Out-of-bounds memory write in libsolv crashes RPM-based package manager tools (dnf, yum, zypper) when processing a corrupted or specially crafted .solv repository cache file. The root cause is an absent array-index bounds check on directory-id values read from compressed filelist data during .solv file rewriting - but because the out-of-bounds write stores only a fixed, non-attacker-controlled value, the vendor explicitly rules out arbitrary code execution, confining impact to denial of service. No public exploit has been identified and no active exploitation is confirmed; note that the 'RCE' metadata tag conflicts directly with the description and appears to be erroneous.
Parameter/argument delimiter injection in Microsoft Edge (Chromium-based) enables network-based code execution by an unauthenticated remote attacker who can induce a user to interact with malicious content. The flaw, classified under CWE-141, stems from insufficient sanitization of delimiter characters in parameter or argument handling within the browser, potentially allowing injected values to alter command or function execution semantics. Tags associated with this CVE include 'Authentication Bypass', suggesting the delimiter injection may also facilitate circumventing browser-level or web-application authentication controls in certain contexts. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Prompt injection in Microsoft Edge for iOS exposes users to network-based spoofing attacks through Microsoft Edge's AI/Copilot integration. Malicious web content can embed adversarial LLM prompts that, when processed by Edge's AI features, manipulate the model to produce spoofed or misleading output - potentially impersonating trusted content or bypassing AI-enforced guardrails. The CVSS vector (PR:N/UI:R) indicates no attacker authentication is required, but a user must interact with Edge on iOS while AI features are active. No public exploit code has been identified at time of analysis, and a vendor-released patch is available via MSRC.
Incorrect authorization in Microsoft Edge (Chromium-based) allows a remote, unauthenticated attacker to disclose limited information and cause minor integrity impact by luring a user to attacker-controlled web content. The flaw stems from CWE-863, where Edge's authorization logic fails to correctly enforce access boundaries, permitting content-triggered data exposure within the browser's security context. No public exploit has been identified at time of analysis, and Microsoft has released a patch via the MSRC advisory.
Stored Cross-Site Scripting in xipblog v2.0.1 and earlier for PrestaShop allows unauthenticated remote attackers to inject persistent JavaScript payloads through the name and content parameters of ajax.php, which are written to the database without sanitization and rendered unsafely in Smarty templates. When a store administrator subsequently reviews submitted comments in the PrestaShop back office, the payload executes within the admin's authenticated browser session, enabling full store compromise including session hijacking, unauthorized admin actions, and potential exfiltration of customer and payment data. A publicly available proof-of-concept exists per SSVC data and a GitHub Gist reference; exploitation is not currently confirmed in CISA KEV.
Origin validation failure in Microsoft Edge (Chromium-based) enables unauthenticated remote attackers to bypass browser security features, resulting in limited cross-origin confidentiality and integrity impacts. The vulnerability (CWE-346) exploits improper validation of request origins within the Chromium-based browser engine and requires user interaction to trigger. No public exploit code has been identified at time of analysis, and Microsoft has released a patch via the MSRC update guide.
Stored Cross-Site Scripting in the Spiffy Calendar WordPress plugin (before version 5.0.9) allows an authenticated attacker holding the lowest standard WordPress role (contributor) to inject malicious script via the Event Title field. When a higher-privileged user - such as an administrator or editor - subsequently views the affected event listing, the payload executes in their browser context, enabling session hijacking, credential theft, or redirection to attacker-controlled infrastructure. EPSS is 0.15% (4th percentile) and no active exploitation has been identified at time of analysis.
Stored cross-site scripting in E-Commerce Pack versions 4.5.001 through 28082026 (Akilli Ticaret Software Technologies Ltd.) allows an authenticated low-privilege attacker to inject persistent malicious scripts that execute in other users' browsers, with a confirmed scope change affecting victim browser sessions. The CVSS S:C flag indicates impact escapes the vulnerable application boundary, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No vendor patch is available - the vendor did not respond to TR-CERT's coordinated disclosure - and no public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits contributor-level authenticated users to perform unauthorized actions beyond their intended role scope. The flaw, reported by Patchstack and classified as CWE-862 (Missing Authorization), allows low-privileged WordPress users to impact site integrity and availability without administrative consent. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Heap buffer overflow in FFmpeg's TDSC screen-capture codec decoder exposes Red Hat Enterprise Linux AI 3 and OpenShift AI deployments to denial of service or potential arbitrary code execution. The tdsc_load_cursor() function performs erroneous stride-based pointer arithmetic in two locations when rendering cursor data from crafted TDSC video, writing past a heap-allocated buffer boundary. No public exploit or active exploitation has been confirmed at time of analysis, and the upstream fix is available as FFmpeg commit 242ff799c.
