Buffer overflow in the XML processing stack of Palo Alto Networks PAN-OS enables unauthenticated remote attackers to cause denial of service on VM-Series virtual firewalls or execute arbitrary code with root privileges on PA-Series physical appliances. The vulnerability is reachable via the management web interface or dataplane interface, and Panorama management platforms are also confirmed in scope. No public exploit has been identified at time of analysis; the CVSS 4.0 supplemental metric E:U corroborates no known active exploitation.
Root-level command injection in GeoVision GV-LPC2211 and GV-LPC2011 license plate recognition cameras (firmware V1.13) allows an authenticated administrator to execute arbitrary OS commands as root by embedding shell metacharacters in the FTP account username field. The injected payload is executed during a subsequent FTP-account update operation, yielding complete device compromise. No public exploit is identified at time of analysis, and no confirmed patched firmware version has been independently verified.
Stored OS command injection in GeoVision GV-LPC2211 V1.13 allows an authenticated administrator to achieve arbitrary root-level code execution on the embedded device by crafting a username that contains shell metacharacters, which are unsafely interpolated into a shell command when the account is later deleted. The vulnerability affects both the GV-LPC2011 and GV-LPC2211 license plate recognition camera models per the CPE entry. No public exploit code or active KEV-listed exploitation has been identified at time of analysis.
OpenPanel's server-side mutation resolvers fail to enforce project access levels, allowing read-only project members to execute 26 of 29 write operations that should be restricted to higher-privileged roles. Affected actions include deleting reports and dashboards, scheduling entire projects for deletion, publishing private analytics to public share links, and modifying alerting rules - all achievable by any user with the lowest valid project membership tier. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; organizations should consult GitHub Security Advisory GHSA-f9rx-pxgw-c6rg for patch details.
Stored XSS in the Sidebar Manager Light WordPress plugin (all versions through 1.18) allows unauthenticated attackers to permanently inject malicious JavaScript via the `sbm_description` parameter into pages served to any site visitor. The scope-changed impact means attacker-controlled scripts execute within victims' browsers rather than solely the plugin's own context, enabling session hijacking, credential phishing, or drive-by malware delivery. No public exploit code has been identified at time of analysis, and the plugin's limited deployment footprint constrains real-world exposure.
Path traversal in knowns through version 0.33.0 allows authenticated AI agent sessions to read arbitrary files anywhere on the host filesystem by supplying absolute paths or relative traversal sequences to the `code.find` MCP tool's path argument. The vulnerability exists because the handler in `internal/mcp/handlers/code.go` performs no canonicalization or boundary enforcement before passing the caller-supplied path to the underlying OS, bypassing the intended project-root confinement entirely. No public exploit code or CISA KEV listing exists at time of analysis, though the exploit primitive is trivially simple given the CWE-22 root cause.
Authorization bypass in Countly Server's DBViewer plugin allows authenticated low-privilege users to read data from restricted MongoDB collections, including plaintext password-reset tokens, by exploiting a logic flaw in the aggregation-pipeline sanitizer. The `/o/db` aggregation endpoint's stage sanitizer misclassifies branches containing unrecognized MongoDB-internal operators (such as `$_internalInhibitOptimization`) as generic arrays rather than sub-pipelines, causing it to skip enforcement entirely for that branch. This lets a user holding only DBViewer read permission inject `$lookup` stages inside `$facet` sub-pipelines, cross-join into restricted collections such as `members`, and extract sensitive fields including `prid` (password-reset tokens), which are directly usable for account takeover. No public exploit has been identified at time of analysis, but the GitHub PR diff exposes sufficient technical detail to reconstruct the technique.
Prototype pollution in isomorphic-git before 1.42.0 allows an operator of a malicious Git server to pollute Object.prototype by advertising crafted ref names containing '__proto__' path segments during ref negotiation, enabling credential theft when the victim's onAuth callback is triggered. The getRemoteInfo function fails to sanitize ref path components before using them as property keys on JavaScript objects, so a ref such as '__proto__/corsProxy' causes all subsequent network operations within the affected isomorphic-git instance to route through an attacker-controlled proxy. No public exploit or CISA KEV listing has been identified at time of analysis; the fix is confirmed in v1.42.0 released 2026-09-10.
Cross-site request forgery in SP Property (a Joomla real estate extension by joomshaper.com) before version 4.1.4 allows unauthenticated attackers to forge POST requests against two unprotected endpoints. The visitor property booking endpoint (properties.booking) and agent contact form endpoint (agents.sendmail) both processed POST submissions without validating Joomla's built-in session anti-CSRF tokens, enabling an attacker who tricks a site visitor into loading a malicious page to submit fraudulent bookings or send arbitrary contact messages on that visitor's behalf. No public exploit has been identified at time of analysis.
