Unauthenticated administrator account takeover affects the TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress in all versions through 3.3.1, where the 'trp_get_translations_regular' AJAX action returns raw translation-dictionary entries without access control. Because an administrator's password-reset URL can be persisted into the secondary-language dictionary as a translatable string, an unauthenticated attacker can read the plaintext reset key and login parameters and seize the admin account. Reported by Wordfence; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote code execution in SENAITE.CORE (senaite.core) 2.0.0 through 2.6.0 lets any network-reachable attacker run arbitrary Python in the Zope worker process by chaining a missing authorization check with an eval() sink in the JSON API. The anonymous-reachable /@@API/update route calls eval() on attacker-supplied RecordsField/RecordField values before any permission or write check fires, and a public working PoC (tested against the stock senaite/senaite:v2.6.0 Docker image) demonstrates credential-free command execution. Publicly available exploit code exists; the flaw is not listed in CISA KEV, so there is no confirmation of active exploitation.
Cross-namespace privilege escalation in Kyverno 1.18.0-1.18.1 lets any tenant who can create a NamespacedMutatingPolicy in their own namespace force the cluster-privileged admission controller to generate resources (ConfigMaps, Secrets, NetworkPolicies, RoleBindings) in arbitrary namespaces, including kube-system. The nmpol CEL compiler unintentionally exposes the generator library to matchConditions, and neither the mpol validator nor GenerateResources enforces namespace scope on the generator.apply() target. A working proof-of-concept is published in the vendor advisory (GHSA-79gf-7frw-68m9); there is no KEV listing or evidence of active exploitation, and the issue is fixed in 1.18.2.
Arbitrary file deletion in the Order Tip for WooCommerce WordPress plugin (versions before 1.6.0) allows authenticated Shop Managers to delete any file on the web server by exploiting missing capability checks and absent path restrictions on the deletion endpoint. The plugin fails to validate both the requesting user's permissions and the target file path, meaning a malicious or compromised Shop Manager account could remove critical WordPress files such as wp-config.php, leading to full site compromise. A publicly available proof-of-concept exists per WPScan; however, EPSS sits at only 0.17% (6th percentile) and CISA has not added this to KEV, consistent with the SSVC assessment of no observed exploitation.
Command injection in LibreNMS's Virtualization Discovery module enables authenticated administrator-level users to execute arbitrary OS commands on the underlying host server. Covering all tracked versions per CPE cpe:2.3:a:librenms:librenms:*, this CWE-78 flaw was disclosed by PRJBLK alongside a publicly available proof-of-concept exploit targeting version 26.5.0. No CISA KEV listing was identified at time of analysis, but the public PoC materially lowers the exploitation bar for any attacker who already holds admin credentials.
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream collectors such as rsyslog, Splunk, and Elastic Stack. The escapeStructuredDataValue() function omits C0 control character escaping, so a literal newline embedded in a log property value terminates the current RFC 6587 TCP syslog frame and begins a new one; if the attacker-supplied bytes constitute a valid RFC 5424 header, the downstream collector accepts them as a separate, authentic-looking record. A second injection path exists through unvalidated SD-NAME keys, which can prematurely close structured-data elements. Both paths require the non-default SyslogSinkOptions.includeStructuredData: true setting. Publicly available proof-of-concept code exists; no CISA KEV listing at time of analysis.
DOM-based XSS in SunEditor's Embed plugin (npm/suneditor <= 3.1.3) allows an authenticated user with editor access to execute arbitrary JavaScript in another user's browser by submitting crafted embed HTML containing an iframe followed by an external script element. The Embed plugin's node-processing loop recreates the attacker-controlled script element and appends it to the live DOM rather than discarding it, bypassing sanitization. A working proof-of-concept is publicly documented in GHSA-w93q-cq9w-58p7; no KEV listing is present, but stored-XSS scenarios targeting higher-privilege users (administrators, editors) compound the impact significantly.
