Stored Cross-Site Scripting in Smart Slider 3 (WordPress plugin by Nextend) versions up to and including 3.5.1.38 allows authenticated contributors to inject persistent JavaScript payloads via the Gutenberg 'slider' block attribute, targeting Editors and Administrators who subsequently open affected posts in the WordPress block editor. The flaw originates from insufficient input sanitization in the Gutenberg block integration and missing output escaping in the plugin's shortcode renderer. No public exploit code or CISA KEV listing has been identified; the primary real-world risk is insider-threat or compromised-contributor scenarios leading to privileged account takeover.
Stored Cross-Site Scripting in LiteSpeed Cache for WordPress (all versions through 7.7) allows authenticated attackers holding Author-level access or higher to inject persistent malicious scripts via specially crafted `<img>` tag attributes. The defect lives in a flawed regular expression inside the plugin's media class that is invoked only when both the 'Lazy Load Images' and 'Add Missing Sizes' features are simultaneously active, causing attribute-embedded payloads to survive sanitization and be stored in page content. Injected scripts execute in the browser of any subsequent visitor, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored Cross-Site Scripting in the Avada (Fusion) Builder WordPress plugin through version 3.15.6 allows authenticated contributors to permanently embed malicious JavaScript in page content via the 'size' shortcode attribute. The root bypass is structural: WordPress's wp_kses_post filter only inspects HTML angle-bracket constructs, so payloads confined entirely to a shortcode attribute string pass the filter unchanged at save time and execute in any visitor's browser. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the Scope:Changed CVSS designation reflects that successful injection escalates attacker influence from the contributor's own context into the browsers of higher-privileged users, including site administrators.
Server-Side Request Forgery in wallabag 2.x through 2.6.14 enables authenticated users to coerce the application server into issuing arbitrary HTTP requests to internal or external hosts via a maliciously crafted article title or content field that is processed during PDF export. The scope change in the CVSS vector (S:C) reflects that the SSRF escapes the wallabag application boundary and can reach backend services, cloud metadata endpoints, or internal network hosts invisible to the attacker directly. A separate full-disclosure post references this same advisory with a higher CVSS score of 8.5 and also mentions a Stored XSS vector, suggesting the attack surface may be broader than the NVD 6.4 score implies. No public exploit identified at time of analysis.
Stored Cross-Site Scripting in the Envira Gallery WordPress plugin (versions ≤1.12.4) permits authenticated attackers holding Author-level privileges or higher to inject persistent JavaScript payloads through the gallery description configuration field. The injected script executes in the browsers of any site visitor who loads a page rendering an affected gallery with its description enabled, enabling session hijacking, credential theft, or admin account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; a fix has been committed to the WordPress plugin repository trunk per changeset 3514026.
Stored Cross-Site Scripting in GiveWP (WordPress donation plugin by StellarWP, versions through 4.14.4) allows authenticated Contributor-level users to inject persistent JavaScript payloads into donation form pages via the give_form shortcode. The flaw arises because the continue_button_title and display_style shortcode attributes are sanitized with sanitize_text_field() - which strips HTML tags but does not encode special characters - and then written unescaped into HTML data attributes, leaving a standard XSS sink unguarded. No public exploit has been identified and active exploitation has not been confirmed by CISA KEV at time of analysis.
Stored cross-site scripting in All-in-One WP Migration Unlimited Extension (all versions up to and including 2.84) allows any authenticated WordPress user with Subscriber-level access to plant persistent JavaScript payloads via the ai1wm_backups_path parameter, which execute in the administrator's browser context when the plugin settings page is visited. Two compounding weaknesses drive the flaw: absent input sanitization on the parameter and missing authorization checks on the settings() function, permitting low-privileged users to write attacker-controlled data into plugin configuration. A partial fix was shipped in version 2.84 but a fully remediated release has not been confirmed, and no public exploit code has been identified at time of analysis.