Unauthenticated access to six REST endpoints on StarRocks' frontend HTTP port allows remote attackers to enumerate cluster topology, database metadata, JVM statistics, and version information without credentials, affecting all releases through 4.0.13. Five REST handler classes in the FE component override execute() directly rather than implementing executeWithoutPassword(), inadvertently bypassing the authentication gate enforced by the RestBaseAction base class. No public exploit code or active exploitation has been confirmed at time of analysis; however, the reconnaissance value of the disclosed data materially reduces the effort required for targeted follow-on attacks against the same infrastructure.
Memory corruption in the TP-Link TL-WR841N v14 embedded HTTP service allows an unauthenticated attacker with adjacent network access to trigger a buffer overflow by submitting a crafted multipart/form-data request containing an oversized boundary parameter. The confirmed impact is limited to undefined application behavior resulting from process memory corruption; TP-Link's own advisory and the CVE description both explicitly state that arbitrary code execution, information disclosure, and denial-of-service have not been demonstrated, despite those labels appearing in the CVE tags. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.
Log forging in morgan HTTP request logger middleware for Node.js (all versions prior to 1.12.0) allows unauthenticated remote attackers to inject Unicode line separator characters - U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator) - into log output via attacker-controlled token values such as the Basic auth username surfaced through the remote-user token. This causes Unicode-aware downstream log processors and SIEM pipelines to split a single HTTP request record into multiple logical entries, enabling false log injection and audit trail manipulation. This is an incomplete-fix follow-up to CVE-2026-5078, which addressed only ASCII control characters; no public exploit has been identified at time of analysis.
Komodo through version 2.3.2 leaks internal resource identifiers and pollutes its audit log because the /execute and /execute/{variant} API handlers resolve resource names and write audit records before enforcing authorization checks. Authenticated low-privileged users can enumerate internal resource identifiers they lack permission to access and inject fraudulent audit entries that falsely attribute privileged operations, undermining forensic and compliance integrity. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Prototype pollution in SvelteKit's remote form functions allows network-accessible attackers to remove methods from JavaScript object prototypes by supplying crafted, user-controlled file input path names. Affected versions are all @sveltejs/kit releases up to and including 2.69.0; the vendor released a fix in 2.69.1. No active exploitation is documented in CISA KEV, and no public exploit code has been identified at time of analysis, though the vulnerability is network-reachable and requires no authentication from the attacker.
NULL pointer dereference in TP-Link TL-WR841N v14's UPnP service allows adjacent-network attackers to crash the UPnP process by sending a specially crafted SOAP state variable query, resulting in a denial-of-service condition. The affected UPnP functionality - including device discovery and state management - remains unavailable until the process is restarted or the device is rebooted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
NULL pointer dereference in the UPnP SOAP request handler of the TP-Link TL-WR841N v14 allows an adjacent-network attacker to crash the UPnP daemon by sending a crafted SOAP action request with unexpected XML content, producing a denial-of-service condition until the service is restarted or the device rebooted. Impact is confined to UPnP functionality; the router itself continues operating. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog. TP-Link has released a firmware patch addressing this flaw.
Memory exhaustion vulnerabilities in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to crash the portal daemon within minutes by triggering unfreed heap allocations in the authentication handler. The root cause is CWE-401 (missing memory release) in src/auth.c, where intermediate buffers allocated during gateway interface lookups in client_auth() are never freed on certain code paths. No confirmed active exploitation exists and no CISA KEV listing is present, but the attack surface is inherently broad in public hotspot deployments where any connected device can trigger the vulnerable authentication flow.
OAuth authorization code forwarding to attacker-controlled hosts is enabled by an open redirect flaw in Twenty CRM through version 2.35.0, where the OAuthPropagatorController.propagateOAuthCallback endpoint accepts the state query parameter as an unvalidated redirect URL. Instances running with IS_MULTIWORKSPACE_ENABLED disabled are specifically vulnerable because this configuration bypasses the domain validation logic that would otherwise restrict redirect targets. No active exploitation has been confirmed in the CISA KEV catalog and no public proof-of-concept code was identified in the provided data, but the attack requires only a crafted link and passive victim interaction.
