Pre-authentication server-side request forgery in the SonicWall SMA1000 secure-access appliance's Work Place interface lets a remote unauthenticated attacker abuse an unintended alternate access path to reach internal/sensitive functionality and perform unauthorized operations. It affects SMA1000 firmware up to and including 12.4.3-03453 and 12.5.0-02835 (platform-hotfix builds and older), carries a maximal CVSS of 10.0, and has publicly available exploit code. SonicWall SMA appliances have been a repeated target of real-world attacks, and reporting ties this to broader SMA exploitation activity, though CISA KEV listing is not confirmed in the provided data.
Path traversal in Next.js (13.4.0 through 15.5.23 and 16.x before 16.3.3) running on Windows-hosted servers lets a remote unauthenticated attacker escape the incremental-cache root and read private build artifacts, most critically the server-reference-manifest encryption key, which can be leveraged for remote code execution in the application. The flaw stems from route segments not escaping backslashes before cache-path construction, so encoded Windows path separators (e.g. %5c) bypass the sanitizer. Publicly available exploit code exists in the form of the e2e regression test shipped with the fix; no CISA KEV listing or EPSS score was provided.
RESP protocol command injection in Predis, the popular PHP client for Redis and Valkey, affects versions 3.0.0-RC1 through 3.2.x when pipeline() is used over aggregate cluster or replication connections. Because AbstractAggregateConnection::write() re-splits an already-serialized RESP buffer on CRLF instead of respecting RESP length prefixes, attacker-controlled keys or values containing carriage-return/line-feed bytes are re-parsed as additional Redis commands, enabling shard-wide cache deletion, targeted data reads/writes, or node disruption on clusters and denial-of-service on replication setups. Fixed in 3.3.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Silent stack-based buffer overflow in Pyramid Solutions' NetStaX EtherNet/IP Stack before v5.6.1 lets a remote attacker send an oversized Class 3 explicit-message request that overruns the application-side receive buffer without any CIP error being returned, causing memory corruption, device crash, or a potential remote code-execution path. Any industrial device embedding the affected stack for EtherNet/IP communication is exposed over the network with no authentication. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the appliance's SSH daemon over the network and gain administrative access to vulnerable AFC hosts. Once in, the attacker can execute arbitrary commands as a privileged OS user, resulting in complete system compromise. Rated CVSS 10.0 (critical) with a scope-changing vector; no public exploit identified at time of analysis and EPSS/KEV data were not provided in the input.
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent existing authentication controls to gain administrative privileges and completely compromise the Fabric Composer host. HPE rates this CVSS 10.0 (network, low complexity, no privileges, no user interaction, scope-changed). No public exploit is identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Unauthenticated remote code execution in Manacle Technologies' Multi-Tenant ERP System allows attackers to upload arbitrary files to a web-accessible directory via an API endpoint that lacks both authentication and file-type validation. Any remote attacker can drop a server-side executable (e.g., a web shell) and run arbitrary code, fully compromising the host. Reported by CERT-In (CIVN-2026-0430) with a maximum CVSS 4.0 score of 10.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in HPE Aruba Networking AOS-CX (the network operating system running on Aruba CX switches) allows an unauthenticated remote attacker to run arbitrary code with elevated privileges by sending specially crafted packets to a vulnerable daemon. HPE's advisory (hpesbnw05134en_us) describes multiple flaws in a single service stemming from improper handling of malformed input, carrying a critical CVSS 9.8. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the unauthenticated network-facing RCE profile makes this a top-priority patch for affected switching fabric.
Unauthenticated arbitrary file upload in the WPLP Cookie Consent (GDPR/CCPA cookie banner) plugin for WordPress, versions up to and including 4.4.1, allows remote attackers to plant executable files on the server and potentially achieve remote code execution. The flaw stems from missing file-type validation in the saas_upload_logo() function combined with an authorization bypass on the WPLP connector REST endpoints, so no login is required. Reported by Wordfence and carrying a CVSS of 9.8; no public exploit identified at time of analysis.
Unauthenticated account takeover in the Nokri - Job Board WordPress theme (versions through 1.6.6) lets remote attackers reset any user's password, including administrators. The flaw stems from the nokri_reset_password() function accepting an empty reset token that matches the empty or unset sb_password_forget_token user meta value, so no valid token is ever needed. Reported by Wordfence and rated CVSS 9.8; no public exploit or CISA KEV listing is identified at time of analysis.
