Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized destHost parameter to the ipFilterList=mod action in netis.cgi, triggering a stack-based buffer overflow. Because the Boa web server runs CGI handlers as root and the overflow occurs before authentication is checked, successful exploitation yields full device takeover. Publicly available exploit code exists and the flaw was reported by VulnCheck; CVSS 4.0 base is 9.3 (AV:N/AC:L/PR:N/UI:N), but no active exploitation (CISA KEV) is confirmed.
Remote authentication bypass in EFM ipTIME T16000M firmware 14.20.2 lets unauthenticated attackers defeat session validation via the httpcon_check_session_url function, gaining administrative access to the router's web management interface over the network. Publicly available exploit code exists (published via VulDB), and the CVSS 4.0 score of 9.3 reflects total loss of confidentiality, integrity, and availability. There is no public exploit identified in CISA KEV, but the vendor was contacted and did not respond, so affected devices currently have no fix.
Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized Base64-encoded password to the login handler in /bin/netis.cgi, whose custom Base64 decoder writes past a fixed-size stack buffer. Because the Boa web server runs CGI processes as root, successful exploitation yields full device takeover. Publicly available exploit code exists (published by VulnCheck and researcher ozcanpng), and the CVSS 4.0 base score is 9.3, though there is no public exploit identified as being used in active attacks.
Arbitrary account takeover in the miniOrange OAuth Client extension for Joomla (versions before 3.2.0) lets a remote unauthenticated attacker authenticate as any user, including administrators, by manipulating a single cookie value. The flaw is an authorization/identity check that trusts a client-controlled cookie to establish the logged-in account, so tampering with it grants full session control. No public exploit has been identified at time of analysis, but the trivial network-based vector and CVSS 10.0 rating make it a high-priority patch.
Denial of service in OpenThread, the open-source Thread networking stack embedded in Google Nest devices (identified as Nest 3.78.518349), lets an attacker who has already joined the same Thread mesh send crafted Mesh Link Establishment (MLE) packets that trigger reachable assertion failures and a stack-based buffer overflow, crashing affected nodes. The flaw carries a vendor CVSS 4.0 score of 10.0, though the description scopes real-world impact to denial of service rather than the code execution the score's high confidentiality/integrity metrics would imply. There is no public exploit identified at time of analysis and it is not on CISA KEV.
Host root code execution in Canonical LXD arises from a path-traversal flaw in instance template processing, letting an attacker with container edit permissions - or any user who launches a maliciously crafted image - overwrite arbitrary root-owned files on the host. The root cause is a validate-then-open mismatch: LXD checks template target paths against a confined os.Root handle but then creates the file via os.Create using the raw, unconfined string path. No public exploit has been identified at time of analysis, but the CVSS 9.9 rating and container-to-host scope change make this a critical container-escape.
Arbitrary file upload in the UltimateAI WordPress plugin (versions up to and including 3.1.0) lets any authenticated Subscriber-level user upload files with attacker-controlled types, per Patchstack (CVE-2026-32559, CWE-434). Because the plugin fails to validate uploaded file types, a low-privileged account can place a malicious PHP payload on the server, and with a CVSS 3.1 base score of 9.9 and scope change this typically escalates to full remote code execution and site takeover. No public exploit identified at time of analysis.
Pre-authentication OS command injection in DrayTek VigorSwitch managed switches lets a remote, unauthenticated attacker run arbitrary commands as root by supplying crafted input to the setget.cgi 'pass' field, which is passed to a shell without sufficient filtering. The flaw affects a broad range of VigorSwitch models (G/P/Q-series including G2540Xs, P2282X, Q2300X, G2542X and ~30 listed variants) and carries a CVSS 4.0 score of 9.3. No public exploit has been identified at time of analysis, but DrayTek has published a security advisory addressing it.
Root-level OS command injection in DrayTek VigorAP wireless access points (models 903, 906, 912C, 918R, 960C, 1060C) lets a remote, unauthenticated attacker run arbitrary commands by sending a crafted UDP message to the dray_apm component after a START_SPEED_TEST request. The flaw stems from missing validation of UDP payload content before it is passed to command execution, and the CVSS 4.0 base score of 9.3 reflects full compromise of confidentiality, integrity, and availability. It was reported by VulnCheck, a vendor patch is available, and no public exploit has been identified at time of analysis.