Local denial-of-service in IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 allows a local attacker to exhaust system resources and render the platform unavailable, without requiring any credentials. The vulnerability stems from improper resource allocation controls (CWE-770), meaning the system places no effective cap on resource consumption triggered by local access. No public exploit has been identified at time of analysis, and a vendor patch is available via IBM's support portal.
Cross-site scripting in oPanel's DNS lookup and management component before v1.20.25 allows a remote unauthenticated attacker who controls any DNS zone to inject arbitrary JavaScript into an authenticated panel user's browser session by poisoning a DNS TXT record with a crafted payload. When a panel user performs a DNS lookup on the attacker-controlled domain, the unsanitized TXT record value executes in the victim's browser context, enabling session token theft and full account takeover. A public proof-of-concept is available on GitHub; the vulnerability is not in CISA KEV and EPSS sits at 0.37%, indicating low automated exploitation probability but a documented and accessible attack technique.
Cross-site scripting via `javascript:` URI injection in Omeka S 4.2.0 allows an attacker who controls site navigation configuration to plant a malicious custom URL that executes arbitrary JavaScript in any visitor's browser when the navigation link is clicked. The flaw resides in the `Url.php` navigation link handler, which failed to reject URLs using the `javascript:` scheme. A researcher-published writeup exists, but no confirmed active exploitation or CISA KEV listing is present at time of analysis.
Stored Cross-Site Scripting in ElementsKit Pro for WordPress allows unauthenticated attackers to persistently inject arbitrary JavaScript via the Advanced Search REST endpoint, affecting all versions through 4.10.1. The flaw combines an authentication bypass (permission_callback set to __return_true) with inadequate output escaping: sanitize_text_field() permits double-quote characters to pass through, and stored keywords are later rendered into HTML attributes using sprintf() without esc_attr(), enabling attribute injection. Unlike reflected XSS, this stored variant poisons the site globally - every visitor who triggers the 'no results' state on any page using the Advanced Search widget executes the injected payload. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Reflected XSS in Ceviz Informatics Inc.'s Web Design platform (versions through 25082026) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by tricking them into clicking a crafted URL. The CVSS scope change (S:C) confirms the injected script crosses the application-browser trust boundary, enabling session hijacking, credential theft, or malicious redirects. No public exploit identified at time of analysis and no CISA KEV listing; the threat is opportunistic phishing-driven rather than mass exploitation.
Reflected XSS in Dayneks Software Industry and Trade Inc.'s E-Commerce Platform (all versions through 28082026) allows unauthenticated remote attackers to inject and execute malicious scripts in victim browsers by delivering crafted URLs. The vulnerability, rooted in CWE-79 unsanitized input reflection, enables session hijacking, credential theft, or malicious redirection within the e-commerce site's origin context. No vendor patch is available; the vendor did not respond to TR-CERT's coordinated disclosure, leaving operators without an official remediation path.
Heap out-of-bounds read in GIMP's file-iff plugin allows a local attacker to crash the application or disclose limited heap memory contents by delivering a specially crafted IFF/ILBM image file. The flaw stems from missing validation of HAM row size when the number of color planes (nPlanes) is zero, causing a size mismatch that bypasses memory bounds checking. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Heap out-of-bounds read in GIMP's file-pvr plugin exposes users of Red Hat Enterprise Linux 6 through 9 to application crashes and limited heap memory disclosure when opening a crafted PVR image file. The VQ (Vector Quantization) compressed-texture decoder omits mandatory bounds validation, allowing a malicious image to read beyond allocated heap regions. Impact is primarily denial of service via crash, with a secondary low-severity information disclosure path; no public exploit code and no CISA KEV listing are associated with this issue at time of analysis.
Heap out-of-bounds read and stack out-of-bounds access in GIMP's file-psd plugin allow an attacker to crash the application or disclose limited memory contents by convincing a user to open a specially crafted PSD image. The flaw affects GIMP as shipped in Red Hat Enterprise Linux 6 through 9 and stems from missing validation of the channel-count parameter during PSD parsing. No active exploitation has been identified; the attack requires local file delivery and deliberate user interaction, significantly constraining real-world risk.
