Intercepted VNC sessions in Devolutions Remote Desktop Manager are possible because the IronVNC client automatically accepts the server's RSA key without verification during RSA-AES authentication, leaving an on-path attacker able to substitute their own key and relay tampered traffic. Both the 2026.2.x branch (up to 2026.2.17.0) and the 2026.1.x branch (up to 2026.1.24.0) are affected. No public exploit exists and EPSS sits at 0.11% (1st percentile), but the attack requires only network positioning and a user-initiated VNC session, making it a realistic threat on untrusted or adversary-adjacent networks.
Cross-Site Request Forgery (CSRF) in the Hash Form WordPress plugin versions 1.4.0 and below enables unauthenticated remote attackers to trigger unauthorized state-changing actions on behalf of authenticated WordPress users who visit a malicious page. The vulnerability stems from missing or insufficient CSRF token (nonce) validation in the plugin's request handling, classified under CWE-352. With no public exploit identified at time of analysis and an integrity-only impact (CVSS 4.3), this is a medium-severity finding requiring user interaction to exploit.
Null byte injection in Netty's MqttEncoder affects applications using versions prior to 4.1.137.Final and 4.2.17.Final that forward user-controlled input into MQTT UTF-8 string fields - specifically client identifiers, will topics, usernames, and PUBLISH topic names. Because the encoder performs no null byte validation, an attacker with adjacent-network access and low-level privileges can embed the prohibited U+0000 character, causing downstream MQTT brokers to misparse field boundaries and potentially bypass topic-based ACLs or misidentify client sessions. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
OAuth token refresh in hex.pm (Elixir's package registry) fails to re-validate organizational membership when issuing new access tokens, allowing users removed from a private organization to retain read access to its packages. Affected are hex.pm deployments from 2025-10-10 through 2026-08-24. An authenticated former member can repeatedly refresh a token carrying an explicit repository:<org> or docs:<org> scope - bypassing revocation entirely for up to 30 days - because CDN edges authorize access from token claims without querying the database. No public exploit exists and this is not in CISA KEV.
Heap-based buffer overflow in Open5GS 2.8.0's HSS S6a Authentication-Information-Request handler allows network-adjacent authenticated Diameter peers to corrupt process heap memory by supplying a malformed Visited-PLMN-Id AVP with an incorrect octet-string length. The vulnerable function `hss_ogs_diam_s6a_air_cb` in `src/hss/hss-s6a-path.c` passes raw AVP data to cryptographic key derivation (`ogs_auc_kasme`) without first validating that the PLMN identifier length matches the expected 3-byte constant `OGS_PLMN_ID_LEN`. No active exploitation is confirmed (no CISA KEV listing), but a proof-of-concept signal is present in the CVSS 4.0 threat metric (E:P); an upstream fix commit is available though a formally tagged patched release is not independently confirmed.
Authorization bypass in Dolibarr ERP up to versions 18.0.10, 22.0.5, and 23.0.3 allows any low-privileged authenticated user to read or overwrite another user's private notes by manipulating the numeric `id` parameter in `/user/note.php`. The root cause (CWE-639 - Authorization Bypass Through User-Controlled Key) is a missing identity check before the permission evaluation: all requests were evaluated under the caller's self-write right rather than distinguishing whether the target user matched the caller. A proof-of-concept exists (CVSS 4.0 E:P), though no active exploitation has been confirmed via CISA KEV. Patches are available in versions 23.0.4 and 24.0.0.
Out-of-bounds read in Open5GS 2.8.0 PCRF Rx AA-Request handler allows remote low-privileged attackers with Diameter Rx interface access to send crafted AA-Request messages containing null or incorrectly-sized Framed-IP-Address or Framed-IPv6-Prefix AVPs, triggering memory reads beyond allocated boundaries. The patch commit c18dc6938bf63cc7374315d3dca303d92066e746 adds missing null and length validation for both AVP types; a tagged release incorporating it has not been independently confirmed. No active exploitation is recorded in CISA KEV, though the CVSS 4.0 E:P flag indicates proof-of-concept code is known to exist.
Improper authorization in Open5GS 2.8.0's AMF UEContextReleaseRequest path handler allows remote low-privileged attackers to trigger unauthorized UE context release operations in the 5G core network. The flaw, tagged as an authentication bypass (CWE-285), affects the Access and Mobility Management Function - a security-critical component governing device connectivity and session management in 5G deployments. A proof-of-concept exploit exists (E:P in CVSS 4.0 supplemental), and no CISA KEV listing was identified at time of analysis.
Stored cross-site scripting in NethServer's WebTop calendar component (versions 1.5.6 and earlier) permits an authenticated attacker to inject malicious JavaScript into calendar event fields, which silently executes in the browser of any user who subsequently views the poisoned event. The impact scope includes session hijacking, unauthorized access to emails, contacts, and files, and the ability to perform actions as the victim within the platform - all without the victim taking any action beyond viewing the event. No active exploitation or public exploit code has been identified at time of analysis; a vendor-released patch exists in WebTop 1.5.7.
Stored cross-site scripting in the contacts component of NethServer's WebTop groupware module allows an authenticated attacker to inject persistent JavaScript into shared address book fields, which executes silently in any victim's browser upon viewing the poisoned contact record. All WebTop installations on version 1.5.6 and earlier are at risk; successful exploitation can cascade into session hijacking, credential theft, and unauthorized access across all integrated groupware services including email and file storage. No public exploit has been identified at time of analysis, though the stored XSS class requires minimal technical sophistication once an attacker holds a low-privilege account.