Unaligned memory access in the Linux kernel netfilter synproxy timestamp adjustment code can crash the kernel or degrade performance on strict-alignment CPU architectures when synproxy is actively configured. Systems running synproxy as a SYN-flood mitigation layer on architectures such as SPARC, classic MIPS, or ARM without hardware unaligned-access emulation are exposed to remote-triggered denial of service via crafted TCP packets. No active exploitation is confirmed (absent from CISA KEV) and EPSS at 0.17% (6th percentile) indicates negligible observed exploitation probability, though the network-reachable vector warrants timely patching on vulnerable platforms.
NULL pointer dereference in the Linux kernel's EMAC (Ethernet MAC) network driver during device probe can crash the kernel, resulting in complete system availability loss on affected hardware. The fault lies in `emac_probe()` where `devm_request_irq()` is called before `dev->emacp` is mapped via `devm_platform_ioremap_resource()`, leaving a race window during initialization in which any hardware interrupt invoking `emac_irq()` will dereference a NULL pointer and trigger a kernel panic. No public exploit code exists and the vulnerability is absent from CISA KEV; patches have been released across multiple Linux stable branches.
Out-of-bounds read in the Linux kernel SCTP subsystem leaks up to four bytes of receive-buffer tail memory to remote unauthenticated attackers via a malformed INIT chunk. When an Adaptation Layer Indication parameter is sent with only its 4-byte header (omitting the mandatory 32-bit Adaptation Code Point), the kernel reads past the declared parameter boundary and copies those bytes into the state cookie of the INIT ACK response, exposing them to the peer. No public exploit has been identified and EPSS of 0.16% (6th percentile) indicates low exploitation probability, though the unauthenticated, network-accessible attack surface on any SCTP-enabled system warrants prompt patching.
Uninitialized receive buffer allocation in the Linux kernel's CAN J1939 transport layer exposes residual kernel heap memory to J1939 session participants. The function j1939_session_fresh_new() allocates a buffer without zeroing it, meaning any system running a CAN-capable Linux kernel with J1939 transport support may leak prior heap contents to peers exchanging Extended Transport Protocol (ETP) messages. No public exploit has been identified at time of analysis, and EPSS sits at 0.16% (6th percentile), consistent with a low-exploitation-probability kernel information-disclosure flaw in a specialized networking subsystem.
Null-pointer dereference in the Linux kernel's btrfs LZO decompression path can crash the kernel when reading a crafted compressed extent, causing a denial-of-service. Kernels in the range starting at commit a6e66e6f8c1b685e11b778bef614480a9c1a5278 through the two fix commits are affected across multiple stable branches (5.15 and later). No public exploit code or CISA KEV listing exists at time of analysis; the EPSS score of 0.15% (5th percentile) confirms this is not yet being exploited at scale. Exploitation requires the attacker to introduce a malformed btrfs filesystem image with LZO-compressed extents that the kernel then reads.
Deadlock in the Linux kernel's iomap subsystem allows local attackers to cause a denial of service by exhausting the shared bioset used by both iomap_split_ioend and its input bios. The circular dependency in bioset allocation halts I/O completion on iomap-backed filesystems (XFS, ext4 direct I/O) and can hang the affected system. No active exploitation has been confirmed (not in CISA KEV) and the EPSS probability is very low at 0.15% (5th percentile), but the impact on availability is total for the affected I/O path.
Unauthenticated access to the getSysStatusCfg handler in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes a broad set of sensitive device data - including WiFi encryption keys, SSID, WAN/LAN IP addresses, firmware version, serial number, and connected client statistics - to any attacker with network reachability to the management interface. The exposure of raw WiFi key material is notably more impactful than a typical status-read disclosure: recovered credentials can be used to join the wireless network and pivot to LAN-side targets. No public exploit or active exploitation has been identified at time of analysis, though the attack is fully automatable via a single crafted POST request.
Broken access control in the Simple Payment WordPress plugin (versions 2.5.2 and below) allows unauthenticated remote attackers to perform unauthorized actions affecting payment integrity. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and the High integrity impact (I:H) with no confidentiality or availability impact suggests attackers can manipulate payment-related functionality - such as bypassing payment verification or altering payment states - without holding any WordPress account. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated denial of service in Smush Image Compression and Optimization plugin (versions ≤ 4.2.0) allows any remote attacker to exhaust WordPress server resources without credentials or user interaction. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms trivial, unauthenticated network exploitation with high availability impact, making every site running an affected version an easy target for sustained disruption. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity means exploitation requires minimal skill.
SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-complexity conditions, to read and manipulate backend database contents - yielding high confidentiality and integrity impact with no availability disruption. Both the commercial (Pro) and community (CE) editions of the OX-branded Dovecot mail server are confirmed affected per vendor CPE data and the OX advisory OXDC-ADV-2026-0003. No public exploit code has been identified at time of analysis, and the AC:H vector indicates exploitation is non-trivial and likely requires specific environmental or protocol conditions.
OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass when the identity provider omits the scope claim from token responses. Dovecot incorrectly falls back to evaluating the audience claim as a substitute for scope, accepting any token whose audience value coincidentally matches a configured scope name - regardless of what permissions that token actually grants. The flaw also silently masks IDP misconfigurations where scope issuance is entirely absent. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the CVSS score of 7.4 (AV:N/AC:H) reflects that successful exploitation yields full confidentiality and integrity access to email.
AES-GCM nonce reuse in wolfEngine before 1.4.1 allows a network-positioned passive adversary to fully recover encrypted plaintext and forge authentication tags across all TLS 1.2 and DTLS 1.2 sessions. The 8-byte explicit nonce is generated once at TLS write-key setup and never incremented per record, meaning every GCM record within a connection shares an identical (key, nonce) pair - a catastrophic misuse of authenticated encryption. AES-CCM cipher suites, TLS 1.3, and non-TLS uses of AES-GCM are explicitly unaffected; no public exploit identified at time of analysis.
Nonce reuse in wolfProvider before 1.2.2 completely breaks AES-GCM confidentiality and integrity guarantees for every TLS 1.2 and DTLS 1.2 connection using that cipher suite. Because the 8-byte explicit nonce is set once at key establishment and never incremented, every record in a session is encrypted under an identical (key, nonce) pair - the classical 'forbidden attack' condition where XORing two ciphertexts yields the XOR of the plaintexts, and the GHASH authentication key can be algebraically recovered to enable tag forgery. No active exploitation is confirmed in CISA KEV, and no public proof-of-concept has been identified at time of analysis; however, the attack is well-understood cryptography with no special tooling required beyond captured traffic.
NULL pointer dereference in the Linux kernel netfilter subsystem's xt_nat module allows a local attacker with low privileges to crash the kernel by instantiating SNAT or DNAT targets through the nft_compat compatibility layer using an unsupported bridge family, triggering a NULL dereference in nf_nat_setup_info(). Multiple stable kernel branches from 5.10 through 7.x are affected across numerous long-term support trees. No public exploit has been identified at time of analysis, and EPSS probability is very low at 0.18% (7th percentile); critically, the description itself notes the original crash was already mitigated by a prior upstream commit, making this patch a defense-in-depth hardening measure rather than a primary fix.
Stored XSS in the Amelia WordPress booking plugin (versions ≤ 2.2) allows unauthenticated attackers to persist malicious JavaScript that fires when a site administrator views the Calendar page. The attack chain exploits two compounding weaknesses: an explicit nonce-verification skip in AddBookingCommand (Command.php:186) that permits unauthenticated booking submissions, and unsafe interpolation of customer name fields into JavaScript template literals rendered via innerHTML in the FullCalendar eventContent callback (redesign/dist/index.js:199). No public exploit is confirmed at time of analysis, but the Wordfence disclosure provides sufficient technical detail for trivial weaponization.
Stored Cross-Site Scripting in the Optimole image optimization plugin for WordPress (all versions through 4.2.10) allows unauthenticated network attackers to inject persistent JavaScript payloads via the 'above_fold_images' ('a') REST API parameter. Injected scripts execute in any visitor's browser upon accessing an affected page, enabling session hijacking, credential theft, or administrative account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported the issue and a patch was confirmed in version 4.2.11.