Heap out-of-bounds read in GIMP's file-ico plugin allows a local attacker to crash GIMP or leak limited heap memory contents by delivering a specially crafted ICO image file to a victim user. Affected packages span Red Hat Enterprise Linux 6 through 9. No public exploit code or CISA KEV listing exists at time of analysis, but the user-interaction requirement (opening a malicious file) is the primary delivery mechanism and a realistic social-engineering target in image-processing workflows.
Path traversal in Duplicacy's restore function through version 3.2.5 allows arbitrary file writes outside the designated restore directory when a user restores from a compromised or attacker-controlled snapshot repository. Duplicacy fails to sanitize file paths deserialized from snapshot entries, so crafted traversal sequences (e.g., '../../') cause files to be written to any location accessible by the restoring OS user. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the integrity and availability impact is rated High in the CVSS 4.0 assessment.
Arbitrary file write outside the worktree boundary in gix-worktree-state (part of gitoxide) before 0.33.0 on Windows enables an attacker-controlled repository to overwrite files at arbitrary paths on a victim's filesystem. The flaw manifests when gix_worktree_state::checkout() performs an incremental materialization: a malicious repo first places a symlink entry at path P pointing outside the worktree, then a subsequent incremental checkout of a regular-file entry at the same path follows the Windows reparse point and writes attacker-supplied blob content through the link. No public exploit code is identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Feedback endpoint authorization bypass in Chainlit through 2.12.0 allows authenticated users to modify or delete other users' feedback records by supplying arbitrary feedback identifiers to the PUT and DELETE API endpoints. The server performs no ownership verification before processing these operations (CWE-639), enabling silent corruption of human-rating datasets used in LLM evaluation and RLHF pipelines. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Stack-based buffer overflow in MongoDB BI Connector ODBC Driver allows an authenticated user who can influence the numeric argument of a SQL LIMIT clause to crash the hosting application process or corrupt adjacent stack memory. The vulnerability is gated by a non-default driver configuration: the prefetch feature must be explicitly enabled, narrowing real-world exposure to that subset of deployments. No public exploit code has been identified and the issue is absent from CISA's Known Exploited Vulnerabilities catalog; however, where conditions are met, availability impact is rated High by the reporter.
CPU exhaustion via infinite loop in OX Dovecot CE's ManageSieve login handler allows unauthenticated remote attackers to deny Sieve script management and potentially degrade the entire mail server. The flaw is triggered at the pre-authentication stage, requiring only network access to the ManageSieve port; repeated connections can saturate all available CPU cores. No public exploit code exists, and the CVSS AC:H metric indicates the attack requires precisely crafted input, limiting opportunistic exploitation.
SMTP smuggling in Open-Xchange's OX Dovecot Pro and Community Edition allows an unauthenticated attacker to inject forged SMTP commands into messages relayed through Dovecot, bypassing its outbound content-sanitization logic. By embedding crafted bare carriage return sequences in a message body - delivered via Sieve redirect or submission relay - the attacker causes a vulnerable downstream mail server to misinterpret message body content as new SMTP envelope commands, enabling injection of spoofed email. This is the same vulnerability class as CVE-2023-51764 (Postfix) and CVE-2023-51766 (Exim); no public exploit code exists and the CVE is not listed in CISA's KEV catalog.
IBM Concert versions 1.0.0 through 2.3.1 expose deployments to man-in-the-middle attacks due to improper TLS certificate validation (CWE-295), enabling remote attackers to intercept and manipulate communications between Concert components. The integrity impact is rated High by IBM's own CVSS scoring, meaning an adversary successfully positioned in the network path can perform unauthorized actions against affected Concert instances. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7285337.
OAuth2 multi-scope enforcement bypass in OX Dovecot Pro and CE allows an attacker holding a partial-scope OAuth2 token to authenticate and perform operations beyond their granted permissions via the remote token validation path. The remote validation logic incorrectly accepts a token carrying only one of several required scopes, while the local validation path correctly enforces all configured scope requirements - creating an inconsistency exploitable by any holder of a legitimately issued but insufficiently scoped token. No public exploit identified at time of analysis; CVSS 5.9 Medium with high integrity impact reflects a real but configuration-gated privilege escalation risk.