Cross-site request forgery in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote unauthenticated attackers to perform unauthorized state-changing actions on behalf of authenticated users, with high integrity impact. Exploitation requires social engineering to lure a logged-in DataStage user to a malicious page, at which point the victim's browser silently submits forged requests to the DataStage application. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available.
Unauthenticated cross-site scripting in the WPCS WordPress currency switcher plugin (versions ≤ 1.3.2) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in victims' browsers without any server-side privileges. The CVSS Scope:Changed metric confirms the injected payload escapes the plugin's own security context, enabling session theft, credential harvesting, or admin-level action execution on behalf of a tricked user. No public exploit or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature lowers the bar for exploitation significantly.
IBM WebSphere Application Server 8.5 and 9.0 contain improper authentication controls that allow an attacker who already holds a local, low-privileged foothold on the server to bypass security checks and escalate privileges. Successful exploitation yields high confidentiality and integrity impact — protected resources and configuration can be read and modified — though availability is unaffected per the CVSS vector. No public exploit code has been identified, EPSS is very low at 0.12% (3rd percentile), the issue is not in CISA KEV, and a vendor patch is available from IBM.
Authorization bypass in HashiCorp Consul's Connect service mesh allows a low-privileged authenticated service to communicate with destination services it is not authorized to reach. The flaw originates in Consul's Envoy RBAC rule generation: unescaped special characters in service names, namespaces, or partitions cause the generated matching rules to be overly permissive, defeating the Connect intentions authorization model. No public exploit or CISA KEV listing exists at time of analysis; fixes are available across Consul open-source and Enterprise release trains.
NoSQL injection in the MongoDB integration for Laravel (laravel-mongodb PHP) allows an authenticated low-privilege user to manipulate polymorphic relation identifiers, causing the application to return documents outside the intended relation target. The vulnerability (CWE-943) exploits the boundary between data and query logic in MongoDB's operator-based query model: a crafted relation identifier stored by an attacker is later interpreted as a MongoDB query condition rather than a literal string during relation resolution. No active exploitation has been identified, and no public proof-of-concept is known at time of analysis; the issue is tracked in MongoDB JIRA as PHPLARA-265.
NoSQL injection in the MongoDB-Laravel PHP integration's embedded-document relation handling allows an authenticated low-privilege user to manipulate embedded record identifiers so they are evaluated as query operators rather than literal values. Exploitation can result in mass deletion of all embedded documents within a targeted parent record, or silent overwrite of an unintended embedded document, depending on how the injected condition is constructed. No public exploit code has been identified at time of analysis, and no CISA KEV entry exists, but the network-accessible attack surface and low authentication barrier make this a meaningful integrity risk for any application exposing user-controlled identifiers to embedded-relation operations.
Regex metacharacter injection in the MongoDB C# Driver's LINQ query translation layer allows an authenticated low-privilege user to alter generated regular-expression predicates, causing the application to return database records beyond those the original filter was designed to expose. The vulnerability, reported by MongoDB and tracked under CSHARP-6177 (CWE-943), requires only network access and a low-privilege account - making it a meaningful access-control risk in any .NET application that incorporates user input into LINQ regex-based queries against MongoDB. No public exploit has been identified at time of analysis, and no EPSS or KEV data is present in available intelligence.
Unauthenticated Cross-Site Scripting (XSS) in the WPAdverts WordPress plugin affects all versions through 2.3.3, allowing a remote attacker without any credentials to inject malicious JavaScript into pages served by the plugin. With user interaction (UI:R), a victim - likely a logged-in site administrator - must visit or trigger the vulnerable endpoint for the payload to execute in their browser context. Successful exploitation can lead to session hijacking, unauthorized administrative actions, or content manipulation via the changed-scope (S:C) browser execution context. No public exploit or KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the Page Visits Counter - Lite WordPress plugin (versions ≤ 1.2.3) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser context of a visiting user. Because CVSS marks scope as Changed (S:C), the injected script can escape the plugin's own context and affect the broader WordPress page environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit or CISA KEV listing has been identified at time of analysis; the issue was disclosed by Patchstack.
Subscriber-level broken authentication in the MailMunch - Grow your Email List WordPress plugin (versions ≤ 3.2.5) enables low-privileged authenticated users to bypass authentication controls, causing integrity and availability impacts on affected WordPress installations. The vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and reported by Patchstack, indicating a pathway or channel that circumvents the intended authentication mechanism. No public exploit code or active exploitation has been identified at time of analysis, though the network-accessible, low-complexity attack vector lowers the bar for abuse.
