Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution within the current user's security context when a victim opens a specially crafted malicious file. The vulnerability resides in file-parsing logic (CWE-122), and successful exploitation grants full C:H/I:H/A:H impact without requiring elevated privileges on the victim's system. No public exploit or CISA KEV listing has been identified at time of analysis; Adobe has released a security advisory (APSB26-121) addressing the issue.
SEPPmail Secure Email Gateway (SEG) before 15.0.7 establishes a fully privileged session prior to completing multi-factor authentication enrollment, allowing an attacker who possesses credentials for an MFA-required but not-yet-enrolled account to bypass the second factor entirely. The flaw is a session lifecycle error - the gateway incorrectly grants access rights before the enrollment ceremony is finished, collapsing MFA to single-factor authentication for affected accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, though NCSC.ch has reported the issue, suggesting coordinated disclosure with the Swiss vendor.
Command injection in OpenVPN for Windows allows a low-privilege attacker - operating through a rogue CA combined with a configured validation script - to inject arbitrary commands via improperly quoted CreateProcess() arguments that include characters special to cmd.exe. Affected is OpenVPN prior to v2.7.7 on Windows platforms only. A successful attacker can achieve full confidentiality, integrity, and availability impact on the host running the VPN client or server. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV.
Remote code execution in n8n's Git node allows an authenticated workflow user to execute arbitrary OS commands as the n8n process user by pointing the node at a repository containing malicious git configuration. The vulnerability arises from an incomplete sanitization list that omitted the content-filter and merge-driver git configuration key families, allowing those keys to survive into git operations and trigger arbitrary command execution during routine Add, Commit, Checkout, or Pull operations. Patched versions 1.123.73, 2.35.4, and 2.36.2 are confirmed available; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the EasyMesh daemon of the TP-Link Archer AX55 v4 allows a LAN-adjacent unauthenticated attacker to crash the easymesh process and potentially achieve remote code execution on the router, provided Mesh mode is enabled. The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N) correctly constrains the attack to the local network segment with high complexity due to the Mesh mode prerequisite. TP-Link has released a patched firmware; no public exploit code or active exploitation has been identified at time of analysis.
Missing authorization on the PUT /hr/pass endpoint in vhr (through commit 03abbd3) allows any authenticated user who knows a target account's current password to change that account's password - a classic IDOR via CWE-639. The server accepts an arbitrary account ID in the request body without verifying it matches the session owner, enabling cross-account credential takeover by low-privileged insiders. SSVC flags a POC as available and assesses technical impact as total; no vendor-released patch has been identified at time of analysis.
Cross-cluster secret exfiltration in Rancher Manager before 2.15.1 allows any authenticated user with namespace-creation rights on one downstream cluster to read Project Secrets belonging to a completely separate downstream cluster. The secretsController propagates secrets based solely on the user-writable `field.cattle.io/projectId` annotation, skipping validation that the referenced project belongs to the same cluster - a classic CWE-639 insecure direct object reference pattern. No public exploit or CISA KEV listing has been identified at time of analysis; the vendor-confirmed fix is v2.15.1.
Unchecked escrow draining in 1Hive's Gardens v2 governance framework allows any low-privilege proposal submitter to siphon pool-funded buffer balances by exploiting a cancel-then-claim flow. Versions at commit 3e595f3 and prior are affected: when a streaming proposal is cancelled, cancelProposal zeroes the GDA member units but never reclaims the CFA deposit and 0.5% margin buffer parked in the StreamingEscrow, while the permissionless claim() function then forwards that entire orphaned balance to the attacker-chosen beneficiary. No patch is available as of publication, and the only on-chain fund-recovery path (drainToStrategy) is gated to dispute rejection rulings and cannot be invoked on normal cancellation or completion.
Session fixation in MISP's optional CustomAuth flow lets an attacker who pre-plants a known session identifier silently inherit a victim's fully authenticated MISP session after the victim logs in, gaining all privileges of the victim's account including access to shared threat intelligence, event data, and administrative functions. The flaw is confined to deployments explicitly configured to use CustomAuth - standard authentication modes are unaffected. Vendor patch is available at commit e2eb2f058; no public exploit identified at time of analysis.