Cross-user data disclosure in SvelteKit (npm/@sveltejs/kit versions 2.38.0 through 2.60.0) stems from a race condition in the query.batch() API that can cause concurrent HTTP requests from different authenticated users to merge under a single shared request context. Successful exploitation allows one user to receive response data belonging to another user's simultaneous session, including potentially sensitive application state. Vendor-released patch version 2.60.1 is available; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
IBM Integrated Analytics System versions 1.0.0.0 through 1.0.31.0 employs cryptographic algorithms below acceptable security standards, exposing highly sensitive data to decryption by a network-positioned attacker. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates network exploitation without authentication but requires high attack complexity, consistent with a passive interception or man-in-the-middle scenario. No public exploit code has been identified, and IBM has released a remediation patch via support advisory 7285147.
IBM Integrated Analytics System versions 1.0.0.0 through 1.0.31.0 fails to properly validate TLS certificates, enabling network-positioned attackers to conduct man-in-the-middle attacks and intercept sensitive data in transit. IBM has confirmed the issue and released a patch via advisory node/7285149. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the network-accessible attack vector with no authentication requirement raises the relevance for deployments where the system communicates across untrusted network segments.
Uncontrolled recursion between Elixir's charlist inspection path and the error-message rescue clause in List.to_string/1 and List.to_charlist/1 can exhaust a BEAM node's memory when an attacker controls list data reaching those functions. A crafted list whose printable prefix exceeds the 4096-element printable_limit but which carries an invalid element beyond that threshold bypasses the ASCII classification check, triggers ArgumentError in IO.chardata_to_string/1, and then recurses infinitely through the rescue clause because the inner inspect/1 call is not in tail position - every frame is retained on the process heap. No public exploit has been identified at time of analysis; vendor-released patches are available as Elixir 1.18.5, 1.19.6, and 1.20.4.
CSV injection in the MongoDB MongoSQL Transition Readiness Tool allows a low-privileged cluster user to embed spreadsheet formula directives inside database or collection names, which are written unsanitized into generated CSV reports. When an operator opens the report in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, the formula executes on the operator's workstation, potentially exfiltrating report contents to an attacker-controlled endpoint or triggering external content retrieval. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is constrained by the requirement for both cluster write access and an operator who opens the file in a formula-evaluating spreadsheet.
SQL injection in MongoDB Connector for BI allows a high-privilege user to embed arbitrary SQL in generated DDL output by crafting a collection JSON schema validator description containing unescaped backslash sequences. All versions covered by cpe:2.3:a:mongodb:bi_connector:*:*:*:*:*:*:*:* in deployments that build SQL schemas from collection validators are affected. When an operator or automated pipeline later replays the poisoned SHOW CREATE output against a SQL server, the injected SQL executes with the replaying session's full privileges, potentially exfiltrating data or manipulating schema objects. No CISA KEV designation and no public exploit code are known at time of analysis.
Memory exhaustion and disk consumption in Ericsson CodeChecker's massStoreRun API endpoint allows authenticated users holding analysis-run storage permissions to trigger denial of service via a decompression bomb. The processing path accepts Base64-encoded zlib payloads and fully materializes the decompressed output in memory before any disk write, with no maximum decompressed size enforced - a small compressed payload can expand to gigabytes. A proof-of-concept exists (CVSS 4.0 supplemental metric E:P) and the attack is automatable (AU:Y), meaning a compromised or malicious account with store permissions can repeatedly crash the service or exhaust host resources.
Out-of-bounds memory write in libsolv crashes RPM-based package manager tools (dnf, yum, zypper) when processing a corrupted or specially crafted .solv repository cache file. The root cause is an absent array-index bounds check on directory-id values read from compressed filelist data during .solv file rewriting - but because the out-of-bounds write stores only a fixed, non-attacker-controlled value, the vendor explicitly rules out arbitrary code execution, confining impact to denial of service. No public exploit has been identified and no active exploitation is confirmed; note that the 'RCE' metadata tag conflicts directly with the description and appears to be erroneous.