Cross-site request forgery in WWBN AVideo's log archive endpoint allows unauthenticated remote attackers to exfiltrate sensitive application logs and destroy forensic evidence by tricking an authenticated administrator into visiting a malicious page. The `view/logArchive.json.php` endpoint accepts GET requests without any CSRF token validation, so a crafted page silently causes the administrator's browser to trigger log archiving - copying live logs into a publicly accessible zip file while simultaneously truncating the original log to eliminate attack traces. Affected versions span all releases through commit c3edcc274c389816d434acadac07ee78eaf330c1; no KEV listing and no public exploit code identified at time of analysis.
Cross-site request forgery in AVideo's setPassword.json.php endpoint allows unauthenticated remote attackers to modify or clear any user's channel password by tricking an authenticated administrator into visiting a malicious webpage. The root cause is the endpoint accepting GET requests for a state-changing password operation without CSRF token validation, making a single img tag or iframe on an attacker-controlled page sufficient to trigger the attack. No public exploit has been identified at time of analysis, and no KEV listing exists, but the low attack complexity makes successful exploitation realistic whenever an administrator can be phished.
Cross-site request forgery in WWBN AVideo's LoginControl plugin allows network-adjacent unauthenticated attackers to silently replace a logged-in victim's PGP two-factor authentication public key by luring them to a page containing a crafted image tag pointing to the unprotected `savePublicKey.json.php` GET endpoint. The outcome is either account lockout (denying the legitimate user access) or full account takeover if the attacker independently possesses the victim's password and can now pass 2FA using their own PGP key. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization in MISP's event template instantiation path allows authenticated users to write events into sharing groups they are not permitted to access, and to attach tags beyond their normal tagging permissions. Affected are all MISP deployments running version 2.5.45 and earlier. An attacker with a low-privilege account that can view a community-distributed template (distribution=1) may exploit the flaw to bypass `SharingGroup::canUse()` checks and additionally cause `local_only` tags to propagate globally through MISP's synchronization and export mechanisms, violating the isolation guarantees those tags exist to enforce.
Improper authorization in Hikvision HikCentral Access Control V2.5.0 and below allows authenticated low-privilege users to invoke API endpoints restricted to higher-privileged roles, resulting in unauthorized access to sensitive data and limited system modification. The CVSS vector (PR:L, C:H, I:L) confirms the attacker requires only a valid low-privilege account but can achieve high confidentiality impact and limited integrity compromise across the network. No public exploit code or CISA KEV listing has been identified at time of analysis, though the straightforward nature of the authorization flaw (unenforced role checks on API routes) makes it readily exploitable by any insider or attacker who obtains basic credentials.
Heap-based out-of-bounds read in ESP32-audioI2S versions 3.4.4 through 4.0.0 allows network-positioned attackers to crash ESP32 devices or leak adjacent heap memory by delivering crafted MP3 files or malicious HTTP audio streams containing oversized SYLT (synchronized lyrics) ID3 frames. The root cause is a shadowed local variable in read_ID3_Header() that zeroed the bounds-check operand, rendering the guard permanently ineffective regardless of declared frame size. No public exploit has been identified, but the fix is publicly visible in the upstream GitHub repository.
Local privilege escalation in gvfs's privileged gvfsd-admin daemon affects Red Hat Enterprise Linux 6 through 10, allowing an authenticated local attacker to obtain root access. The daemon's use of symlink-following chown() on attacker-controlled directory paths creates a TOCTOU window during D-Bus socket setup. By racing the operation and substituting a symlink to a root-owned file such as /etc/pam.d/su, an attacker causes the daemon to transfer ownership of that critical file to the attacker's UID, enabling subsequent modification and full privilege escalation to root.
Stack-based buffer overflow (CWE-121) in the Nintendo Switch local wireless networking subsystem allows an adjacent unauthenticated attacker within wireless range to execute arbitrary code via a Return-Oriented Programming (ROP) chain embedded in crafted network traffic. All Nintendo Switch firmware versions prior to 23.0.0 are affected, and Nintendo has released version 23.0.0 as the remediation. No public exploit code or active exploitation has been identified at time of analysis, though SSVC rates technical impact as total.
Kernel pool memory corruption in Silicon Labs silabser.sys (the Windows kernel driver for CP210x USB-to-serial bridge devices) v11.5.0 and earlier allows a local unprivileged user who physically attaches a malicious CP210x-compatible USB device to escalate privileges to kernel-level code execution. The driver fails to validate USB device-supplied packet data before processing, enabling crafted malformed packets to corrupt Windows kernel pool allocations. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.