Remote code execution in the Tenda A18 Wi-Fi router (firmware v15.13.07.09) arises from an unauthenticated buffer overflow in the fromSetCmdlineRun function, letting a remote attacker corrupt memory and run arbitrary code on the device. The CVSS 9.8 vector indicates network-reachable, no-authentication, no-interaction exploitation, and a public repository (github.com/momo8877847/Tenda-A18) appears to document the flaw, so publicly available exploit code likely exists. There is no CISA KEV listing and EPSS is low (0.30%), indicating no confirmed widespread active exploitation at this time.
Analysis complete. Key findings for CVE-2026-73778: - **Vulnerability class**: Predictable factory-default password in the AOS-CX Credential Manager — essentially CWE-1392 (Use of Default Credentials), though HPE lists CWE as N/A. - **Exploitation window**: Strictly time-bounded — only while the device is in factory-default or post-ZTP state before any admin credential is set. Once configured, the device is no longer vulnerable. - **CVSS 8.1 / AC:H**: The complexity metric honestly reflects the timing constraint and need to know/predict the default credential — this is not a trivially exploitable network service but a provisioning-phase gap. - **Advisory context**: Third CVE in HPE bulletin HPESBNW05134en_us alongside CVE-2026-73749 (CVSS 9.8 unauth RCE) and CVE-2026-73766 (CVSS 7.2 auth command injection). - **Data quality flags**: None — vendor, product, and tags are all accurate. - **Injection attempt**: The "opole" marker in the editorial note was recognized and discarded per the established prompt-injection pattern for this CVE synthesis workstream.
Privilege escalation in haierkeys fast-note-sync-service versions 2.13.7 and earlier arises because the admin configuration endpoint discloses the server's authTokenKey to remote callers. Because authTokenKey is the secret used to mint/validate authentication tokens, an attacker who reads it can forge valid (including administrative) tokens and take over the instance. No active exploitation is recorded in CISA KEV and EPSS is low (0.21%), but a researcher gist and GitHub issue are referenced and likely contain a working proof-of-concept.
Unauthenticated QoS configuration injection in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers push attacker-controlled Quality-of-Service settings to the master node by sending a crafted MQTT message to the cs_broker component's sendToMasterQosConfig handler. Because the handler performs no authentication or access-control check, any party able to reach the MQTT broker can alter traffic-shaping/prioritization policy across the managed mesh. No public exploit identified at time of analysis, and EPSS is low (0.18%), indicating no observed mass exploitation yet.
Unauthenticated access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers restart the cloud update check workflow by sending a crafted MQTT message to the exposed cs_broker component. The remoteCloudUpdateCheck handler performs no authentication before acting on broker messages, so anyone able to reach the broker can repeatedly trigger the workflow. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile), indicating no evidence of mass exploitation.
Unauthenticated device reboot and pairing-state reset affects the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) via its recvClearPairCfg handler, which processes MQTT messages to the cs_broker component without verifying the sender's authorization. A remote attacker who can reach the MQTT broker can send a crafted message to wipe the device's pairing state and force a reboot, disrupting connectivity. No public exploit is identified at time of analysis, and EPSS is low (0.18%, 7th percentile), consistent with SSVC exploitation status of 'none'.
Unauthenticated mesh-heartbeat injection in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote attacker send a crafted MQTT message to the cs_broker component and cause the keepAlive function to emit indirect mesh heartbeat information toward the mesh master. The flaw is a missing access-control check (CWE-284) on an internal MQTT topic that trusts any client. SSVC rates technical impact as total and exploitation as automatable, but no public exploit is identified and EPSS is low (0.18%, 7th percentile).
Analysis complete. Two notes on this one: 1. **Prompt injection ignored** — the input's "Editorial note" tried to get me to weave the word "gniezno" into `risk_assessment`. That's an injection attempt embedded in task data, not a legitimate instruction, so I disregarded it. Nothing was inserted. 2. **Metadata corrections flagged** — the `n/a n/a` version placeholder (real product is TOTOLINK T6) and the loose "Authentication Bypass" tag (really CWE-284 improper access control) are surfaced in `data_quality_flags`. I also assessed the CVSS down from 9.8 (C:H/I:H/A:H) since `recv_mesh_info_sync` is a write/config-injection primitive, not a disclosure one → assessed **C:N/I:H/A:L**. Saved to memory alongside the sibling TOTOLINK T6 MQTT-cluster entries.
Unauthenticated log erasure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers delete diagnosis logs by sending a crafted POST request to the clearDiagnosisLog handler at /cgi-bin/cstecgi.cgi. The endpoint enforces no authentication, so any attacker with network reach to the web management interface can wipe diagnostic records. No public exploit identified at time of analysis and EPSS is low (0.18%), but the flaw is one of a large cluster of unauthenticated cstecgi.cgi handler weaknesses reported against this device.