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.1) enables unauthenticated attackers to inject persistent malicious scripts via Rich-Text Textarea fields, which execute in any visitor's or administrator's browser upon page access. The flaw originates from insufficient input sanitization at submission time and missing output escaping at render time, with vulnerable code paths confirmed across multiple plugin files including textarea.php, abstract-class-front-action.php, and admin-page-entries.php. A patched release (1.57.0.2) is confirmed available via the WordPress plugin repository changeset; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (all versions through 3.3.3) allows unauthenticated attackers to permanently inject arbitrary JavaScript into translated pages visible to all site visitors. The attack exploits a bypass of WordPress's native comment sanitization (KSES): a crafted payload using anchor and code tags is permitted by the allowlist, stored verbatim in the database, and later executed when the plugin's bundled simple_html_dom parser processes comments during page translation rendering. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Stored XSS in the LiteSpeed Cache WordPress plugin (all versions through 7.8.1) allows unauthenticated attackers to permanently inject malicious JavaScript into comment-bearing pages by exploiting a bypass in WordPress's wp_kses sanitizer via decimal numeric character references inside permitted HTML elements. The payload persists in the database and executes in every subsequent visitor's browser, creating session-hijacking, credential-theft, and site-defacement opportunities at scale. No active exploitation is confirmed in CISA KEV, but the changeset between tags 7.8.1 and 7.9 on the WordPress plugin repository confirms a vendor-released fix is available.
Missing authorization controls in HyperDX through 1.10.1 allow any authenticated team member to perform privileged administrative actions across team management endpoints. Three API endpoints - PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member - fail to enforce role-based access controls, enabling a low-privileged team member to rotate API keys, rename teams, and delete any team member including account owners. No public exploit has been identified at time of analysis, but the attack surface is straightforward given the explicit endpoint enumeration in the disclosure.
Remote code execution in the Rank Math SEO WordPress plugin (versions <= 1.0.276) is reachable by any user holding WordPress Author-level privileges, exploiting unsafe PHP deserialization (CWE-502) to execute arbitrary server-side code. The CVSS vector (AV:N/AC:L/PR:H) confirms the attack is network-delivered with low complexity once Author credentials are in hand, yielding full confidentiality, integrity, and availability compromise of the host. No active exploitation confirmed in CISA KEV and no public proof-of-concept has been identified in the available intelligence at time of analysis.
Stored cross-site scripting in the Customer Reviews for WooCommerce WordPress plugin (versions up to and including 5.106.0) enables unauthenticated attackers to inject persistent malicious scripts into WooCommerce product pages, where they execute in every subsequent visitor's browser. The flaw resides in the 'cr_local_forms_submit' AJAX handler, which stores unsanitized HTML review text via wp_insert_comment() without sanitization and later renders it through comment_text() without output escaping - a textbook inject-store-render CWE-79 chain. No active exploitation has been confirmed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, though the attack requires only a review form URL that the plugin routinely distributes to customers via order-reminder emails, lowering the practical barrier to abuse.
Stored Cross-Site Scripting in WP Rocket versions up to and including 3.21.0.1 allows unauthenticated remote attackers to inject persistent malicious scripts via the rocket_beacon AJAX endpoint. Any user who subsequently visits a page where the payload has been stored will execute the attacker-controlled script in their browser context. A patched release (v3.21.1) is available from WP Media, and no public exploit or active exploitation has been identified in the provided data.
Missing authorization on license management REST endpoints in Budibase server before 3.41.3 allows any low-privilege authenticated user to delete license keys or manipulate offline tokens via /api/global/license/* - degrading or disabling premium features for the entire deployment. The flaw (CWE-862) is network-exploitable with low complexity and requires only a valid user account, making it accessible to the broadest possible authenticated audience within a deployment. No public exploit or CISA KEV listing exists at time of analysis, but the attack path is trivially reproducible given endpoint documentation.
OS command injection in PowSyBl Core's AbstractLocalCommandExecutor implementations allows authenticated callers who forward untrusted data to the vulnerable public APIs to execute arbitrary shell commands as the JVM process user on both Unix and Windows hosts. Affected versions are com.powsybl:powsybl-computation-local up to and including 7.2.1; the flaw is a library-level sink, meaning any REST front-end, pypowsybl integration, or multi-tenant grid analysis platform embedding powsybl-core that passes external parameters to LocalComputationManager.execute(), ActionSimulatorTool.run(), or AmplModelRunner.run() inherits the vulnerability without modifying powsybl code. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the advisory documents multiple injection vectors with bypass paths for the previously weak escaping.