Parameter/argument delimiter injection in Microsoft Edge (Chromium-based) enables network-based code execution by an unauthenticated remote attacker who can induce a user to interact with malicious content. The flaw, classified under CWE-141, stems from insufficient sanitization of delimiter characters in parameter or argument handling within the browser, potentially allowing injected values to alter command or function execution semantics. Tags associated with this CVE include 'Authentication Bypass', suggesting the delimiter injection may also facilitate circumventing browser-level or web-application authentication controls in certain contexts. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Prompt injection in Microsoft Edge for iOS exposes users to network-based spoofing attacks through Microsoft Edge's AI/Copilot integration. Malicious web content can embed adversarial LLM prompts that, when processed by Edge's AI features, manipulate the model to produce spoofed or misleading output - potentially impersonating trusted content or bypassing AI-enforced guardrails. The CVSS vector (PR:N/UI:R) indicates no attacker authentication is required, but a user must interact with Edge on iOS while AI features are active. No public exploit code has been identified at time of analysis, and a vendor-released patch is available via MSRC.
Incorrect authorization in Microsoft Edge (Chromium-based) allows a remote, unauthenticated attacker to disclose limited information and cause minor integrity impact by luring a user to attacker-controlled web content. The flaw stems from CWE-863, where Edge's authorization logic fails to correctly enforce access boundaries, permitting content-triggered data exposure within the browser's security context. No public exploit has been identified at time of analysis, and Microsoft has released a patch via the MSRC advisory.
Stored Cross-Site Scripting in xipblog v2.0.1 and earlier for PrestaShop allows unauthenticated remote attackers to inject persistent JavaScript payloads through the name and content parameters of ajax.php, which are written to the database without sanitization and rendered unsafely in Smarty templates. When a store administrator subsequently reviews submitted comments in the PrestaShop back office, the payload executes within the admin's authenticated browser session, enabling full store compromise including session hijacking, unauthorized admin actions, and potential exfiltration of customer and payment data. A publicly available proof-of-concept exists per SSVC data and a GitHub Gist reference; exploitation is not currently confirmed in CISA KEV.
Origin validation failure in Microsoft Edge (Chromium-based) enables unauthenticated remote attackers to bypass browser security features, resulting in limited cross-origin confidentiality and integrity impacts. The vulnerability (CWE-346) exploits improper validation of request origins within the Chromium-based browser engine and requires user interaction to trigger. No public exploit code has been identified at time of analysis, and Microsoft has released a patch via the MSRC update guide.
Stored Cross-Site Scripting in the Spiffy Calendar WordPress plugin (before version 5.0.9) allows an authenticated attacker holding the lowest standard WordPress role (contributor) to inject malicious script via the Event Title field. When a higher-privileged user - such as an administrator or editor - subsequently views the affected event listing, the payload executes in their browser context, enabling session hijacking, credential theft, or redirection to attacker-controlled infrastructure. EPSS is 0.15% (4th percentile) and no active exploitation has been identified at time of analysis.
Stored cross-site scripting in E-Commerce Pack versions 4.5.001 through 28082026 (Akilli Ticaret Software Technologies Ltd.) allows an authenticated low-privilege attacker to inject persistent malicious scripts that execute in other users' browsers, with a confirmed scope change affecting victim browser sessions. The CVSS S:C flag indicates impact escapes the vulnerable application boundary, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No vendor patch is available - the vendor did not respond to TR-CERT's coordinated disclosure - and no public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits contributor-level authenticated users to perform unauthorized actions beyond their intended role scope. The flaw, reported by Patchstack and classified as CWE-862 (Missing Authorization), allows low-privileged WordPress users to impact site integrity and availability without administrative consent. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Heap buffer overflow in FFmpeg's TDSC screen-capture codec decoder exposes Red Hat Enterprise Linux AI 3 and OpenShift AI deployments to denial of service or potential arbitrary code execution. The tdsc_load_cursor() function performs erroneous stride-based pointer arithmetic in two locations when rendering cursor data from crafted TDSC video, writing past a heap-allocated buffer boundary. No public exploit or active exploitation has been confirmed at time of analysis, and the upstream fix is available as FFmpeg commit 242ff799c.