PHP Object Injection in the ACPT (Pro) - Custom Post Types plugin for WordPress affects all versions up to and including 2.0.63, allowing an attacker to inject a serialized PHP object that the plugin deserializes. The vendor advisory (Patchstack) frames this as a 'Subscriber' level issue, meaning a low-privileged authenticated account can supply crafted serialized data; where a suitable POP gadget chain exists in the plugin or its dependencies, this can escalate to code execution, data theft, or site compromise. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Insecure deserialization in weDevs WP Project Manager (WordPress plugin) versions up to and including 4.0.6 allows remote unauthenticated attackers to inject crafted PHP objects (CWE-502) into the application. With CVSS:3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N) and full confidentiality, integrity, and availability impact, successful exploitation can lead to arbitrary object instantiation and, given a suitable POP gadget chain in the plugin or WordPress core, remote code execution or data compromise. Reported by Patchstack and tracked as ENISA EUVD-2026-65169; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
PHP Object Injection in the WordPress plugin The Events Calendar (all versions up to and including 6.17.2) allows unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the plugin, per CVSS a network, low-complexity, no-authentication issue with high confidentiality, integrity, and availability impact (CVSS 9.8). Depending on the POP gadget chains present in the plugin, its dependencies, or other installed plugins/themes, this can escalate to arbitrary file operations, SQL injection, or remote code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch target.
Unauthenticated privilege escalation in the TranslatePress multilingual plugin for WordPress (all versions up to and including 3.3.2) allows a remote, unauthenticated attacker to gain elevated privileges within the site, per a Patchstack advisory. The flaw is classified as incorrect privilege assignment (CWE-266) and carries a CVSS 9.8, implying an attacker can escalate to a high-impact role without authentication or user interaction. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Header-injection in the Apache Camel camel-atmosphere-websocket producer lets an external sender hijack WebSocket message dispatch in routes that bridge an HTTP consumer into the producer. Because the dispatch headers (websocket.connectionKey, websocket.connectionKey.list, websocket.sendToAll, websocket.eventType, websocket.errorType) use dotted names outside the filtered Camel namespace, the inherited HttpHeaderFilterStrategy admits them in both directions, so an attacker-supplied header overrides the recipient the route selected - suppressing a notification meant for one client or redirecting it to another client whose connection key the sender knows. No public exploit identified at time of analysis; EPSS is low (0.23%, 13th percentile) and it is not in CISA KEV, though the vendor rates it CVSS 9.8.
Header-filter bypass in the Apache Camel Undertow component (4.11.0-4.14.8, 4.15.0-4.18.3, and 4.19.0-4.21.x) lets remote senders smuggle legacy 'websocket.' dispatch headers across the undertow transport boundary. Because UndertowEndpoint overwrote the UndertowHeaderFilterStrategy with the base HttpHeaderFilterStrategy, undertow-specific filtering never ran on endpoint-configured routes, so an undertow HTTP consumer maps attacker-controlled 'websocket.*' wire headers onto the Exchange and a downstream undertow WebSocket producer can be steered to deliver to a peer other than the one the route selected. No public exploit identified at time of analysis, EPSS is low (0.16%, 5th percentile), and the fix is available from Apache.
Arbitrary code execution in libtiff's tiffcrop utility (commit 85f2ac8e) stems from the process_command_opts() function in tools/tiffcrop.c, classified as CWE-94 code injection. An attacker who can influence the input processed by tiffcrop can trigger execution of arbitrary code. Publicly referenced proof-of-concept material appears to exist via a linked gist, but the flaw is not in CISA KEV and EPSS is low (0.16%, 5th percentile), indicating no evidence of widespread active exploitation.
PHP Object Injection in the FreightCo WordPress theme (versions up to and including 1.1.15) lets remote attackers pass attacker-controlled serialized data into an unsafe unserialize() call, enabling exploitation of PHP object gadget chains. The flaw is unauthenticated (CVSS 3.1 vector PR:N) and carries a critical 9.8 base score, and per the CVSS vector it can lead to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.