Improper TLS certificate validation in MISP's CurlClient class allows an adjacent-network attacker to perform man-in-the-middle attacks against outbound HTTPS connections made by the MISP instance, including threat intelligence synchronization. The PHP property `CurlClient::$verifyPeer` was left uninitialized, defaulting to null, which cURL interprets as falsy and therefore disables peer certificate verification. A successful attacker can observe authentication material and exchanged threat intelligence, and inject falsified data into MISP's responses from remote services. No public exploit has been identified; SSVC rates exploitation as none at time of analysis.
Path traversal in @fastify/http-proxy before 11.6.2 permits unauthenticated remote attackers to bypass the prefix and rewritePrefix boundary controls and reach upstream paths that the proxy operator intended to keep hidden. The root cause is an asymmetry between the plain HTTP handler — which omits destination validation — and the WebSocket handler, which performs it correctly; the underlying reply-from library compounds this by only rejecting forward-slash traversal sequences, leaving backslash dot-segment variants unchecked. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
NULL pointer dereference in GStreamer's RTSP support library (gst-plugins-base) crashes any process that parses a Digest authentication header containing specially crafted whitespace, resulting in a denial-of-service condition. The flaw is bidirectional: an unauthenticated remote attacker can crash an RTSP server by sending a single malformed request when Digest authentication is enabled, and a malicious or compromised RTSP server can crash an RTSP client using the same technique. No confidentiality or integrity impact is confirmed; the sole consequence is process termination. No public exploit code or CISA KEV listing has been identified at time of analysis.
Predictable HMAC shared secrets generated by the API Publisher component of WSO2 API Manager allow a sophisticated attacker to forecast future webhook signing secrets and forge event payloads that the API Gateway accepts as authentic. All supported release lines are affected — API Manager 4.1.0, 4.2.0, 4.3.0, 4.4.0 and 4.5.0, plus API Control Plane 4.5.0 — with fixes shipped as vendor update levels (for example 4.4.0.68, 4.3.0.104, 4.5.0.52 and 4.1.0.253). Exploitation is not currently observed: EPSS is only 0.27% (19th percentile), CISA's SSVC rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis, so the practical risk is driven by the sensitivity of the webhook-integrated downstream systems rather than by mass scanning activity.
Uncontrolled resource consumption in the Migrate Guru - Site Migration & Cloning WordPress plugin (versions 6.65 and earlier) exposes any WordPress installation running the plugin to remote denial of service by unauthenticated network attackers. The root cause (CWE-770) indicates that one or more plugin endpoints perform resource-intensive operations without adequate rate limiting or throttling, allowing an attacker to exhaust server capacity without supplying credentials. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated denial of service in MalCare Security WordPress plugin versions 6.69 and earlier allows any remote attacker with no credentials to exhaust server resources and take down affected WordPress sites. The vulnerability, rooted in CWE-770 (resource allocation without throttling), exposes a network-accessible plugin endpoint that can be abused to render the site unavailable. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a straightforward target for automated abuse.
In-sandbox arbitrary code execution in Google Chrome's V8 JavaScript engine (all versions prior to 152.0.7977.82) is achievable by a remote unauthenticated attacker who tricks a user into visiting a specially crafted HTML page. The underlying flaw is a CWE-367 Time-of-Check Time-of-Use (TOCTOU) race condition within V8, allowing the attacker to win a memory-access race and redirect execution flow inside the Chrome renderer sandbox. No public exploit code has been identified and CISA SSVC rates exploitation as 'none' at time of analysis, though the technical impact is rated 'total' within the sandbox boundary.
Hardcoded container registry credentials in IBM Netezza Software 11.3.0.3 through Interim Fix 002 expose a secret directly in application source code, allowing unauthenticated remote access to IBM's private container registry. An attacker who obtains the credential - likely by inspecting distributed software artifacts or container image layers - can pull private images, potentially revealing proprietary application code, embedded configuration values, and additional secrets. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Integer overflow in Signum Node's block processing engine prior to v3.9.9 allows a malicious miner to receive an arbitrarily inflated block reward by crafting a block with a negative totalFeeCashBackNqt value. The flaw exists in BlockServiceImpl.applyBlock() and was introduced when the SMART_FEES hardfork (at block ~1,029,000) added fee cash-back and burn accounting logic without overflow guards. No public exploit code has been identified at time of analysis, but the attack is technically feasible for any active network participant with mining capability.
