Pre-authentication remote code execution in N-able N-central before 2026.3.1.14 allows unauthenticated remote attackers to execute arbitrary code on the management server, per the vendor's own security advisory. Rated CVSS 4.0 10.0 with a full-impact vector including scope change, it targets a platform that centrally manages large fleets of downstream endpoints, making it an exceptionally high-value target. No public exploit has been identified at time of analysis, and it is not yet listed in CISA KEV, but the pre-auth, network-reachable nature warrants emergency patching.
OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets an attacker inject shell commands through the function sub_2F77E8 in Apis/system.c, part of the Network Configuration Management component. Successful exploitation yields arbitrary command execution on the camera's embedded Linux OS. The CVSS 4.0 vector requires high privileges (PR:H), and no public exploit or active exploitation has been identified at time of analysis.
OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets remote attackers execute arbitrary shell commands via the CAutoAddWifi::ThreadProc function of the Kylin component's AutoAddWifi.cpp. The flaw is reachable without authentication over the network and yields full device compromise. No public exploit has been identified at time of analysis, and the report originates from a single source (VulDB).
Unauthenticated account takeover in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.12) lets remote attackers overwrite any user's email address - including an administrator's - and then hijack the account via WordPress's built-in password-reset flow. The flaw stems from a missing capability check in pre_update_value combined with an authorization gate that is silently bypassed when a non-numeric post identifier (e.g. 'user_1') is supplied. Reported by Wordfence; no public exploit code or CISA KEV listing was identified at time of analysis, but the trivial, unauthenticated nature makes this a high-priority patch.
Full account takeover in the MemberDash WordPress membership plugin (versions up to and including 1.8.5) lets unauthenticated remote attackers reset the password of any user - including administrators - by supplying an arbitrary target user ID via the 'id' parameter during registration. The victim receives no notification, so takeover is silent. Reported by Wordfence with a critical 9.8 CVSS; no public exploit is identified at time of analysis, though the trivially scriptable request pattern makes weaponization straightforward.
Authentication bypass via response replay affects the DIGEST-MD5 server implementation in the Perl Authen::SASL distribution (Authen::SASL::Perl::DIGEST_MD5) before version 2.2100. The server generates a fresh nonce in its challenge but never compares it against the nonce returned by the client, so an attacker who passively captures one successful qop=auth exchange can replay that exact response against a later session for the same service, host, realm and user and authenticate as that user without knowing the password. An upstream fix is available (2.2100, commit 9433736); no public exploit identified at time of analysis, and EPSS is low at 0.22%.
SAML authentication bypass in the Perl module MojoX::Authentication before 0.006 lets a remote unauthenticated attacker impersonate any user by forging a SAML response. The module's parse_assertion routine constructs a Net::SAML2::Binding::POST object without any trust anchor (no cacert, cert_text, or anchors), so the signature on an unencrypted assertion is validated against the certificate embedded in the response itself rather than the trusted IdP signing certificate. No public exploit has been identified at time of analysis, and EPSS is low (0.11%), but the flaw is a complete pre-authentication account-takeover primitive.
Improper privilege management in the Tenda CP3 IP camera (firmware 27.5.57.101) exposes the CRedirServer::SetRedirectEnable function (Functions/Redirect.cpp) to remote abuse, letting an attacker toggle the device's redirect handling without proper authorization enforcement. The flaw was disclosed by VulDB (vuln #399276) and carries a CVSS 4.0 base score of 9.4, though no public exploit code and no active-exploitation evidence accompany the entry. No public exploit identified at time of analysis, and the single-source, sparse disclosure limits how much of the claimed impact can be independently confirmed.
Server-side request forgery in OpenMAIC before 1.0.1 lets unauthenticated attackers coerce the server into fetching arbitrary attacker-supplied provider URLs, reaching cloud instance metadata endpoints (e.g. 169.254.169.254) to steal IAM credentials and instance metadata. The flaw exists because the outbound URL guard was gated to production builds only, so any deployment not running under NODE_ENV=production skipped SSRF validation entirely. Reported privately by VulnCheck; a vendor patch (v1.0.1) is available, no public exploit code was identified, and the product is not in CISA KEV.