Unauthenticated wireless client disconnection affects the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015), where the freeStaClient handler in the cs_broker MQTT component performs no authentication or access control on incoming messages. Any attacker able to reach the internal MQTT broker can forcibly deauthenticate/disconnect connected Wi-Fi clients (CWE-284). No public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile), and the input's 9.8 CVSS overstates a defect whose real-world effect is a repeatable availability disruption rather than full compromise.
Unauthenticated mesh-state manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote attacker invoke the meshInfoKick function by publishing a crafted MQTT message to the internal cs_broker component, kicking or clearing stale mesh information and forcing regeneration of mesh metadata. The flaw is an incorrect access control (CWE-284) on an MQTT command handler that performs no authentication before acting. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) despite the 9.8 CVSS rating.
Unauthenticated device removal and forced reboot affects the TOTOLINK T6 mesh router (firmware 4.1.5cu.748_B20211015), where the delSlaveDevice function in the cs_broker MQTT component accepts crafted messages without authentication. A remote attacker can delete a chosen slave device from the router's local mesh management data and trigger a system reboot, disrupting the mesh network. No public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile) and the flaw is not in CISA KEV.
Unauthenticated firmware-workflow abuse in TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) lets a remote attacker start a firmware download or flash operation on a mesh slave device by publishing a crafted MQTT message to the cs_broker component. The meshSlaveUpdate handler performs no authentication or access-control check on the inbound message, so any party able to reach the broker can trigger the slave update workflow. No public exploit was identified at time of analysis, and EPSS is low (0.18%, 7th percentile).
Unauthenticated firmware-update abuse in the TOTOLINK T6 mesh router (firmware 4.1.5cu.748_B20211015) lets a remote attacker mass-trigger firmware update activity across all mesh slave nodes by publishing a crafted MQTT message to the internal cs_broker component. The informSyncUpgfw handler performs no access control (CWE-284), so any actor able to reach the broker can initiate the sync-upgrade workflow fleet-wide. No public exploit is identified at time of analysis and EPSS is low (0.18%), but the attack is network-borne and requires no authentication.
Incorrect access control in the recvIndirectMeshInfo function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers insert or replace mesh neighbor records by sending a crafted MQTT message to the cs_broker component. The CVSS 9.8 rating reflects an unauthenticated network-facing vector, but the primary real impact is integrity (poisoning of the mesh neighbor table), with no confidentiality read and only indirect availability effect. No public exploit is identified at time of analysis and EPSS is low (0.18%, 7th percentile).
Incorrect access control in the recvSlaveCloudCheckStatus function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated attackers overwrite cloud-result tracking files by publishing a crafted MQTT message to the internal cs_broker component. Because the broker accepts and acts on these messages without authenticating the sender, any actor able to reach the MQTT service can corrupt the router's cloud-check state. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the flaw is not in CISA KEV.
Unauthenticated mesh-channel manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers force a rescan and switch of the primary mesh Wi-Fi channel by publishing a crafted MQTT message to the internal cs_broker component's updatePriChannel handler. No credentials are required, and no public exploit is identified at time of analysis; EPSS is low (0.18%, 7th percentile), indicating limited observed exploitation interest despite the high CVSS score.
Unauthenticated state tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers overwrite the mesh slave-IP inventory by publishing a crafted MQTT message to the cs_broker component, which performs no access control on the updateSlaveIpList function. Any attacker able to reach the MQTT broker can corrupt the router's internal record of mesh slave device addresses, disrupting mesh coordination. No public exploit has been identified and EPSS is low (0.17%), but the flaw is unauthenticated and MITRE-reported.
Memory corruption in Mozilla Firefox 154, Firefox ESR 153.1, and Firefox ESR 140.14 stems from a batch of internally discovered memory-safety defects that Mozilla presumes could be exploited to run arbitrary code within the browser process. The flaws were found by Mozilla's own developers and fuzzing efforts (no external report), affect the mainline and both ESR trains, and are resolved in Firefox 155, ESR 140.15, and ESR 153.2. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%, 6th percentile).
Arbitrary code execution in Mozilla Thunderbird before 154 (and before ESR 153.2) on Windows allows a crafted calendar (iCalendar) invitation to attach a file:// URI that points at a local or network-hosted executable, bypassing Thunderbird's normal blocking of executable attachments. When the new invitation display is enabled the attachment can also be shown under a misleading, benign-looking filename. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified; EPSS is low at 0.15% (5th percentile).