Privilege escalation in the Jawn WordPress theme (versions ≤ 1.4.2, by mvpthemes) allows a remote, unauthenticated attacker to elevate their privileges within a WordPress site, per a Patchstack advisory. The flaw is rooted in incorrect privilege assignment (CWE-266) and carries a CVSS 9.8, implying an attacker can reach administrator-level control without credentials or user interaction. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary file disclosure in the WP Cafe Pro WordPress plugin (all versions before 3.0.15) lets remote unauthenticated attackers perform Local File Inclusion, reading sensitive server files such as wp-config.php or, in PHP include contexts, potentially executing attacker-controlled code. The flaw is network-reachable with no privileges or user interaction (CVSS 9.8), was reported by Patchstack, and a vendor patch exists in 3.0.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated privilege escalation in the Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin (versions up to and including 8.9.1) lets remote, unauthenticated attackers improperly acquire elevated privileges on affected WordPress sites. Reported by Patchstack and tracked as EUVD-2026-64804, the flaw carries a critical CVSS 9.8 with a fully network-exploitable vector and no user interaction. No public exploit identified at time of analysis, but the low attack complexity and unauthenticated nature make it a high-priority patching target.
Unauthenticated privilege escalation in the Digits WordPress plugin (versions 9.2 and earlier by UnitedOver, LLC) allows remote attackers to elevate their privileges without any authentication or user interaction, per Patchstack's disclosure. Digits is an OTP/phone-based login and registration plugin, so a flaw in its privilege-handling logic can let an outsider gain elevated account access. CVSS is rated 9.8 (critical); there is no public exploit identified at time of analysis and it is not on CISA KEV.
OS command injection in 4MOSAn GCB Doctor allows unauthenticated remote attackers to execute arbitrary system commands via a leftover ADOdb test page whose parameter is passed into a shell context. The vulnerable component is a debug/test artifact (an ADOdb connection test page) that was never removed from production builds, so any internet-reachable instance before build 20260621 is exploitable with a single crafted request. No public exploit has been identified at time of analysis, but the CVSS 4.0 base score of 9.3 and the fully unauthenticated network vector make this a high-priority patch.
Sensitive credential disclosure in RansomLook (versions 0 through 2.0.0) exposes full API keys in the rendered HTML of the authenticated /admin/apikeys page: although the UI only shows a truncated key, each token is embedded verbatim in hidden form fields backing the enable/disable, private-access, and delete actions. Anyone able to view the admin page source or DOM, or any intermediary that retains HTTP response bodies (debugging proxies, browser caches, monitoring systems), can recover the complete tokens and then authenticate with those keys' privileges, including access to private data. There is no public exploit identified at time of analysis; the issue is fixed upstream by replacing rendered tokens with SHA-256-derived opaque handles.
Broken authorization in RansomLook's web-based configuration editor (the /admin/config endpoint) lets any authenticated low-privileged user modify the application's config/generic.json, tampering with notification, LDAP, SMTP, and general settings. Because the endpoint enforces only that a session exists - with no administrator/privilege check (CWE-862) - a compromised or intentionally low-tier account can redirect integrations, alter authentication-related settings, or knock the installation offline. No public exploit has been identified at time of analysis, and the flaw is not in CISA KEV; the vendor CVSS 4.0 base score is 9.4.
Unauthenticated code execution in Combodo iTop before 3.2.3 arises because remote users can delete the setup-generated .readonly lockfile, which is the guard that blocks write operations and, once removed, re-opens privileged setup/configuration paths that lead to arbitrary code execution (CWE-94). Any internet-reachable iTop instance below 3.2.3 is affected, and the flaw carries a CVSS 4.0 score of 9.4 with full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial precondition (a single unauthenticated file-deletion request) makes weaponization realistic.
Prototype pollution in exceljs-hardened before 5.0.0 lets a remote attacker corrupt Object.prototype by feeding parsed JSON containing a malicious __proto__ property into a cell note, because the deepMerge helper in the note-serialization path fails to reject __proto__, constructor, or prototype keys. Any application that uses this library to process untrusted spreadsheet or note data is affected, and polluting the global prototype can cascade into denial of service, logic tampering, or code execution via downstream gadgets. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthenticated administrator account registration in rConfig 8.0.0 through the affected releases lets any remote attacker create a fully privileged Admin user by hitting a POST /register route that was supposed to be disabled. A duplicate bare Auth::routes() call in routes/web.php re-enables self-registration, and because the registration controller never assigns a role while the users.role column defaults to Admin, the new account is instantly authenticated with full administrative rights. Reported by VulnCheck; no public exploit identified at time of analysis, but the flaw is trivially reachable and grants access to stored device credentials, user data, and API token issuance.