Locked asset visibility bypass in Immich through 3.1.0 exposes private photo and video assets to unauthorized viewers via shared albums and shared links. When a user locks an asset using the single-asset locking endpoint, the lock flag is not enforced by the access control logic that governs shared album and shared link contexts, leaving those assets readable through pre-existing shares. An authenticated or link-holding attacker can enumerate and retrieve locked media and its metadata without any further privilege escalation. No public exploit or CISA KEV listing has been identified at time of analysis.
Index-out-of-bounds panic in gitoxide's gix-packetline library (versions before 0.21.5) allows a malicious Git server to abort the client process during fetch operations by sending a crafted side-band packet line with an empty payload. The TextRef implementation fails to handle zero-length payloads, triggering an unconditional Rust panic that terminates the connecting client. No authentication is required on the attacker's side; the victim need only initiate a fetch or clone against a hostile server. No public exploit code or CISA KEV listing identified at time of analysis.
Insecure Direct Object Reference in R2R's conversation API through version 3.6.5 enables any authenticated user to modify conversations owned by other users by supplying arbitrary conversation identifiers. The flaw, located in the conversations router (conversations_router.py), bypasses ownership validation in both the conversation update and message append handlers, enabling cross-user data corruption and content injection. No public exploit code or active exploitation has been confirmed at time of analysis, but the attack surface is the network-accessible API layer requiring only a valid authenticated session.
Heap-based buffer overflow in openNDS before 11.0.0 allows an unauthenticated attacker positioned on the captive portal network to crash the openNDS daemon and potentially execute arbitrary code remotely. The flaw is in the redirect_to_splashpage function in http_microhttpd.c, where the query string buffer is under-allocated at QUERYMAXLEN bytes despite URL encoding expanding input by up to 1.5x - when a crafted request triggers the redirect path, the encoded data overflows the heap allocation. No public exploit identified at time of analysis, though the upstream fix commit is publicly available and exposes the exact vulnerable code path.
Prompt endpoint ownership validation failure in Quivr through 0.0.322 enables authenticated users with only read-only brain access to overwrite any system prompt by supplying a harvested prompt identifier to an unprotected write endpoint. The IDOR flaw (CWE-639) means that low-privileged authenticated accounts can silently corrupt AI brain behavior for all users of a shared brain, with no elevated privileges required beyond a valid session. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and broad scope of impact across all brain users make this a practical integrity threat in multi-tenant Quivr deployments.
Availability denial in the Linux kernel's KVM ARM64 nested virtualization stack allows a guest VM to crash the host through improper Synchronous External Abort (SEA) handling when Stage 1 translation resolves a Guest Frame Number outside configured memory slots. Affected systems must run a vulnerable Linux 6.16-era kernel on ARM64 hardware with KVM nested virtualization explicitly enabled; fixed versions are 6.18.40, 7.1.5, and 7.2. No public exploit exists and no active exploitation is confirmed; EPSS stands at 0.18% (7th percentile), reflecting the niche attack surface.
Symlink-based file clobbering in the Linux kernel's intel-speed-select daemon allows a local low-privileged user to redirect root-process writes to an attacker-chosen file by pre-positioning a symlink at the daemon's fixed /tmp pidfile path. Affected systems are those running Linux 5.18 through unpatched 6.x and 7.x branches on Intel Speed Select Technology hardware with the daemon active. No public exploit is identified at time of analysis and EPSS is low (0.17%, 7th percentile), but the attack is mechanically simple and requires only a local shell account.
Out-of-bounds vmemmap read in the Linux kernel's mm/util snapshot_page() crashes or leaks kernel memory during page isolation on memory-remove paths. The function incorrectly reads __page_2 when nr_pages > 1 rather than the correct threshold of nr_pages > 2, causing an illegal access into an adjacent, unmapped vmemmap section when an order-1 folio sits at a vmemmap section boundary. This was observed producing a kernel oops on ppc64le systems during DLPAR memory remove on a 22 TB LPAR. No public exploit is identified and EPSS is 0.17%, but the defect can cause a local denial-of-service or kernel memory disclosure. Patches are available across multiple stable kernel branches.