Capture-replay authentication bypass in the Forminator WordPress plugin (versions up to and including 1.57.1) allows unauthenticated network-accessible attackers to achieve low-level integrity impact against affected installations. Reported by Patchstack under CWE-294, the flaw enables replay of captured authentication or nonce tokens, potentially allowing unauthorized form actions or integrity-affecting operations without valid credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Server-Side Request Forgery in the Everest Forms WordPress plugin (all versions up to and including 3.4.4) enables unauthenticated remote attackers to force the WordPress server to issue arbitrary outbound HTTP HEAD requests to attacker-controlled URLs. The flaw resides in the plugin's upload field handling: when a form submission triggers re-rendering due to a missing required field, unsanitized POST-supplied URLs are passed directly to WordPress's `wp_remote_head()` without any domain restriction. No active exploitation has been confirmed by CISA KEV, though the zero-authentication requirement and WordPress's broad deployment footprint elevate practical risk for internal network reconnaissance and cloud metadata endpoint probing.
Authentication bypass via identity spoofing in WPDeveloper's Essential Addons for Elementor WordPress plugin (versions through 6.8.0) enables unauthenticated network attackers to circumvent CAPTCHA verification controls. The flaw, classified as CWE-290 (Authentication Bypass by Spoofing), allows an attacker to spoof identity data accepted by the plugin, defeating bot-protection mechanisms on login, registration, or other CAPTCHA-gated forms. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified; however, the low complexity and zero-privilege requirement make opportunistic abuse plausible.
Reflected XSS in the All Video Share Joomla extension (versions 1.0.0 through 4.5.0) exposes site visitors to script injection attacks when they interact with attacker-crafted URLs. Multiple user-supplied input parameters are rendered in HTTP responses without HTML encoding, providing several distinct reflected XSS entry points. No public exploit code or active exploitation has been identified at time of analysis, and no KEV listing exists.
Path traversal in houtini-lm (versions up to 2.13.2) allows an authenticated remote user to supply crafted absolute paths to the code_task_files tool, causing the server to read files outside its intended working directory. Because code_task_files forwards file contents directly to the configured LLM endpoint - which may be a remote provider such as OpenRouter - a successful traversal can silently exfiltrate sensitive files (SSH keys, environment files, cloud credentials) off the machine to a third-party service. No public exploit has been identified and the CVE has not been added to the CISA KEV catalog; an upstream fix is available in commit 35d97bca.
Cross-site request forgery in AVideo's live-channel controls endpoint allows a remote, unauthenticated attacker to silently hijack a logged-in streamer's viewer-redirect configuration. The PHP endpoint `/plugin/Live/myLiveControls.save.json.php` accepts GET requests without a CSRF token or origin check, permitting an attacker who can socially engineer a streamer to visit a malicious page to overwrite `customUrl`, `customMessage`, and `autoRedirect` settings persisted in `users.externalOptions`. Downstream impact falls on stream viewers, who can be silently redirected to attacker-controlled phishing sites or shown spoofed messages. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.1 reflects the mandatory victim-interaction requirement.
Graylog Server's system catalog entity titles API endpoint leaks protected database fields - including user password hashes - to authenticated requesters who craft custom field-selection parameters. PR:L authentication is required, and permission checks are partially enforced: regular users are limited to their own password hash, but any user holding an admin role can extract password hashes for every account in the system. No public exploit or CISA KEV listing has been identified; vendor-released patch 7.1.4 is available and is the only remediation.
Dsync stream protocol command injection in OX Dovecot Pro and OX Dovecot CE allows an authenticated mail user to store crafted content that is later interpreted as dsync protocol commands when an administrator runs dsync with the stream protocol during a migration or replication. Successful injection enables modification of mailbox state on the destination server, including internal mailbox attributes that a user should not be able to manipulate directly. No public exploits are known and no CISA KEV listing exists; exploitation depends on an administrator-initiated dsync stream operation against a mailbox containing attacker-controlled content.
Stored or reflected cross-site scripting in SOY Gallery, a web-based gallery application by Tsuyoshi Saito, allows an authenticated low-privilege attacker to inject arbitrary script that executes in the browser of any logged-in user who views the affected content. The CVSS scope-change metric (S:C) confirms the impact crosses from the attacker's session into the victim's browser context, enabling session hijacking or credential theft. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Cross-site scripting in SOY Calendar (by Tsuyoshi Saito) enables a remote attacker holding a low-privilege account to inject arbitrary JavaScript that executes within the browser session of other logged-in users. The CVSS scope-change indicator (S:C) confirms the injected script breaks out of the application's own security boundary, elevating the practical risk beyond the medium base score. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored or persistent cross-site scripting in SOY Calendar by Tsuyoshi Saito allows a low-privileged authenticated attacker to inject arbitrary JavaScript that executes in other logged-in users' browsers. The CVSS scope change (S:C) confirms the payload crosses a security boundary, targeting victim sessions rather than the attacker's own context. No public exploit code or CISA KEV listing has been identified at time of analysis; disclosure was coordinated through JPCERT/CC.