Arbitrary CI command execution in GitLab Enterprise Edition allows an authenticated developer-role user to run unauthorized commands within a CI pipeline context across all EE versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1. The root cause is CWE-829 (Inclusion of Functionality from Untrusted Control Sphere): a Claude AI agent integration within GitLab EE processes CI pipeline configuration drawn from a user-controlled source without adequate isolation, enabling instruction injection into the agent's execution context. A public proof-of-concept is confirmed via HackerOne report 3863650, though SSVC and EPSS signals indicate no observed widespread active exploitation at time of analysis.
Remote unauthenticated administrative compromise is possible across three WordPress plugins - BlogVault Backup & Staging, MalCare WordPress Security Plugin, and WP Remote WordPress Plugin - in versions 5.16 through 6.64, due to the combination of a weak pseudo-random number generator used to create site-binding secrets and unauthenticated endpoints leaking data derived from those secrets. An attacker who can observe the leaked derived values can reverse the weak PRNG to reconstruct the original secret, then authenticate to the remote management service with administrative privileges and achieve full site takeover. A publicly available proof-of-concept exists; no CISA KEV listing is present, and EPSS sits at 0.17%, indicating limited observed mass exploitation despite the public exploit.
Path traversal in the AI Engine WordPress plugin (versions 3.3.3 through 3.7.1) allows arbitrary server file reads with subsequent exfiltration to an external service. When the plugin's non-default public API feature is enabled, subscriber-level users can supply a crafted URL that the plugin maps to a local filesystem path without confinement, reads, and forwards to an external AI endpoint. In default configurations the flaw is limited to administrator-level users, but on WordPress multisite networks this allows unprivileged subsite administrators to extract network-wide configuration secrets. A publicly available POC exists, though EPSS at 0.19% indicates no widespread automated exploitation at time of analysis.
Unauthenticated account creation in the Project Manager WordPress plugin before version 4.0.7 allows any remote attacker to register WordPress user accounts regardless of the site's registration settings. The import routes in the plugin carry no authorization checks whatsoever (CWE-862), enabling an attacker who already knows the password they will submit to establish a persistent, valid WordPress account on the target site. A publicly available proof-of-concept exploit exists; however, EPSS is currently 0.18% (7th percentile), indicating low observed exploitation volume at the time of analysis.
Path traversal in IzPack's UnpackerBase.unpack() enables arbitrary file writes under victim privileges when a user executes a trojanized installer JAR. The unpacking pipeline calls IoHelper.translatePath(), which performs only file-separator substitution with no canonical-path check, no startsWith(installDir) containment guard, and no normalization of '../' sequences, allowing attacker-controlled PackFile entries to escape the install directory entirely. Because IzPack JARs are standard unsigned ZIPs with no integrity protection, any legitimate IzPack installer can be silently repackaged with malicious entries; a publicly available proof-of-concept confirms the escape. The CVE is not listed in CISA KEV, but the trivial repacking method and social-engineering distribution vector make this a credible supply-chain threat to organizations consuming IzPack-packaged software from untrusted sources.
Remote code execution in the Pods WordPress plugin (versions 3.1.0 through 3.3.9.1) allows authenticated users holding the author role or higher to invoke arbitrary PHP functions on the server by submitting a crafted display callback that bypasses the plugin's blocked-function comparison logic. Exploitation is limited to sites where restricted display-callback mode is active - the automatic default on installations first deployed on Pods versions predating 3.1 - meaning a large subset of long-running Pods deployments are in-scope. A public exploit exists per WPScan reporting, though EPSS at 0.21% (11th percentile) indicates low observed exploitation activity and no CISA KEV listing at time of analysis.
OS command injection in Comfast CF-WR630AX firmware v.2.7.0.2 allows an adjacent-network attacker with administrator-level credentials to execute arbitrary OS commands through the device's web management interface and CGI endpoint via unsanitized parameters. A public proof-of-concept exploit is available on GitHub, though EPSS probability remains very low (0.19%, 9th percentile), indicating minimal observed exploitation activity. No active exploitation has been confirmed by CISA KEV, and the AV:A/PR:H CVSS vector materially constrains the realistic attacker population.