The BPF signed loader in the Linux kernel fails to enforce map exclusivity before performing SHA-based integrity validation of metadata maps, allowing a local attacker with BPF privileges to race a mutation of the shared map's contents after the hash is computed but before validation completes. Systems running Linux kernel between commit fb2b0e290147ba01a53dfd92cf91058c9d2ee254 and the patched stable releases (6.18.40, 7.1.5, 7.2) are affected. Exploitation bypasses the integrity guarantees of the signed BPF loader, enabling the attacker to make the check pass on stale, attacker-controlled data; no public exploit exists and EPSS is 0.17% (6th percentile), indicating low current exploitation probability.
Kernel stack disclosure and potential denial-of-service affect Linux systems with CXL hardware due to an off-by-8 size constant in the CXL RAS capability subsystem introduced in Linux 6.2. A local user who can trigger a CXL AER uncorrectable error and read tracefs can obtain up to 448 bytes of adjacent kernel stack data - potentially including code pointers and sensitive in-flight values - from the tracefs ring buffer. No public exploit identified at time of analysis; EPSS at 0.17% (6th percentile) reflects the niche CXL hardware dependency and local-only attack vector.
Cross-user thread enumeration in the Mastra AI framework through version 1.63.0 allows authenticated low-privilege attackers to read conversation histories and metadata belonging to other resource owners via the memory API. The ownership validation in GET /api/memory/threads is silently disabled when the `mapUserToResourceId` callback is omitted from server configuration, creating a no-op authorization gate (CWE-862). No public exploit code or CISA KEV listing exists, but the CVSS 4.0 score of 7.1 reflects the high confidentiality impact achievable with only a valid authenticated session.
Reflected cross-site scripting in Crocoblock's JetEngine WordPress plugin (all versions through 3.8.14.2) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by inducing them to follow a specially crafted URL. The scope-change component of the CVSS vector indicates that successful exploitation breaks out of the plugin's immediate context to affect the broader browser session, enabling session token theft or administrative action impersonation. No public exploit code or active exploitation has been confirmed at time of analysis; the flaw was disclosed by Patchstack.
Server-side request forgery in Budibase Server before 3.41.3 allows authenticated low-privileged users to abuse the query import endpoint, directing the server to fetch arbitrary attacker-supplied URLs - including cloud instance metadata endpoints such as AWS IMDSv1 (169.254.169.254) and equivalent GCP and Azure services. The attack is network-reachable with low complexity and no user interaction required, making it reliably exploitable by any authenticated Budibase user in cloud-hosted deployments where temporary credentials are accessible via metadata APIs. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Server-Side Request Forgery in Budibase Server self-hosted deployments exposes internal services on the RFC 6598 shared address space (100.64.0.0/10) by omitting that range from the default SSRF blacklist (DEFAULT_BLACKLIST) used for REST datasource query preview requests. Authenticated users holding the Builder role can submit a crafted POST /api/queries/preview request targeting a reachable host in 100.64.0.0/10, causing the Budibase server to proxy the request and return the internal service response through the preview flow, potentially exposing confidential internal data. No released patch has been identified; exploitation requires Builder-role access and a self-hosted deployment without a custom BLACKLIST_IPS override. No public exploit or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow and null pointer dereference vulnerabilities in the PLANET GS-4210-16P2S managed PoE switch firmware (all versions before 3.441b260626) allow a remote authenticated attacker to crash the CGI-based web management service by submitting crafted POST requests to RADIUS server configuration handlers. The `web_radiusSrv*_post` handler family in `/cgi-bin/dispatcher.cgi` copies user-controlled parameters into fixed-size stack buffers without bounds checking and dereferences `radName`/`radIp` pointers without confirming their presence. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis; a vendor-released firmware patch is available.
Stack-based buffer overflows in PLANET GS-4210-16P2S managed switch firmware before 3.441b260626 allow a remote administrator to crash the web management interface by sending crafted HTTP POST requests to /cgi-bin/dispatcher.cgi. More than 30 named CGI handler functions - spanning VLAN, SNMP v3, ACL, AAA, DHCP, STP, PoE, and cable diagnostics subsystems - copy attacker-supplied POST parameters into fixed-size stack buffers without length validation. The confirmed impact is denial of service of the web management service; the vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis, though a vendor patch is available.