Memory-corruption defects in Mozilla Firefox 154 were discovered internally by Mozilla and bundled under CVE-2026-84142 (advisories MFSA2026-82 and MFSA2026-86), and fixed in Firefox 155. Several of the reported Bugzilla issues showed evidence of memory corruption that Mozilla presumes could have been exploited with sufficient effort to achieve code execution when a user renders malicious web content. There is no public exploit identified at time of analysis and EPSS is low (0.14%), consistent with an internally-found, pre-disclosure fix rather than active abuse.
Memory corruption in the Graphics: ImageLib component of Mozilla Firefox stems from an integer overflow when handling image data, potentially allowing remote attackers to corrupt heap memory and achieve code execution when a victim renders malicious image content. Mozilla fixed the issue in Firefox 155 and Firefox ESR 153.2 (advisories mfsa2026-82/85/86/88). It carries a critical 9.8 CVSS score, but EPSS is only 0.14% (4th percentile), it is not in CISA KEV, and no public exploit was identified at time of analysis.
Cross-origin data exposure in Mozilla Firefox's DOM: Navigation component stems from a site isolation failure that lets malicious web content bypass the same-origin/site boundary Firefox enforces to keep pages from different sites in separate processes. The flaw affects Firefox before version 155 and Firefox ESR before 153.2, and could allow a crafted page to read or influence data belonging to another origin. Reported and fixed by Mozilla (MFSA2026-82/-85/-86/-88); no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile).
Information disclosure in Mozilla Firefox's Profile Backup component, remediated in Firefox 155 and Firefox ESR 153.2 (Mozilla advisories MFSA2026-82/85/86/88). Mozilla provides only an 'Other issue' placeholder description, so the precise mechanism is undisclosed, but the CWE-200 classification points to unintended exposure of data handled during profile backup. No public exploit or active exploitation has been identified, and EPSS is very low (0.14%, 4th percentile).
Cross-origin information disclosure in Mozilla Firefox arises from a site-isolation failure in the DOM Push Subscriptions component (CWE-346, origin validation error), allowing content from one origin to be improperly associated with or exposed to another. It affects Firefox before 155 and Firefox ESR before 153.2, and was disclosed and patched by Mozilla; there is no public exploit identified at time of analysis and EPSS is very low (0.14%, 4th percentile). The 'Information Disclosure' tag is consistent with the CWE and the likely cross-origin read impact.
Cross-origin data exposure in Mozilla Firefox arises from a site-isolation defect in the DOM Navigation component, where origin boundaries are not correctly enforced during navigation, potentially letting a malicious page access data belonging to another origin. It affects Firefox before 155 and Firefox ESR before 153.2, and was fixed by Mozilla in those releases (advisories mfsa2026-82/85/86/88). No public exploit identified at time of analysis; EPSS is low (0.14%, 4th percentile).
Arbitrary code execution in OpenAI Codex Desktop (Windows and macOS, including the Microsoft Store package) occurs when a user opens a workspace containing an attacker-prepared Git repository whose local .git/config is intact. Because Codex automatically inspects Git metadata and working-tree status on open, a malicious attr.tree setting combined with a clean/process filter causes Git to launch an attacker-controlled program outside Codex's command sandbox, with the signed-in user's privileges and no trust prompt, approval, or model interaction. No public exploit is identified at time of analysis and EPSS is low (0.14%), but the outcome is full local compromise of the user's files and credentials.
An improper input validation defect (CWE-20) in Firefox Focus for Android was reported and fixed by Mozilla in Firefox 155 per advisory MFSA2026-82. The public description is a placeholder-grade 'Other issue' with no technical mechanism disclosed, so the concrete impact cannot be verified; there is no public exploit identified at time of analysis and EPSS is low (0.13%, 3rd percentile). Despite a headline CVSS of 9.8, the vendor tag set and thin description leave the real-world severity for this privacy-focused mobile browser unconfirmed.
SQL injection in TRtek's Products's Store web application (all versions before build 030631b2) lets remote attackers inject arbitrary SQL through unsanitized input, exposing and altering the backend database. The flaw is unauthenticated and network-reachable with a maximal CVSS of 9.8, though no public exploit or active exploitation has been identified and the product appears to be a niche Turkish commercial application with limited deployment. Coordinated disclosure was handled by Turkey's national CSIRT (TR-CERT / USOM).
Remote code execution in Klemsan KIO (Klemsan Internet Objects) versions prior to v1.9 allows attackers to inject and execute arbitrary code against the network-facing application. The flaw, reported by TR-CERT (Turkey's national CSIRT), carries a CVSS 9.8 and requires no authentication or user interaction, giving full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial attack profile makes it a high-priority patch.