Stored Cross-Site Scripting in the Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) permits any authenticated Contributor-role user to inject arbitrary JavaScript payloads via unsanitized widget settings that are rendered unescaped inside HTML attributes. When a higher-privileged user such as an administrator previews or views the crafted content, the payload executes in their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. A public proof-of-concept is available via WPScan; however, no public exploit identified at time of analysis maps to confirmed active exploitation, and EPSS sits at 0.18% (8th percentile).
Command injection in Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build) allows an adjacent-network attacker holding administrator credentials to execute arbitrary OS commands with root privileges. The flaw is in the update_interface_png SET handler within /usr/bin/webmgnt, where the display_name parameter is unsanitized and concatenated via sprintf() directly into a shell command string passed to system(). A public proof-of-concept is available on GitHub; EPSS at 0.17% (6th percentile) indicates no current widespread exploitation, and the vulnerability is not listed in CISA KEV.
Credential exposure in Rently Smart Home versions 20.1.0 and prior allows authenticated network-based attackers to retrieve all property access PINs, including the Master Pin that overrides the standard user permission hierarchy. Reported by ICS-CERT via CISA advisory ICSA-26-237-01, the flaw is particularly severe in property rental contexts where Master Pin retrieval translates directly to unauthorized physical access to tenant properties. No public exploit code has been identified at time of analysis, but the low attack complexity and network-accessible vector make this a genuine operational and physical security risk.
GitLab Enterprise Edition's SCIM user provisioning feature allows an authenticated low-privileged user to trigger an unbounded loop via specially crafted input, causing denial of service on the affected instance. Versions spanning a wide range from 11.10 through 19.3.0 are affected, with vendor-released patches now available. A publicly available exploit is documented in HackerOne report #3292470; however, this vulnerability is not listed in CISA KEV, indicating active exploitation has not been confirmed at scale.
Unauthenticated queue-trigger exposure in the Booking for Appointments and Events Calendar WordPress plugin (versions before 2.4.7) permits any remote visitor to force the dispatch of the plugin's pending notification queue and integration callbacks. Because the queue-processing endpoint performs no authentication check (CWE-287), an attacker needs no credentials or session to invoke it. A publicly available proof-of-concept exists per the WPScan report, though EPSS at 0.23% indicates exploitation has not yet reached widespread automated activity, and the vulnerability is not listed in CISA KEV.
Simple Newsletter Plugin for WordPress (versions 4.0.0 through 4.3.2) fails to verify that a public requester matches the subscriber whose record is being fetched, exposing stored personal data and the authorization key that controls changes to that subscriber's record to any unauthenticated caller. A publicly available proof-of-concept documented by WPScan demonstrates the attack path, though EPSS at 0.18% (7th percentile) suggests exploitation has remained limited in observed telemetry. Vendor-released patch version 4.3.3 is available and should be applied immediately given the zero-complexity, unauthenticated exploit path.
Unauthenticated access to a missing-authorization REST endpoint in the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before version 3.7.1 exposes the site's connected compliance-service API secret and account credentials to any visitor. Using the retrieved secret, an attacker can call the connected third-party compliance service API to sever the plugin's integration, causing GDPR, CCPA, and cookie policy documents to stop displaying on the affected WordPress site. A public exploit exists per WPScan, though CISA has not listed this in KEV and SSVC rates active exploitation as none at time of analysis.
Unauthenticated ownership bypass in the Return Refund and Exchange For WooCommerce plugin (versions before 4.6.4) exposes guest order workflows to arbitrary third-party manipulation. Any unauthenticated network attacker who can reference a guest order ID can read private order messages, impersonate the customer by posting messages or attachments, and cancel active return requests - undermining both customer privacy and merchant return-process integrity. A publicly available proof-of-concept exists; however, exploitation probability is very low per EPSS (0.17%, 6th percentile), and no active exploitation has been confirmed by CISA KEV.
Remote command injection in Ubiquiti's UniFi Talk Application lets a network-positioned attacker run arbitrary commands on the underlying host device due to improper input validation (CWE-20). Ubiquiti rates it CVSS 10.0 with a changed scope, meaning a successful attack escapes the application boundary to fully compromise the host. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Command injection in Ubiquiti UniFi Protect Application lets a network-positioned, unauthenticated attacker run arbitrary OS commands on the underlying host device, per the CVSS:3.1/AV:N/PR:N/UI:N vector and CWE-20 improper input validation root cause. The maximal 10.0 score reflects full confidentiality, integrity, and availability compromise with a scope change (S:C), meaning code executes on the host beyond the application boundary. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the trivial complexity and lack of authentication make it a top-priority patch for any exposed NVR.