Broken access control in Quick Event Manager WordPress plugin (≤9.17) allows unauthenticated remote attackers to perform unauthorized write operations against event management functions, achieving high integrity impact with no authentication required. CWE-862 (Missing Authorization) indicates the plugin omits capability checks on one or more endpoints or AJAX handlers before executing privileged actions. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated information exposure in Apache Allura through version 1.20.0 allows remote attackers to retrieve non-public project content via the search functionality, bypassing access controls enforced elsewhere in the application. The search subsystem fails to apply visibility restrictions consistently, meaning private tickets, wiki pages, discussions, or code artifacts indexed by search may be readable without authentication. No public exploit code has been identified at time of analysis, and the EPSS score of 0.20% (10th percentile) reflects minimal observed exploitation interest despite the unauthenticated attack vector.
NoSQL injection in Microsoft Discovery Studio enables unauthenticated, network-based attackers to extract confidential data from the application's backend data store. The CWE-943 flaw allows specially crafted query inputs to bypass intended data-access boundaries, with the CVSS scope-change (S:C) indicating that leakage can extend beyond the directly targeted component - potentially exposing data belonging to other users or system contexts. Exploitation requires user interaction (UI:R), constraining opportunistic mass attacks; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution in Rockwell Automation Arena's DOE file parser allows a network-reachable attacker to write beyond the boundary of an allocated object and execute arbitrary code within the context of the running Arena process. Affected users must be socially engineered into opening a maliciously crafted Design of Experiments (DOE) file or visiting a page that triggers the parse. The CVSS 4.0 score of 7.5 reflects high attack complexity and mandatory active user interaction, reducing real-world exploitability despite the high-severity memory corruption impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated two-factor authentication bypass in the Really Simple SSL WordPress plugin (versions ≤9.8.0) allows a remote attacker to circumvent 2FA protections via an alternate authentication path (CWE-288), gaining unauthorized access to accounts with both confidentiality and integrity impact. The CVSS vector assigns AC:H, reflecting that exploitation requires specific conditions - most critically, the 2FA feature within the plugin must be actively enabled and configured on a target account. No public exploit code or CISA KEV listing has been identified at time of analysis, but Patchstack has published a database entry with technical details that may lower the barrier to exploitation.
SAML assertion replay bypass in Rancher Manager before v2.15.1 allows unauthenticated network attackers to obtain additional authenticated management sessions as a victim user in high-availability deployments. The per-process in-memory cache that tracks consumed SAML assertion IDs - introduced by the CVE-2026-44946 fix - is not shared across pod replicas, so a captured assertion can be replayed once against each replica that has not yet seen it, yielding one unauthorized session per targeted replica. All SAML identity providers supported by Rancher are affected, and a vendor-released patch is available in v2.15.1. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds kernel memory reads in the Linux kernel's ovpn (in-kernel OpenVPN) driver allow a local attacker with low privileges to leak kernel memory by abusing a missing ownership check on the sk_user_data socket field. The driver dereferences sk_user_data as an ovpn-internal structure without first confirming that encap_type identifies the socket as ovpn-owned, so when BPF SOCKMAP or another subsystem has populated sk_user_data with a different pointer type, ovpn misinterprets that memory and reads out of bounds. Affected kernels span 6.16 through pre-patch stable releases; no public exploit has been identified and EPSS sits at 0.21% (11th percentile), but kernel memory disclosure can seed further privilege escalation.
Type-confusion memory access in the Linux kernel BPF subsystem allows a local attacker with BPF-capable privileges to read or corrupt kernel memory via the bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie helpers. Both helpers accept a generic sock_common pointer (ARG_PTR_TO_BTF_ID_SOCK_COMMON) but dereference fullsock-specific fields without first confirming the socket is in TCP_LISTEN state, meaning a mini-socket passed to either helper causes an out-of-bounds struct field access. No public exploit has been identified and EPSS sits at 0.20% (10th percentile), though the C:H/I:H CVSS impact signals the potential to compromise kernel memory integrity if exercised by a sufficiently privileged local process.