Persistent storage exhaustion and file overwrite in DJI consumer/prosumer drone firmware allows an attacker with local or adjacent access to disable flight logging and block firmware updates. The onboard FTP service ships hardcoded credentials shared across affected models (CWE-798), and any party who reaches the drone's internal network or USB RNDIS interface can authenticate and write unlimited files to /blackbox/upgrade/, overwriting existing files. Uploaded data survives reboot and factory reset, making the condition durable. No public exploit identified at time of analysis; CIRCL-reported with CVSS 4.0 base 9.3.
Cross-tenant authorization bypass (IDOR/BOLA) in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 lets an authenticated user of one company read, modify, and even hijack supplier records belonging to other companies by sending a PUT to /api/supplier/{id} and supplying an arbitrary company_id in the body. The supplier lookup was not scoped to the caller's tenant and mass-assignment allowed re-parenting a record to the attacker's own company, breaking multi-tenant isolation. A vendor patch exists (5.3.2) and the fix is visible in a public GitHub commit; there is no public exploit identified and it is not on CISA KEV, but the flaw is trivially reproducible from the diff.
Unauthenticated SQL injection in the PixelYourSite "Boost" WordPress plugin (versions up to and including 2.0.4) lets remote attackers inject arbitrary SQL through an unauthenticated request, exposing the WordPress database on any internet-facing site running the plugin. The CVSS 3.1 base score is 9.3 (critical) with a changed-scope, confidentiality-focused vector. No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical, but the barrier to abuse is low.
Unauthenticated SQL injection in WooBeWoo Product Filter Pro (a WooCommerce catalog-filtering plugin) affects all versions up to and including 3.1.8, allowing remote attackers with no authentication to inject arbitrary SQL into backend queries and read sensitive database contents such as WordPress user records, password hashes, and session tokens. Reported by Patchstack and carrying a CVSS 9.3 (CWE-89), the flaw is network-exploitable with low complexity and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but SQLi in WordPress plugins is historically a high-value, easily-weaponized target.
SQL injection in Page Builder CK, a Joomla site-building extension by joomlack.fr, affects all versions prior to 3.6.5 and allows remote attackers to inject arbitrary SQL through the loadStyles method of the frontend page model. Because it is a second-order flaw, malicious input is stored first and executed during a later database operation, ultimately exposing the full Joomla database. The vendor-supplied CVSS 4.0 vector rates it 9.3 (Critical) with high confidentiality, integrity, and availability impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in OAuth2 Proxy (versions 7.5.0 up to but excluding 7.15.2) lets an unauthenticated remote attacker reach protected upstream routes by spoofing the X-Forwarded-Uri header. Because the trusted-proxy IP set defaults to 0.0.0.0/0 (and ::/0) whenever --reverse-proxy is enabled without --trusted-proxy-ip, every client is treated as a trusted proxy, so the skip-auth allow list is matched against the attacker-controlled header value while the real protected path is passed to the upstream. Reported by VulnCheck with a coordinated GitHub Security Advisory (GHSA-7x63-xv5r-3p2x); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in phpIPAM's REST API before 1.8.2 lets unauthenticated remote attackers obtain full API access by abusing an object-cache key collision, then wielding a numeric database row ID as a valid API token to read, write, and delete all IP address management records. VulnCheck reported the flaw and the vendor shipped a fix in 1.8.2; a patch commit is public, so publicly available exploit code exists in the sense of a documented, reproducible technique, though no active exploitation is confirmed. With a CVSS 4.0 base of 9.3 and no authentication or user interaction required, this is a high-priority issue for internet- or network-exposed phpIPAM instances.