Stored cross-site scripting in the MongoDB BI Connector Transition Readiness Report tool allows a low-privileged MongoDB user with write access to inject malicious script payloads into database metadata. When a second user generates and opens the resulting HTML report, the embedded scripts execute in their browser context, potentially exposing report contents or manipulating the displayed output. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the stored delivery model increases reachability beyond typical reflected-XSS scenarios.
Stored Cross-Site Scripting in the Bit Assist WordPress plugin (versions before 1.7.2) allows an authenticated administrator to inject persistent malicious scripts via the Call-To-Action feature. When other users or administrators visit affected pages, the injected payload executes in their browser context, enabling session hijacking, credential theft, or forced redirection to attacker-controlled sites. No public exploit or CISA KEV listing is confirmed at time of analysis; EPSS of 0.15% (4th percentile) reflects very low observed exploitation probability.
Use-after-free (CWE-416) in Microsoft Edge (Chromium-based) allows a remote, unauthenticated attacker to crash the browser through a crafted webpage, resulting in a denial-of-service condition. Critically, the CVE description claims code execution capability, but the CVSS vector (C:N/I:N/A:L, score 4.3) directly contradicts this - a genuine RCE would produce C:H/I:H impact in the 8-9+ range; this discrepancy should be verified against the full MSRC advisory. No active exploitation has been confirmed and no public POC has been reported; a vendor patch is available via the Microsoft Security Response Center.
Memory corruption via out-of-bounds write in OX Dovecot Pro and OX Dovecot CE's ManageSieve service allows authenticated network attackers to crash the ManageSieve process, denying all users the ability to remotely manage Sieve email filter scripts. The root cause is improper handling of extreme numeric literals during Sieve script compilation. The vendor notes that remote code execution may theoretically be achievable via the same memory corruption primitive, though no public exploit demonstrates this; no public exploits are known and the vulnerability is not listed in CISA KEV.
Server-Side Request Forgery in Synology Chat Server's webhook functionality allows remote authenticated users to probe internal or external network resources and retrieve non-sensitive information. Affected versions are all Chat Server releases prior to 2.4.5-22148. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the authenticated network attack vector and low complexity make this straightforward to exploit for any valid user of the application.
Authenticated availability disruption in OX Dovecot Pro and OX Dovecot CE allows any valid credential holder to crash the imap-hibernate service by opening many concurrent connections and sending malformed IMAP commands, triggering an intermittent out-of-bounds read (CWE-125). The crash terminates the imap-hibernate process, dropping hibernated IMAP sessions for co-hosted users and degrading service availability. No public exploit code is known and the vulnerability is not listed in CISA KEV; however, the low attack complexity means any authenticated user on a shared mail platform could attempt disruption.
Uncontrolled CPU consumption in OX Dovecot Pro and OX Dovecot CE allows authenticated IMAP users to trigger a denial of service by issuing malformed or resource-intensive IMAP LIST commands. Both the commercial (Pro) and community (CE) editions of Open-Xchange's Dovecot distribution are affected across all tracked versions per CPE data. No public exploit code has been identified at time of analysis, and the CVSS score of 4.3 reflects the authenticated-access prerequisite and limited availability impact.
Submission-login process crashes with an epoll() panic in OX Dovecot Pro and CE when the per-IP connection limit (mail_max_userip_connections, default 10) is reached, due to improper file descriptor handling (CWE-403). In high-performance mode - the default for Pro releases - the crash terminates all connections managed by the affected process, not just the triggering one, creating a broader denial-of-service for email submission. A secondary side effect of duplicate message delivery is possible when backend TLS is absent. No public exploits are known and this vulnerability is not listed in CISA KEV.
DOM-based cross-site scripting in Yamcs's /ext URL routing endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL - typically via phishing. The vulnerability exists in extension.component.ts, where URL path segments are inserted into the DOM via innerHTML without validation against legitimate custom element names, allowing injected HTML event handlers to fire. Vendor-released patches are available in yamcs-5.12.8 and yamcs-5.13.2; no public exploit code or CISA KEV listing has been confirmed at time of analysis.