Privilege escalation to root in the AWS FPGA Development Kit (aws-fpga) before version 2.3.4 is achievable when a local low-privileged user pre-places malicious shell content at the predictable path `/tmp/sdk_root_env.exp`, which the `sdk_setup.sh` installation script sources after elevating its own privileges. The root cause (CWE-379) is the installation component writing a shell function file to the world-writable `/tmp` directory without using secure temporary file practices, making the path guessable and controllable by any local account. Amazon released a fix in v2.3.4 that removes the offending write step entirely, sourcing the function directly from `shared/bin/set_common_functions.sh` instead; no public exploit has been identified at time of analysis.
Local privilege escalation in HP Support Assistant (versions prior to 9.53.2.0) allows a low-privileged local user to gain elevated system privileges by exploiting insufficient granularity in access controls (CWE-1220). The vulnerability requires local authenticated access but no user interaction, and the CVSS 4.0 AT:P metric indicates specific attack conditions must be present. No public exploit code or active exploitation has been identified at time of analysis; HP has released a patched version addressing the issue.
Insecure Direct Object Reference (IDOR) in the vhr open-source HR management system allows any authenticated user to overwrite arbitrary HR profiles - including administrator accounts - via the PUT /hr/info endpoint by supplying a victim's profile ID in the request body. The flaw stems from a complete absence of object-level authorization in HrInfoController.java: the server updates whichever record ID is provided without verifying the requester owns or has permission to modify it. Beyond profile data manipulation, an attacker can disable administrator accounts, effectively causing a denial-of-service against system administration functions. No vendor-released patch has been identified at time of analysis.
Expression sandbox bypass in n8n before 2.36.2 allows authenticated workflow editors to escape the sandboxed evaluation environment by placing free identifiers in spread, computed-key, switch-case, or class-extension positions, which resolve against Node.js process globals instead of the restricted sandbox scope. Exploiting this flaw enables mutation of host objects - including prototype chains or environment-level state - with those changes persisting process-wide until the n8n service is restarted, affecting all concurrent workflows and users on the same instance. No public exploit or CISA KEV listing has been identified at time of analysis; patch version 2.36.2 is confirmed via the GitHub Security Advisory.
Missing authorization enforcement on Kill Bill's AdminResource endpoints through version 0.24.21 allows any authenticated low-privilege user - holding only account:read permissions - to read internal queue entries, flush server-side caches, and put the host out of rotation, effectively disabling the billing platform. The vulnerability stems from unenforced permission annotations in the JAX-RS AdminResource class, meaning the access-control declarations exist in code but are never evaluated at runtime. No public exploit code exists and CISA has not listed this in KEV; however, the availability impact (VA:H in the CVSS 4.0 vector) makes this a credible insider-threat or compromised-credential denial-of-service vector in any multi-tenant or employee-accessible Kill Bill deployment.
Credential exfiltration in n8n's workflow execution engine allows a low-privileged authenticated user to reference another user's credentials inside an inline sub-workflow node (such as the Workflow Tool node) without any ownership validation. Affected versions are n8n before 2.35.4 and 2.36.x before 2.36.2. When a privileged execution context later runs the poisoned workflow and resolves the referenced secret, the sub-workflow can forward the plaintext credential to an attacker-controlled endpoint. No public exploit code has been identified at time of analysis, but the VulnCheck advisory corroborates the GitHub Security Advisory GHSA-4r56-g65c-fm83.
Cross-site request forgery chained with path traversal in AVideo's stopLive.php enables attackers to trigger recursive deletion of arbitrary server directories when an authenticated administrator visits a malicious page. The vulnerability exists through commit c91b5975d of the WWBN AVideo self-hosted video platform, affecting all versions covered by CPE cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*. The attack exploits missing CSRF token validation in stopLive.php combined with unsanitized concatenation of the key parameter into filesystem paths, allowing payloads like key=../../videos to destroy the videos directory and its contents. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated SSRF in the LiteSpeed Cache WordPress plugin (versions ≤ 7.9) allows any remote attacker without credentials to induce the WordPress server to issue arbitrary HTTP requests to internal or external endpoints. Reported by Patchstack under CWE-918, this flaw can expose internal infrastructure, cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), and backend services not otherwise reachable from the internet. No public exploit code or CISA KEV listing has been identified at time of analysis, but the plugin's massive deployment footprint makes this a meaningful exposure for any internet-facing WordPress installation.