SQL injection in the Woo Essential WordPress plugin (versions up to and including 4.3.0) lets remote unauthenticated attackers inject arbitrary SQL through an unsanitized parameter, enabling extraction of sensitive database contents such as credentials and customer records. Rated CVSS 9.3 (critical) with a scope-changed vector, the flaw was reported by Patchstack; no public exploit was identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated private-data disclosure in RansomLook, an open-source ransomware-leak-site tracking platform, allows any remote user who can reach the web application to pull records marked private. The legacy /export/<database> route exports selected internal databases without authentication and does not consistently apply the app's private-entity access restrictions, so private groups, markets, and posts can leak. Rated CVSS 4.0 9.2 (Critical); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Missing authorization in RansomLook, an open-source ransomware-intelligence tracking platform, lets unauthenticated remote attackers read data explicitly marked private. Several web views and API endpoints (notably /compare, ransom-note views, and search) failed to filter entities flagged as private, exposing private group and market names, ransom-note content, and metadata such as post counts, mirror totals, and uptime. Rated CVSS 4.0 9.2 (critical); a vendor patch exists (commit dc92d6d) and no public exploit has been identified at time of analysis.
SQL injection in CakePHP's database layer allows attackers to inject arbitrary SQL when an application uses FunctionsBuilder::jsonValue() with the PostgreSQL driver and passes user-controlled data into the jsonPath parameter. Affected release lines are 5.1.x before 5.1.10, 5.2.x before 5.2.15, and 5.3.x before 5.3.7; the root cause is the jsonPath value being interpolated into the generated ::jsonpath expression rather than bound as a parameter. No public exploit identified at time of analysis (not listed in CISA KEV), though the fix commit includes a regression test containing a working injection string.
Remote code execution in Konami's Metal Gear Online 3 (build 1.1.2.8) arises from an unbounded heap write when parsing the lobby's kicked-player list: the game trusts the attacker-supplied "kick_num" count without checking it against the 16-player buffer limit. A malicious lobby participant can overflow the kicked-ID buffer into adjacent Steam callback handler structures, corrupting function pointers to hijack control flow and potentially execute arbitrary code inside the game process. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the network-reachable, unauthenticated nature and RCE potential make it high-severity.
Authentication bypass in the CakePHP Authentication plugin's CookieAuthenticator (versions before 2.11.2, 3.0.0-3.3.6, and 4.0.0-4.2.0) lets remote attackers forge unencrypted legacy 'remember me' cookie tokens to impersonate users, and to trigger CPU or memory exhaustion by embedding password hashes with an oversized work factor. Rated CVSS 4.0 9.1, with a vendor advisory (GHSA-h7xh-9h2x-2m37) and fixing PRs published; no public exploit identified at time of analysis and it is not on CISA KEV. Applications only exposed if they use CookieAuthenticator with the legacy token format (the default grace-period behavior).
Remote code execution in Zscaler Client Connector (ZCC) lets a remote, unauthenticated attacker run arbitrary code within the ZCC process context, per a vendor-reported (Zscaler) advisory carrying a CVSS 9.1 rating. The flaw stems from improper input validation (CWE-20) and requires no privileges or user interaction, though exact fixed versions are described only through Zscaler's release summary rather than a discrete CVE-pinned build. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Authentication bypass in Zscaler Client Connector allows remote unauthenticated attackers to subvert the trust between the endpoint agent and the Zscaler Client Connector Portal, per the CVSS vector (AV:N/PR:N) yielding high confidentiality and integrity impact. The flaw (CWE-304) stems from a missing or incorrect step in the authentication logic governing agent-to-portal communications, affecting Windows, macOS, Linux, iOS, Android, and ChromeOS builds below the fixed versions. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though its 9.1 base score and network-facing, no-privilege profile make it high priority.
Arbitrary file write via path traversal in the Apache Camel camel-azure-storage-blob component lets an attacker who can influence blob names in a consumed Azure Storage container force Camel to create or overwrite files outside the configured download directory, with the privileges of the Camel process. It affects Apache Camel 4.0.0 before 4.14.9, 4.15.0 before 4.18.4, and 4.19.0 before 4.22.0, where BlobOperations.downloadBlobToFile joined the fileDir option with the raw remote blob name without normalization or containment checks. No public exploit has been identified at time of analysis and the CVSS is 9.1, but EPSS is low (0.18%, 7th percentile), indicating no observed exploitation activity yet.