Stack-based buffer overflow vulnerabilities in the PLANET GS-4210-16P2S managed PoE switch web management interface allow a remote authenticated attacker to crash the CGI process and disrupt web-based device administration. Three separate POST parameter handlers in /cgi-bin/dispatcher.cgi - processing usrPass, enbPass, usrName, and usrPass - copy user-supplied input into fixed-size stack buffers without bounds validation, triggering CWE-121 conditions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; impact is confined to denial of service against the web management plane.
Null pointer dereference in PLANET GS-4210-16P2S managed switch firmware before 3.441b260626 allows remote authenticated attackers to crash the web management interface by sending a crafted request. The web_poe_alive_rmtip_post handler in /cgi-bin/dispatcher.cgi dereferences the rmtIP POST parameter without first validating its presence, meaning a missing parameter is dereferenced as NULL, faulting the CGI process and rendering the web management interface unavailable. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, though the trigger is trivially simple - a single omitted parameter - for any attacker already holding administrative credentials.
Unauthenticated access to Spring Boot Actuator management endpoints in Zipkin through 3.6.1 exposes sensitive operational data and configuration controls on the same port as the tracing API. Remote attackers with network reach to the Zipkin API port can read environment variables, bean configurations, and storage backend credentials via endpoints such as /actuator/env and /actuator/beans, or silently suppress security-relevant logging by modifying log levels via /actuator/loggers. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms low-complexity, unauthenticated remote exploitation; no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Path traversal in SiYuan's asset.upload MCP tool before v3.8.1 allows an attacker to exfiltrate arbitrary host files - including SSH keys and credentials - by supplying absolute paths that bypass workspace boundary validation. The attack is delivered via prompt injection against an AI Agent connected to SiYuan's MCP server, meaning exploitation depends on an AI agent processing attacker-controlled content. No public exploit or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact (CVSS 4.0: 6.9) reflects the potential to read any file the SiYuan process can access.
Uncontrolled payload size acceptance in SvelteKit's remote form function handler allows unauthenticated remote attackers to crash the underlying Node.js process by submitting oversized POST payloads. All @sveltejs/kit versions prior to 2.69.1 are affected; no authentication or special configuration is required to trigger the crash. Repeated exploitation can sustain denial-of-service against the application process; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in MongoDB's MongoSQL Transition Readiness Tool allows any authenticated BI Connector query issuer to inject arbitrary HTML markup into operator-generated reports by embedding script payloads in query strings that the BI Connector logs verbatim. When an operator later generates an HTML report from affected logs and opens it in a browser, the injected markup executes, potentially disclosing other users' logged query text and usernames to attacker-controlled infrastructure or presenting spoofed content to the operator. No public exploit code has been identified and no CISA KEV listing exists at time of analysis; the required two-step operator interaction substantially limits opportunistic exploitation.
Unauthenticated information disclosure in WWBN AVideo through version 30.0 exposes user registration statistics via two unprotected PHP endpoints. The report4.json.php and report4.1.json.php files return daily and cumulative user-registration counts to any remote requester without authentication or session validation. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog; however, its trivial exploitation path and network accessibility make it easy for any actor who can reach the server to enumerate platform growth data.
Blind SQL injection in the DP Calendar Joomla extension (versions 5.5.0 through 10.11.2) enables authenticated users holding article update permissions to extract Joomla database contents by saving a crafted article when the DP Calendar content plugin is active. Reported by the Joomla security team and scored CVSS 4.0 6.9, the flaw yields high confidentiality impact but is constrained by a high-privilege prerequisite. No public exploit code or CISA KEV listing has been identified at time of analysis.
Secure boot bypass in IGEL OS 12 (before 12.9.0/12.8.3 LTS) and IGEL OS 11 (before 11.11.150) allows physically present attackers to obtain a root shell by exploiting GRUB's fail-open signature verification behavior. Placing an empty, unsigned file named igel.conf on any GRUB-accessible partition causes the bootloader to drop into an interactive GRUB prompt instead of halting, from which the attacker boots the device's own kernel with attacker-controlled command-line arguments, unlocking the disk. The attack leaves TPM PCR values unaltered - defeating attestation-based detection - and was publicly detailed at DEF CON 34; no active exploitation confirmed in CISA KEV at time of analysis.