Command injection in Ubiquiti's UniFi Protect Application lets a low-privileged, network-adjacent user run arbitrary operating-system commands on the host device (typically a UniFi NVR, Cloud Key, or Dream Machine running the Protect service). The CVSS 3.1 score of 9.9 reflects a scope change: an attacker who already holds a low-privilege application account escapes the application boundary to gain full control of the underlying host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralization of CRLF sequences (CWE-93) to gain access to affected consoles and gateways. It impacts a broad line of UniFi OS devices - Cloud Keys, Dream Machines/Routers, Network Video Recorders, Cloud Gateways, Enterprise Firewall/Fortress and NAS appliances, and the UniFi OS Server. Vendor-rated CVSS 10.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Missing authentication on KubePi's SSO configuration endpoints (versions up to and including 1.6.15) lets unauthorized or low-privileged users read, create, and modify the global SSO/OIDC/SAML authentication configuration because those management routes share the public routing boundary with the SSO login/callback endpoints. An attacker can inspect or tamper with authentication settings - potentially leading to account takeover or privilege escalation - abuse the SSO connectivity-test as an SSRF primitive, and harvest authentication-related fields leaked by the user-list API. There is no public exploit identified at time of analysis; the issue is fixed in KubePi 2.0.0.
Command injection in Ubiquiti's UniFi Protect Application lets a network-adjacent attacker holding only low-privileged credentials run arbitrary OS commands on the underlying host device. The CVSS 3.1 base score is 9.9 with a scope change, reflecting that a foothold in the application escalates into full control of the host operating system. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the near-maximal score and low exploitation barrier make it a high-priority patch.
Command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network access to run arbitrary operating-system commands on the underlying host device. The flaw stems from improper input validation (CWE-20) and carries a critical CVSS 9.9 with a scope change, meaning application-level compromise pivots to full control of the host. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
OS command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network reach to run arbitrary commands on the underlying host. Because the CVSS scope is marked Changed with full High confidentiality, integrity, and availability impact, successful exploitation moves beyond the application into the host device itself. No public exploit has been identified at time of analysis and the flaw is not on CISA KEV, but the 9.9 severity and low attack complexity make it a top-priority patch.
Command injection in Ubiquiti's UniFi Access Application allows an authenticated attacker with low privileges and network access to execute arbitrary OS commands on the host device. Rated CVSS 9.9 with a scope change, the flaw stems from improper input validation and lets a low-privileged user break out of the application to compromise the underlying host. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Command injection in the Ubiquiti UniFi Enterprise Audio/Video Bridge allows a network-adjacent attacker to run arbitrary operating-system commands on the device by supplying maliciously crafted input that the firmware fails to validate. The CVSS 3.1 base score is 9.8 and the vector marks the flaw as network-reachable with no authentication or user interaction, yielding full confidentiality, integrity, and availability compromise. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Authenticated remote attackers against WebPros Plesk (versions before 18.0.79.8, and 18.0.80 through 18.0.80.3) can inject special elements into the DNS zone management functionality to read arbitrary files on the server and escalate their privileges. Because the CVSS scope is changed (S:C), a low-privileged panel user can break out of their intended boundary to compromise the underlying host with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and EPSS is low (0.29%) with SSVC exploitation status 'none', indicating no observed exploitation yet.