Unauthenticated access to six REST endpoints on StarRocks' frontend HTTP port allows remote attackers to enumerate cluster topology, database metadata, JVM statistics, and version information without credentials, affecting all releases through 4.0.13. Five REST handler classes in the FE component override execute() directly rather than implementing executeWithoutPassword(), inadvertently bypassing the authentication gate enforced by the RestBaseAction base class. No public exploit code or active exploitation has been confirmed at time of analysis; however, the reconnaissance value of the disclosed data materially reduces the effort required for targeted follow-on attacks against the same infrastructure.
Memory corruption in the TP-Link TL-WR841N v14 embedded HTTP service allows an unauthenticated attacker with adjacent network access to trigger a buffer overflow by submitting a crafted multipart/form-data request containing an oversized boundary parameter. The confirmed impact is limited to undefined application behavior resulting from process memory corruption; TP-Link's own advisory and the CVE description both explicitly state that arbitrary code execution, information disclosure, and denial-of-service have not been demonstrated, despite those labels appearing in the CVE tags. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.
Log forging in morgan HTTP request logger middleware for Node.js (all versions prior to 1.12.0) allows unauthenticated remote attackers to inject Unicode line separator characters - U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator) - into log output via attacker-controlled token values such as the Basic auth username surfaced through the remote-user token. This causes Unicode-aware downstream log processors and SIEM pipelines to split a single HTTP request record into multiple logical entries, enabling false log injection and audit trail manipulation. This is an incomplete-fix follow-up to CVE-2026-5078, which addressed only ASCII control characters; no public exploit has been identified at time of analysis.
Komodo through version 2.3.2 leaks internal resource identifiers and pollutes its audit log because the /execute and /execute/{variant} API handlers resolve resource names and write audit records before enforcing authorization checks. Authenticated low-privileged users can enumerate internal resource identifiers they lack permission to access and inject fraudulent audit entries that falsely attribute privileged operations, undermining forensic and compliance integrity. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Prototype pollution in SvelteKit's remote form functions allows network-accessible attackers to remove methods from JavaScript object prototypes by supplying crafted, user-controlled file input path names. Affected versions are all @sveltejs/kit releases up to and including 2.69.0; the vendor released a fix in 2.69.1. No active exploitation is documented in CISA KEV, and no public exploit code has been identified at time of analysis, though the vulnerability is network-reachable and requires no authentication from the attacker.
NULL pointer dereference in TP-Link TL-WR841N v14's UPnP service allows adjacent-network attackers to crash the UPnP process by sending a specially crafted SOAP state variable query, resulting in a denial-of-service condition. The affected UPnP functionality - including device discovery and state management - remains unavailable until the process is restarted or the device is rebooted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
NULL pointer dereference in the UPnP SOAP request handler of the TP-Link TL-WR841N v14 allows an adjacent-network attacker to crash the UPnP daemon by sending a crafted SOAP action request with unexpected XML content, producing a denial-of-service condition until the service is restarted or the device rebooted. Impact is confined to UPnP functionality; the router itself continues operating. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog. TP-Link has released a firmware patch addressing this flaw.
Memory exhaustion vulnerabilities in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to crash the portal daemon within minutes by triggering unfreed heap allocations in the authentication handler. The root cause is CWE-401 (missing memory release) in src/auth.c, where intermediate buffers allocated during gateway interface lookups in client_auth() are never freed on certain code paths. No confirmed active exploitation exists and no CISA KEV listing is present, but the attack surface is inherently broad in public hotspot deployments where any connected device can trigger the vulnerable authentication flow.