studio allows any authenticated user on a shared instance to read, modify, and delete annotations belonging to other tenants by enumerating sequential integer primary keys. The AnnotationAPI and AnnotationConvertAPI in label_studio/tasks/api.py declare an unscoped queryset (Annotation.objects.all()) and register all annotation permissions against rules.is_authenticated, meaning the organization boundary is never tested at the object level. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects genuinely high confidentiality, integrity, and availability impact on any multi-tenant deployment, and the low exploitation complexity makes the conceptual-to-exploitable gap very small.
RansomLook versions through 2.0.0 leaks victim posts belonging to privately configured ransomware groups and markets through public notification channels (Rocket.Chat, Mastodon, Bluesky, email) and the public MISP feed, due to incomplete privacy enforcement at the entity level rather than the post level. The post-processing logic in posts.py checked only the individual post's private flag, leaving freshly parsed victims of private groups and markets unprotected because new posts arrive with private=False. A parallel defect in misp_feed.py restricted its privacy check to the group database only, so victims of private markets were admitted to the public MISP feed. No public exploit is identified at time of analysis; this is a passive information-disclosure flaw - subscribers to the affected channels receive the leaked data automatically without taking any active exploitation step.
Unauthenticated media exfiltration on sixteen DJI consumer and prosumer drone models allows any attacker who joins the drone's internal Wi-Fi network to enumerate and download all stored photos and videos via the unprotected `/v2` HTTP endpoint. The onboard HTTP media server (CWE-306: Missing Authentication for Critical Function) performs no client verification, and DJI's deterministic filename naming convention eliminates any obscurity barrier, making systematic enumeration trivial. Firmware patches have been released per the DJI advisory (en-us03400011149); no public exploit or CISA KEV listing has been confirmed at time of analysis.
Unauthenticated artifact manipulation in nektos/act's Artifacts V4 backend allows any network-adjacent attacker to read, overwrite, or delete the build artifacts of concurrently running jobs, including embedded secrets and deployment credentials. Two compounding root-cause defects drive the severity: a run-ID ownership check that is explicitly commented out in validateRunIDV4 (pkg/artifacts/artifacts_v4.go), and a universally forgeable HMAC whose key is a hardcoded 4-byte constant (0xba 0xdb 0xee 0xf0) shared across every build with a delimiter-free concatenation scheme vulnerable to hash ambiguity. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the exploitable code paths are visible in public source and trivially reproducible.
Stored XSS in Sakai Conversations (versions 23.0-23.3) allows any authenticated site member - including students - to inject arbitrary HTML and JavaScript into topics, posts, or comments that subsequently execute in the browsers of every user who views that content. The Conversations REST API accepts raw HTML in message fields without invoking Sakai's standard `FormattedText.processFormattedText()` sanitizer, and the LitElement frontend renders stored content via `unsafeHTML()` with no secondary defense. A detailed proof-of-concept including cookie exfiltration and database verification is publicly available in the GitHub security advisory; no active exploitation is confirmed via CISA KEV. In university deployments with hundreds of students per course, a single malicious post can compromise all enrolled users simultaneously.
Remote code execution in AzuraCast ≤0.23.8 is reachable by any authenticated station manager due to a serialization group mismatch that exposes Liquidsoap custom configuration fields through the profile-edit API endpoint, which enforces only the lower-privilege StationPermissions::Profile rather than the StationPermissions::Broadcasting required by the dedicated Liquidsoap configuration endpoint. An attacker injects arbitrary Liquidsoap script constructs - including process.run() or process.exec() OS command primitives - into fields that ConfigWriter::writeCustomConfigurationSection() emits verbatim into the generated .liq script, with execution triggered automatically by the built-in sync task whenever needs_restart is set. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the attack path is fully described in advisory GHSA-q8wg-3qg7-8pc7 and presents a straightforward escalation from station manager to host OS command execution.
SQL injection in TypeORM's SelectQueryBuilder.distinctOn enables database enumeration against PostgreSQL-backed applications that pass client-controlled values into the API without validation. The distinctOn array is joined and interpolated verbatim into a SELECT DISTINCT ON (...) clause in src/query-builder/SelectQueryBuilder.ts, bypassing the driver's escape helper and the allowlist guard (validateOrderByCondition) that protects the orderBy family. Because the injection point is a parenthesized SQL expression list, attackers can supply correlated subqueries and perform boolean or time-based blind inference against any table reachable by the application's database role, independent of the queried entity. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Buffer overflow in DrayTek VigorSwitch's mail_mailalert function allows authenticated remote attackers with valid administrative credentials to cause a denial of service or potentially execute arbitrary commands across approximately 28 affected managed switch models. The flaw stems from unbounded concatenation of multiple SMTP receiver email addresses into a fixed-size buffer, reachable via the device's web management interface. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 8.6 reflects high potential impact to confidentiality, integrity, and availability.