Privilege escalation in Ubiquiti's UniFi Access Application allows a network-adjacent attacker holding only low-privilege credentials to gain full control of the underlying host device through an improper access control flaw. Ubiquiti self-reported the issue and rates it CVSS 9.9 (scope-changing), reflecting that a constrained application account can break out to compromise the host operating system. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate their rights to full administrative control, per Ubiquiti Security Advisory Bulletin 067 (CVE-2026-77536). The flaw stems from improper access control (CWE-284) and carries a near-maximum CVSS 9.9 due to a scope-changing impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to elevate to higher privileges on the affected device or instance due to an improper access control flaw. The issue spans Ubiquiti's core managed platforms - UniFi OS Server, Cloud Keys, Dream Machines/Routers, Cloud Gateways, NVR/Enterprise NVR, Enterprise NAS, and Enterprise Firewall/Fortress Gateway - and carries a critical CVSS 9.9 with a changed scope. No public exploit has been identified at time of analysis, but the low attack complexity and low privilege requirement make it high priority.
Unauthenticated arbitrary file write in the Avada WordPress theme (versions up to and including 7.16) combined with the Fusion Builder plugin (up to and including 3.16) lets remote attackers plant attacker-controlled files - including executable PHP - leading to remote code execution and full site takeover. The flaw is a cross-component chain of broken authorization and weak input validation (CWE-862) reported by Wordfence, and requires both components active plus specific administrator-authored content to be present. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Denial of service in the Linux kernel's TI AM65 CPSW NUSS Ethernet driver (am65-cpsw-nuss) allows sporadic kernel crashes because the driver treats the full 16-bit RX DMA descriptor Source Tag as the MAC port ID, when only the lower 8 bits are valid. On affected TI Sitara/K3 (AM65x-class) hardware, the arbitrary hardware-reserved upper 8 bits produce an invalid port_id that subsequent driver code uses to access out-of-bound memory, causing kernel panics. No public exploit is identified and it is not on CISA KEV; the vendor-tagged impact is Denial Of Service, not the remote code execution implied by the automated 9.8 score.
Use-after-free in the Linux kernel netfilter flowtable (nf_flow_table_offload) arises from an ordering bug in how connection-tracking tuple nodes are published to the rhashtable. Because nf_flow_table_iterate() treats only the original-direction node as the owning entry, publishing it before the reply node lets the garbage collector observe and free a flow while flow_offload_add() is still inserting the reply node, producing slab-use-after-free reads and writes reachable through rht_deferred_worker, jhash, flow_offload_del and flow_offload_lookup. The flaw affects systems using software/hardware flow offload; no public exploit identified at time of analysis, though the CNA-assigned CVSS is 9.8.
Slab-out-of-bounds reads in the Linux kernel's libceph client (cls_lock_client.c decode_locker()) allow a malicious or compromised Ceph OSD to read kernel memory past a validated buffer when a client parses lock information. Any kernel Ceph/RBD client that issues the lock.get_info class method - for example during RBD exclusive lock acquisition - is affected across a wide range of stable branches. The input assigns CVSS 9.8, but no public exploit identified at time of analysis and the flaw is an out-of-bounds read (information disclosure / crash) rather than confirmed code execution, so the practical impact is narrower than the score suggests.
Out-of-bounds memory access in the Linux kernel's libceph client (net/ceph) allows a malicious or corrupted Ceph osdmap to steer requests toward a non-existent OSD index. The flaw stems from an unvalidated osd index taken from the osdmap's primary_temp mapping, which is used to index the fixed-size osd_state, osd_weight, and osd_addr arrays. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed across multiple stable trees.
Denial of service (kernel crash/oops) in the Linux kernel CephFS client affects systems mounting a Ceph filesystem alongside another journaling filesystem such as ext4. The ceph handle_reply() path stores a ceph_mds_request pointer in current->journal_info while prepopulating the inode/dentry cache from an MDS reply; if an allocation in that window enters direct reclaim and prunes dentries from an ext4 mount, JBD2 misinterprets the Ceph pointer as a journal handle and dereferences r_tid as h_transaction, causing a paging fault and kernel oops. No KEV listing and no public exploit identified at time of analysis; the reported impact class is Denial Of Service rather than the code execution implied by the supplied 9.8 score.
Memory corruption in the Linux kernel ipvlan driver arises because ipvlan devices inherit hard_header_len but leave needed_headroom and needed_tailroom at zero, so upper layers under-reserve skb space when the lower physical device needs extra header/trailer room (macsec, IPsec, WireGuard, tunnels, or veth with rx headroom). Triggering the header-prepend or tailroom-append path can cause skb headroom underflow and KASAN-detected slab-use-after-free crashes. It is tagged as Denial of Service, has a vendor fix across multiple stable branches, and shows no public exploit or CISA KEV listing at time of analysis.