Unauthenticated Cross-Site Scripting in the EWWW Image Optimizer WordPress plugin (versions ≤ 8.7.6) enables remote attackers to inject arbitrary JavaScript into pages served to authenticated site visitors, including administrators. With Scope:Changed in the provided CVSS vector, successful exploitation can break out of the plugin's security boundary - allowing session token theft, admin-level action hijacking, or persistent backdoor injection via malicious script execution in a privileged browser context. Reported by Patchstack; no active exploitation or public PoC has been identified at time of analysis.
Uninitialized heap memory disclosure in FreeRDP 3.0.0-3.30.0 exposes up to 576 bytes of stale server or proxy heap contents - potentially including cleartext credentials from prior RDP sessions - to any authenticated downstream RDP client. Three PDU-serialization functions in libfreerdp/core/info.c advance the stream write pointer with Stream_Seek over reserved padding bytes instead of zeroing them with Stream_Zero, leaving prior malloc heap contents in Save Session Info PDUs transmitted to clients. FreeRDP-based server deployments and freerdp-proxy instances are the affected roles; a vendor-confirmed fix ships in version 3.31.0, and no public exploit or active exploitation has been identified at time of analysis.
Credential exposure in n8n's Strapi, SeaTable, and Mailcheck integration nodes causes plaintext API secrets to persist in execution error logs, readable by any authenticated user via the REST API. The three affected nodes pass decrypted credentials to external authentication endpoints through a legacy HTTP helper that lacks error-handling wrappers; when those calls fail, the raw secret is written into execution error records rather than being suppressed or redacted. This bypasses n8n's credential API blank-value redaction, effectively leaking third-party service credentials to any n8n user who can inspect execution results. No public exploit or CISA KEV listing exists at time of analysis; patches are available in versions 1.123.73, 2.35.4, and 2.36.2.
Authorization bypass in ShizenBox2 edge-app (versions ≤ v3.1.15) permits any authenticated low-privilege user to change another account's password by supplying a manipulated user-controlled key in the password-change request - a classic Insecure Direct Object Reference (IDOR) pattern classified under CWE-639. The CVSS 4.0 vector (PR:L/VI:H) confirms that exploitation requires only a valid login with no elevated permissions or user interaction, yielding a high integrity impact against targeted accounts. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; a vendor advisory has been published through JPCERT/JVN.
SSRF in OCSreports (OCS Inventory NG) allows authenticated operators to weaponize the inventory server as a proxy to reach internal network services or cloud metadata endpoints via the /ocsreports/?function=tele_activate endpoint. By supplying attacker-controlled values for the HTTPS_SERV and FILE_SERV parameters, an operator-level account can cause the server to issue outbound HTTP/HTTPS requests to otherwise-inaccessible destinations, including cloud provider metadata APIs such as AWS IMDSv1. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by INCIBE as part of a multi-flaw advisory.
Incorrect authorization in Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint allows any authenticated user holding MEMORY:READ permission to retrieve episodic memory records belonging to all other users by paginating through the collection via the offset cursor. The route implementation in core/cat/routes/memory/points.py omits per-user scoping when querying the vector store, exposing stored conversation histories and personal data across the entire tenant base. No public exploit or CISA KEV listing has been identified at time of analysis.
Missing role-guard middleware on three API route groups in Checkmate through v3.11.0 allows any authenticated low-privilege user to perform administrative actions reserved for admins. Authenticated user-role accounts can create maintenance windows that silence monitoring alerts across all monitors, tamper with notification channel configurations, and delete monitor check history to destroy incident evidence. No public exploit identified at time of analysis, though the vulnerability is documented in a public GitHub issue and a VulnCheck advisory, making opportunistic exploitation by insiders or compromised accounts plausible without further development effort.
Cross-tenant IDOR in Worklenz before 3.0.0 allows any authenticated user to read task data owned by other organizations on the same instance. Task-scoped API endpoints resolved arbitrary task UUIDs supplied by the caller without verifying that the requesting user's organization owned the referenced task, exposing work logs, comments, attachments, and project insights across tenant boundaries. No public exploit is identified at time of analysis, but the attack requires only valid credentials and basic HTTP tooling. Vendor-released patch: v3.0.0.