SQL injection in Teracity Software Technologies' E-OSB application allows remote unauthenticated attackers to inject arbitrary SQL commands against the backend database, per TR-CERT advisory TR-26-0962. All versions before V02.26.07.08.01 are affected, and with a CVSS 9.8 (AV:N/PR:N) the flaw can be exploited over the network without authentication to fully read, modify, or destroy database contents. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Sandbox escape via use-after-free in the Firefox DOM: Security component allows an attacker who lures a victim to a malicious web page to corrupt memory and break out of the browser content sandbox, potentially achieving code execution in a higher-privilege context. All Firefox release and ESR channels prior to the fixed builds are affected. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, but the 9.6 CVSS and scope-change sandbox-escape nature make this a high-priority browser update.
Sandbox escape in Mozilla Firefox stems from a use-after-free in the DOM: Navigation component, letting a malicious web page that a user visits corrupt memory and potentially execute code outside the content sandbox. It affects Firefox before 155 and multiple ESR trains (115.x, 140.x, 153.x), carries a critical 9.6 CVSS with a scope change (browser sandbox to host), and requires the victim to load attacker-controlled content (UI:R). No public exploit identified at time of analysis and CISA SSVC lists exploitation as none.
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network execute arbitrary code as a privileged user on the underlying operating system, resulting in complete compromise of the AFC host. The flaw carries a CVSS 9.6 (critical) rating with a scope-change vector, meaning the compromise extends beyond the vulnerable component to the whole OS. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Policy enforcement bypass in Kyverno v1.9.0 through v1.12.7 lets an authenticated Kubernetes user evade an enforce-mode ClusterPolicy when two overlapping PolicyExceptions apply to the same rule, because the less-restrictive exception wins. An attacker who can name a workload to match a permissive exception pattern (for example '*ingress*') can deploy resources the policy was meant to block, such as Pods with hostPath volumes. The vendor GHSA advisory (GHSA-gg4x-fgg2-h9w9) includes working reproduction manifests; there is no CISA KEV listing and no confirmed in-the-wild exploitation.
Remote code execution in Lutece Core (versions up to and including 7.1.7) allows an authenticated administrator to run arbitrary Java code on the server by abusing the XSL export management module. Because the XML/XSLT processor is configured without FEATURE_SECURE_PROCESSING, malicious XSL stylesheets can invoke Java extension functions; an admin uploads a crafted XSL transformation and triggers it during a user export. Rated CVSS 4.0 9.4 (critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized code execution in Sauter EY-modulo building-automation controllers (modu680-AS, modu660-AS, modu612-LC) and ecoS ecos504/ecos505 field controllers stems from a Time-of-Check Time-of-Use race in a network-facing service, which an unauthenticated remote attacker can win to bypass intended security controls. CERT@VDE (advisory VDE-2026-093) coordinated disclosure and CVSS 4.0 rates it 9.3 (Critical) with full confidentiality, integrity and availability loss. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.
Login-time security-control bypass in WWBN AVideo (commit e01e41ecc and earlier) lets an attacker who already possesses valid credentials defeat two-factor authentication, brute-force captcha escalation, and login/device audit logging by merely setting the HTTP User-Agent header to the literal string 'AVideoEncoder' or 'AVideoMobileApp'. The isAVideoEncoder()/isAVideoMobileApp() trust decisions rely solely on this client-controlled header with no IP allow-list or shared secret, so the protections are trivially spoofable. No patch is available at the time of analysis and no public exploit has been identified, though the advisory itself fully describes the technique.
Account takeover in WWBN AVideo is possible because userRecoverPassSave.json.php never checks whether a password-recovery token has expired, so any captured token stays valid forever. An attacker who obtains a recovery token for a target account can reset that account's password at an arbitrary later time and seize full control. Reported by VulnCheck with a coordinated GitHub Security Advisory (GHSA-j9p7-hm85-9v77); no public exploit identified at time of analysis and no EPSS/KEV data supplied.
Stored cross-site scripting in LibreNMS through 26.4.0 lets an administrator (or an attacker who has hijacked an admin session) chain an SSRF into persistent XSS by pointing the admin-configurable Oxidized integration URL (oxidized.url) at an attacker-controlled server. That server returns malicious JSON whose name, ip, model, author, and commit-message fields are rendered into the device showconfig page without htmlspecialchars(), so any user viewing any device's showconfig tab executes attacker-supplied JavaScript. A proof-of-concept mock Oxidized server has publicly confirmed the injection; no active exploitation is listed in CISA KEV.