Memory corruption in the Linux kernel's macvlan driver occurs because macvlan devices fail to inherit needed_headroom and needed_tailroom from their underlying lower device, leaving both at 0. On systems where a macvlan is stacked on a lower device requiring extra header/trailer space (macsec, IPsec, WireGuard, tunnels, or veth with RX headroom), the upper layers under-reserve skb space, producing headroom underflows and KASAN slab-use-after-free crashes during header insertion. Tagged as Denial Of Service; a vendor patch is available and no public exploit has been identified at time of analysis.
Kernel memory corruption in the Linux SCTP stack allows a forged COOKIE_ECHO chunk to bypass validation of AUTH parameters when cookie authentication is disabled, letting an attacker who controls the echoed cookie bytes supply unchecked RANDOM lengths, HMAC identifiers, and CHUNKS lists. A forged RANDOM length yields out-of-bounds reads during key-vector construction, and a forged HMAC identifier drives a 32-byte write past a zero-length AUTH chunk - described by the reporter as a primitive for a local privilege escalation chain. No public exploit identified at time of analysis; the issue is fixed upstream in the mainline SCTP code.
Uninitialized-data exposure in the Linux kernel's MPTCP (Multipath TCP) option parser lets a remote peer send a malformed DSS suboption with an incorrect size, followed by a second DSS or MPC+Data, causing the first suboption to be ignored while leaving stale fields populated. The kernel then acts on inconsistent or uninitialized memory when handling the MPTCP connection. The upstream fix explicitly resets the affected DSS fields; vendor stable patches are available, this maps to CWE-908/CWE-457 (use of uninitialized resource), and there is no public exploit identified at time of analysis.
Use-after-free in the Linux kernel block layer occurs when a disk whose driver probe fails before add_disk() is released: disk_release() calls blk_mq_exit_queue() without stopping the request_queue timeout timer, so the request_queue is freed while still linked in a timer-wheel bucket. NVMe reaches this path because nvme_update_ns_info() issues Report Zones or FDP io-mgmt-recv I/O on the namespace queue before the disk is added, and a later failure (concurrent reset setting NVME_CTRL_FROZEN, or device_add_disk() failing) leaves the timer armed on freed memory. The flaw was found by the FuzzNvme fuzzer and produces a KASAN slab-use-after-free (write) during timer teardown; no public exploit is identified at time of analysis and it is not in CISA KEV.
Improper handling of incoming MPTCP suboptions in the Linux kernel's Multipath TCP (mptcp) implementation lets a remote peer send option combinations that RFC 8684 treats as mutually exclusive and that the parsing code does not expect, potentially causing inconsistent internal state when malformed or malicious combinations (e.g. MP_CAPABLE with MP_JOIN, or MP_FASTCLOSE with a DSS) are processed on the receive path. The fix mirrors the output-side restrictions in mptcp_write_options so conflicting suboptions are ignored rather than acted upon. No public exploit identified at time of analysis, and the issue is only reachable on hosts where MPTCP is enabled and in use; the supplied CVSS of 9.8 appears automated and likely overstates real-world impact.
Privilege escalation in Ubiquiti's UniFi Protect AI Key lets a network-adjacent attacker abuse an improper access control (authentication-bypass) weakness to gain elevated privileges on the device, per Ubiquiti's own advisory (Security Advisory Bulletin 067). The CVSS 9.8 rating reflects a network-reachable, no-authentication, no-interaction path yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote command execution in JeecgBoot v3.9.2 lets attackers run arbitrary OS commands through the AI Flow module's CodeNode component, which executes user-supplied Groovy scripts. The SecurityCheck class enforces a blacklist to block dangerous calls, but Groovy's dynamic dispatch allows the blacklist to be fully bypassed via string concatenation and reflection, yielding full code execution. No public exploit is identified at time of analysis, and EPSS is low (0.22%, 13th percentile), consistent with a newly disclosed issue rather than mass exploitation.