Buffer overflow in DrayTek VigorSwitch's diag_logmail function allows authenticated administrators to cause denial of service or potentially execute arbitrary commands on affected network switches. The flaw, reported by VulnCheck and acknowledged in DrayTek's August 2026 security advisory, affects a broad range of VigorSwitch models spanning SMB and enterprise product lines. Exploitation requires valid administrative credentials, limiting opportunistic attack surface, but a compromised or rogue admin account can fully compromise device confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing identified at time of analysis.
Buffer overflow in DrayTek VigorSwitch web management interface allows authenticated remote administrators to cause denial of service or potentially execute arbitrary commands on affected managed switches. The flaw resides in the acl_general_setup Edit ACE function, where the name field is copied into a fixed-size stack buffer without length validation (CWE-120). No public exploit code has been identified at time of analysis, and exploitation is gated behind valid administrative credentials, meaningfully reducing the attack surface compared to unauthenticated network flaws.
Buffer overflow in DrayTek VigorSwitch's ACL configuration function exposes authenticated administrators to denial of service or potential arbitrary command execution via the device's web management interface. The root cause - an unbounded strcpy-style copy of a user-supplied name field into a fixed-size stack or heap buffer inside acl_general_setup's Add ACE handler - is a classic CWE-120 defect reachable over the network from any host with management-plane access. Exploitation requires valid administrative credentials (CVSS PR:H), substantially limiting the attack surface; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Buffer overflow in DrayTek VigorSwitch's switch_lan_gvrp function exposes multiple managed switch models to denial of service or potential arbitrary command execution from remote, authenticated attackers. The flaw stems from unsafe copying of a user-supplied portList field into an undersized stack or heap buffer within the GVRP handling code - a classic CWE-120 defect reachable via the device's web management interface. No public exploit code and no CISA KEV listing have been identified at time of analysis, and exploitation is gated behind valid administrative credentials, which meaningfully constrains real-world attacker opportunity.
Buffer overflow in DrayTek VigorSwitch's PoE schedule profile function allows authenticated remote administrators to cause denial of service or execute arbitrary commands on affected network switches. The flaw spans at least 10 CPE-confirmed models and an even wider set per VulnCheck tags, covering much of the VigorSwitch product line. No public exploit code and no CISA KEV listing have been identified at time of analysis, but DrayTek has published a security advisory acknowledging the issue.
Buffer overflow in the sysreboot function of multiple DrayTek VigorSwitch managed switch models allows authenticated remote attackers to cause denial of service or execute arbitrary commands. The root cause (CWE-120) is unsafe concatenation of split valueN attacker-controlled data into a fixed-size buffer in the device's web management firmware, exploitable over the network by any party holding valid administrative credentials. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in DrayTek VigorSwitch's webBackupAction function enables authenticated administrators to trigger denial of service or arbitrary code execution by submitting crafted HTTP requests with excessively long pathN, valueN, key, and option parameters. Exploitation is gated behind valid administrative credentials (CVSS PR:H), limiting direct internet exposure but creating meaningful risk via compromised admin accounts or insider threats. No public exploit identified at time of analysis and no CISA KEV listing, though the CWE-120 root cause class is well-understood and device-accessible researchers could feasibly develop working exploits.
Buffer overflow in DrayTek VigorSwitch's pingtrace diagnostic function allows authenticated remote attackers to cause denial of service or achieve arbitrary command execution across a broad range of VigorSwitch hardware models. The flaw arises from absent length validation when user-supplied host, count, and interval parameters are concatenated into a statically allocated buffer in the web management firmware. No public exploit is identified at time of analysis, and exploitation is gated behind valid administrative credentials, but the severity of achievable impact - full device compromise - warrants prompt patching on any network where VigorSwitch units are deployed.
Buffer overflow in the apautotest function of DrayTek VigorAP firmware allows an authenticated remote attacker with administrative credentials to cause denial of service or potentially execute arbitrary commands across six affected device models. The root cause is CWE-120 (Classic Buffer Overflow) - the CMD6 field undergoes memory copy operations without length validation, enabling controlled heap or stack corruption. No public exploit code has been identified at time of analysis, the vulnerability is absent from CISA KEV, and a vendor-released patch is confirmed available via DrayTek's August 2026 security advisory.