Incomplete authorization fix in Vikunja v2.3.0 allows Write-level collaborators to detach a shared child project from its parent hierarchy by supplying parent_project_id: 0, bypassing the Admin permission gate introduced by the CVE-2026-35595 fix. The flaw exists in versions v2.3.0 through the latest unstable builds and is fixed in v2.4.0. A detailed, independently reproducible proof-of-concept with curl commands is publicly documented in the GHSA advisory, though no CISA KEV listing has been identified at time of analysis.
Memory disclosure in OX Dovecot Pro and OX Dovecot CE exposes uninitialized server process memory to authenticated IMAP users who send a malformed URLFETCH command. The IMAP URLAUTH extension's error-handling path fails to sanitize its response buffer, returning raw memory contents to the requesting client that may include session tokens, cached credentials, or message data from co-resident sessions. No active exploitation has been identified and no public exploits are known, though the low attack complexity for authenticated users makes insider threats and compromised accounts realistic vectors.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated low-privilege attacker to coerce the application server into issuing arbitrary outbound HTTP requests, enabling internal network enumeration and potentially pivoting to other attacks against backend infrastructure. The CVSS vector (PR:L/AV:N/AC:L) confirms this is exploitable over the network by any authenticated user without elevated permissions or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via their support portal.
Authentication bypass in OX Dovecot Pro and CE allows any host configured as a trusted proxy to impersonate arbitrary mail users without knowing their passwords, by injecting forged fields into Dovecot's internal authentication pipeline. The flaw is conditional: both a trusted proxy must be configured and the password database must honour a field permitting password-free authentication - deployments without trusted proxies are fully unaffected. No public exploit code exists and the vulnerability has not been added to CISA KEV at time of analysis.
Login process denial-of-service in OX Dovecot Pro and OX Dovecot CE allows a host designated as a trusted proxy to crash the Dovecot authentication process by injecting a NUL byte into proxy forwarding headers, disrupting subsequent login attempts for all users. The vulnerability carries a CVSS 4.3 (Medium) score with an adjacent-network vector, confining realistic exposure to deployments that explicitly configure trusted proxy hosts - a non-default setup. No public exploit is identified at time of analysis, and Open-Xchange has issued a security advisory with patch guidance.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes UPnP enablement status and parsed port-mapping rules to adjacent-network attackers. The getUPnPCfg CGI handler on /cgi-bin/cstecgi.cgi accepts POST requests without enforcing authentication, violating the access-control model for device configuration endpoints. No active exploitation has been recorded and EPSS sits at the 7th percentile, reflecting low real-world threat at this time.
Smart QoS configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows unauthenticated attackers on the same network segment to read QoS rules and configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The getSmartQosCfg function lacks any access control enforcement, exposing network prioritization policies and associated device rules without credentials. EPSS is low (0.18%, 7th percentile) and no active exploitation has been identified; however, this flaw is consistent with a documented systemic pattern of missing authentication across multiple TOTOLINK T6 CGI endpoints.
Unauthenticated disclosure of Wi-Fi scheduling rules in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any adjacent-network attacker to read the router's getWiFiScheduleCfg configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi without credentials. The CGI handler performs no access control check before returning scheduling policy data. No public exploit code or active exploitation has been identified; EPSS is 0.18% (7th percentile), consistent with limited real-world attacker interest.
Incorrect access control in the getAccessDeviceCfg handler of TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any unauthenticated device on the local network to retrieve access-device policy rules and client connection state by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CWE-284 flaw exposes MAC-address-level access control lists and client status, enabling network reconnaissance by co-located attackers. No active exploitation is confirmed (absent from CISA KEV), and EPSS at 0.18% (7th percentile) reflects minimal observed scanning activity; GitHub CVE coordination repositories are referenced but contain no confirmed public exploit code.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes AP-specific Wi-Fi scheduling rules to adjacent-network attackers. The getApWiFiSchCfg CGI function at /cgi-bin/cstecgi.cgi enforces no access control, allowing any host on the same network segment to retrieve scheduling configurations via a crafted POST request without credentials. No active exploitation or public exploit code has been identified; EPSS at 0.18% and SSVC 'Exploitation: none' both confirm low real-world priority.
Unauthenticated MAC filter rule disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 permits any LAN-adjacent device to retrieve the router's MAC address filtering policy via a crafted POST to /cgi-bin/cstecgi.cgi without credentials. The getMacFilterRules CGI handler fails to enforce access control (CWE-284), exposing firewall policy data that could assist a local attacker in MAC address spoofing to bypass network access restrictions. No public exploit code or active exploitation is identified; EPSS of 0.18% (7th percentile) reflects negligible real-world exploitation interest.