Persistent denial of service in MISP's event template subsystem allows an authenticated user with event-template write permissions to store malformed JSON as a template definition by bypassing semantic validation. When any authenticated user subsequently loads the event template index - an endpoint accessible to all authenticated users - an unhandled exception in afterFind() causes HTTP 500 errors instance-wide until an administrator manually repairs the offending database row. The patch enforces strict array-only validation on save and adds exception handling on retrieval with graceful degradation to an empty definition.
Integration management routes in UnoPim before 2.1.3 are absent from the application's ACL map, meaning the Bouncer middleware never enforces permission checks on those endpoints regardless of the authenticated admin's assigned role. Any low-privilege admin - including one restricted to dashboard-only access - can directly POST to the integration store, update, key-generation, and secret-regeneration routes to create OAuth API integrations and mint client credentials for arbitrary admin accounts, effectively escalating their permissions. A vendor-released patch exists in v2.1.3 and a public researcher writeup (geo-chen/oss) confirms the issue; no public exploit tool or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in WWBN AVideo (all versions through commit c91b5975d) allows authenticated API clients to force the application server to fetch arbitrary internal URLs via the unvalidated `profileImg` and `backgroundImg` parameters in the `set_api_userImages` endpoint. Unlike blind SSRF, fetched responses are written to publicly accessible web paths, enabling reliable exfiltration of cloud metadata credentials (e.g., AWS IMDS IAM tokens), internal API responses, and network-internal service data. No public exploit code or CISA KEV listing exists at time of analysis, but the non-blind exfiltration path significantly elevates real-world exploitability for cloud-hosted deployments.
Local file read and server-side request forgery (SSRF) in n8n's Gmail (v1) and Brevo workflow nodes allow an authenticated low-privilege user to exfiltrate files accessible to the n8n process or probe internal network endpoints by supplying a crafted expression that resolves to a JavaScript object with a `path` or `href` property. Affected versions span the stable branch before 1.123.73 and the 2.x branch before 2.35.4 and 2.36.2, as confirmed by vendor advisory GHSA-95ph-833c-4wrp. No public exploit has been identified at time of analysis, but the attack mechanism is well-defined and low-complexity for any user with workflow creation rights.
Remote process termination in MOOS core-moos through 10.4.0 allows any multicast-reachable attacker to forcibly shut down arbitrary MOOS processes by exploiting a hard-coded passphrase embedded in the SuicidalSleeper component. The passphrase 'elks have been know to waltz' was compiled directly into SuicidalSleeper.cpp and is publicly visible in the open-source repository, enabling unauthenticated adjacent attackers to enumerate running MOOS processes and issue termination commands via the default multicast group and port. No public exploit has been identified at time of analysis, but the static passphrase effectively eliminates any practical authentication barrier for multicast-adjacent peers.
Improper authentication in Adobe ColdFusion 2023 and 2025 allows unauthenticated adjacent-network attackers to escalate privileges and gain limited read and write access to affected systems. The vulnerable administrative component is network-restricted by default, which partially contains exposure, but the scope change indicator in the CVSS vector signals that successful exploitation can affect components beyond the directly targeted service. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing authorization on two REST v2 tag-management endpoints in ntopng 6.7.0-6.7.260717 allows any authenticated low-privilege user to delete or rename tags system-wide, including those created by administrators. The affected endpoints - POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua - perform no isAdministrator() check before processing requests. The fix, confirmed in commit 0e41f24b and released as version 6.7.260718, adds the missing privilege gate to both Lua handlers. No public exploit or KEV listing identified at time of analysis.
Subscriber-level privilege escalation in WCFM Membership WordPress plugin (versions ≤ 2.11.11) enables any authenticated user holding a basic subscriber account to elevate their role to a higher-privileged level, producing high-integrity impact on the affected WordPress/WooCommerce installation. The flaw falls under CWE-266 (Incorrect Privilege Assignment) and was responsibly disclosed by Patchstack. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and broad attacker pool (any registered subscriber) make this a realistic threat for multivendor marketplace deployments.