Buffer overflow in the setLan function of multiple DrayTek VigorAP access point models enables authenticated remote attackers to cause denial of service or execute arbitrary commands on affected devices. Six distinct VigorAP models - 903, 906, 912C, 918R, 960C, and 1060C - are confirmed affected across specific firmware version ranges, all patched by DrayTek in an August 2026 advisory. No public exploit identified at time of analysis, though the vulnerability was independently reported by VulnCheck and the impact class (RCE and DoS) raises operational risk for any organization where VigorAP admin interfaces are reachable from untrusted networks.
Stored OS command injection in the TP-Link Archer BE3600 V1 parent-control module allows an authenticated administrative attacker on the adjacent network to achieve arbitrary command execution on the device. The payload is persisted at configuration time-embedded in a crafted profile name-and fires asynchronously when the router's daily cloud report generation job runs, without any further attacker interaction. A vendor-released patch is available from TP-Link; no public exploit has been identified at time of analysis.
Root-level command injection in the TP-Link Archer BE800 V1 router (firmware prior to 1.4.2 Build 260708) allows an authenticated administrator on an adjacent network to execute arbitrary OS commands with root privileges by injecting shell metacharacters through the VPN connection interface. Successful exploitation hands an attacker full control of the embedded Linux environment, enabling persistent backdoors, credential theft, and use of the router as a pivot into the connected LAN. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released firmware patch is available.
Unauthenticated arbitrary file deletion in the MasterStudy LMS WordPress plugin (versions ≤ 3.7.42) allows remote, unauthenticated attackers to delete arbitrary files on the server via path traversal. The CVSS 8.6 vector (AV:N/AC:L/PR:N/UI:N/S:C/A:H) confirms no authentication or user interaction is required and that impact extends beyond the plugin's own scope to server-level files. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-prerequisite attack surface makes this a high-priority patch target for all WordPress deployments running the affected plugin.
Unauthenticated arbitrary file deletion in ShopBuilder Pro - Elementor WooCommerce Builder Addons plugin versions 2.2.0 and earlier allows any remote attacker to delete arbitrary files on the underlying WordPress server without credentials. The root cause is a path traversal weakness (CWE-22) in a network-exposed endpoint that fails to sanitize user-supplied file paths, enabling traversal outside the plugin's intended file scope. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; however, the trivial exploitation conditions (no authentication, no user interaction) make this a high-priority patching target for any site running the affected plugin.
Unauthenticated arbitrary file deletion in WooCommerce File Approval plugin (versions through 10.7) allows any remote attacker to delete arbitrary files on the underlying server without credentials or user interaction. The path traversal root cause (CWE-22) enables attackers to escape the plugin's intended file handling scope, with the CVSS S:C scope-change indicator confirming that files outside the plugin's own directory — including WordPress core files, configuration files, or OS-level files accessible to the web server process — can be targeted. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the zero-complexity, unauthenticated attack surface makes this a high-priority remediation target for any site running the affected plugin.
Incorrect authorization in KAON PG5298A and PG5298B router firmware allows authenticated network-adjacent users to send crafted JSON-RPC requests that bypass GUI-enforced access controls, enabling arbitrary system file reads and command execution on the device. All firmware versions prior to 3.0.82 (PG5298A) and 4.0.82 (PG5298B) are affected, as confirmed by CERT-PL. No public exploit has been identified at time of analysis; vendor-released patches are available.
OS command injection in Sakura Editor (Windows text editor) enables arbitrary command execution on a victim's PC when they open a file from an attacker-crafted directory and invoke the 'Open Terminal' (Open PowerShell) feature. The vulnerability, tracked as JVN#74538868 and GHSA-6x2x-729r-wjh5 and reported by JPCERT, requires social engineering to place the victim's file in a path containing injected shell metacharacters. No public exploit identified at time of analysis and no CISA KEV listing, but the full-compromise impact (C:H/I:H/A:H on the vulnerable system) warrants prompt patching to v2.4.3.
Privilege escalation vulnerabilities in HP Easy Start for macOS, versions prior to 2.16.7.260722, allow a local low-privileged user to gain elevated system access. Classified under CWE-1104 (Use of Unmaintained Third-Party Components), the root cause likely involves outdated bundled libraries within the printer setup utility. HP has released version 2.16.7.260722 as the remediation; no public exploit code or CISA KEV listing has been identified at time of analysis.