We need answer JSON only. Need synthesize. Must use data. Need be careful with every field strings. We need analyze CVE-2026-79396. Need not copy description. Need incorporate all data. Need investigate references? We have references to GitHub and NVD. We need produce original synthesis. Let's parse input. CVE ID: CVE-2026-79396 Description: Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over the camera. CVSS Score: 9.8 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE: CWE-798 EPSS 0.18% percentile 8% Reported by mitre CPE: cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* Tags: Authentication Bypass, N A ENISA EUVD ID: EUVD-2026-76189 Affected versions: ["n/a n/a"] References: cveorg None https://github.com/ShiroiBoushi/vulnerability-research/tree/main/CVE-2026-79396 euvd advisory https://nvd.nist.gov/vuln/detail/CVE-2026-79396 Need output product_name: 1-3 words. "Xiongmai IP Camera" or "Xiongmai XM530". Product specific. I think "Xiongmai IP Camera" 3 words? Xiongmai IP Camera = 3. Or "Xiongmai XM530" = 2. Probably "Xiongmai XM530". Need product name not vendor alone. Use Xiongmai IP Camera maybe. Summary: 2-3 sentences. Do not start with A vulnerability. Start with specific impact verb and product. We can say "Hardcoded default credentials in Xiongmai XM530 IP camera firmware HMT.CM2005-v220608.1837 and earlier allow remote unauthenticated attackers to achieve full administrative control by extracting or reusing static plaintext credentials from bin/config.xml and the Sofia executable." Need mention if actively exploited? KEV absent. POC? Reference is GitHub vulnerability-research. Could mean POC exists? But not explicitly says POC. We can mention "public proof-of-concept/research is accessible on GitHub" perhaps. E
Out-of-bounds heap read and write in the Linux kernel's CIFS/SMB client (coalesce_t2() in fs/smb/client) allows a malicious or MITM SMB server to corrupt kernel memory or leak data by supplying a crafted Transaction2 DataOffset field. The function computes source and target data pointers directly from the server-controlled DataOffset with no bounds validation before a memcpy, so a small value overwrites header fields while a large value pushes the pointer past the buffer end. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; the fix adds lower- and upper-bound checks for both pointers.
Out-of-bounds ring-buffer write and stale-memory disclosure in the Linux kernel NFSD server affects the nfsd_fh_verify and nfsd_fh_verify_err tracepoints, which reserve a server-address trace slot sized by the transport's remote-address length (xpt_remotelen) but populate it from the local address using xpt_locallen. On NFSv2/v3-over-UDP, xpt_remotelen stays zero for the transport's lifetime, so every file-handle verification copies 16 or 28 bytes past a zero-byte slot; in the reverse case an oversized slot leaks prior ring-buffer contents to trace consumers. Exploitation requires the tracepoint to be enabled by a local administrator, and there is no public exploit identified at time of analysis (EPSS 0.17%).
Out-of-bounds write and kernel memory disclosure in the Linux kernel NFS server (nfsd) affect deployments exporting pNFS flexfiles layouts. The XDR length calculation in nfsd4_ff_encode_layoutget() miscomputes the reservation for the encoded layout, so with certain string/file-handle sizes the server writes up to 5 bytes past the reserved XDR buffer, and with 4-byte-aligned lengths it over-reserves and transmits uninitialized (stale) kernel buffer contents to the client. It is fixed in stable releases 6.12.109, 6.18.50, and 7.2.4 (and 7.3-rc1); no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Out-of-bounds slab write in the Linux kernel's libceph/CRUSH map decoder (crush_decode) lets a malformed CRUSH map corrupt kernel memory on any RADOS client (Ceph RBD or CephFS). Because crush_decode() stores buckets by array slot while the mapper derives each bucket's workspace index from its decoded id, a map encoding an id different from '-1 - slot' makes one bucket alias another's kvmalloc'd workspace; a uniform bucket's second-replica permutation then overflows the smaller aliased buffer, producing a 4-byte OOB write in bucket_perm_choose() confirmed by KASAN. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; the CRUSH map is delivered from the Ceph monitor/OSD map, so exploitation requires a malicious or compromised monitor rather than an arbitrary internet attacker.
Out-of-bounds write in the Linux kernel CephFS client (ceph module) lets a malicious or compromised Ceph monitor corrupt kernel memory on any client with a mounted CephFS. The MDSMap decoder failed to bound export_targets rank values against CEPH_MAX_MDS, and check_new_map() then used each attacker-controlled rank as a bit index into a fixed-size stack bitmap, causing set_bit() to write past the array. No public exploit is identified at time of analysis and EPSS is low (0.17%), but the fix ships across multiple stable trees.
Slab out-of-bounds write in the Linux kernel's CephFS client (ceph_get_name() and __get_snap_name()) lets a malicious or compromised Ceph MDS overflow a NAME_MAX-sized name buffer during NFS-export name resolution. The code copies the MDS-supplied dentry name (rinfo->dname / rde->name) via memcpy and writes a NUL terminator at dname_len without ever checking dname_len against NAME_MAX, so a LOOKUPNAME reply with an oversized name corrupts adjacent slab memory (flagged by KASAN). It is only reachable when a CephFS mount is re-exported over NFS; fixed by the new ceph_export_copy_name() helper that rejects over-length names with -ENAMETOOLONG. No public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Memory-safety corruption in the Linux kernel SUNRPC layer allows a malicious NFS peer to trigger an unsigned integer underflow of the XDR stream length. When gss_krb5_unwrap_v2() decrypts a Kerberos-privacy (krb5p) message, it sets buf->len to a small wire-derived value while the underlying iovec lengths are at page scale; xdr_buf_trim() then subtracts more consumed bytes than buf->len records, wrapping the unsigned length to near UINT_MAX. That corrupted length becomes the authoritative bound for every downstream XDR decoder, enabling out-of-bounds reads and denial of service. A vendor patch is available; this is one of a cluster of related SUNRPC krb5 fixes. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Denial of service (and minor out-of-bounds read) in the Linux kernel's server-side SUNRPC GSS/krb5 code allows a client holding a valid Kerberos GSS context to crash an NFS server exporting with sec=krb5p. svcauth_gss_unwrap_priv() validated only an upper bound on the wire-supplied opaque token length, so a truncated sealed token (len 0-16) reached gss_krb5_unwrap_v2(), which read RFC 4121 header fields past the buffer and hit a divide-by-zero in _rotate_left() (shift %= buf->len with buf->len driven to zero). No public exploit identified at time of analysis; EPSS is low at 0.17% (6th percentile).
Denial of service (and short out-of-bounds read) in the Linux kernel's SUNRPC RPCSEC_GSS Kerberos privacy layer affects gss_krb5_unwrap_v2(), which parses the EC/RRC fields at ptr+4/ptr+6 before confirming the token is at least the 16-byte GSS_KRB5_TOK_HDR_LEN. A malicious NFS-with-krb5p peer supplying a sub-16-byte or malformed wrap token triggers an OOB header read, an unsigned wrap in rotate_left()/xdr_buf_subsegment(), a divide-by-zero in the modulo shift, and a dead BUG_ON that fails to stop a movelen underflow driving a ~UINT_MAX-byte memmove(). There is no public exploit identified at time of analysis; EPSS is 0.17% (6th percentile). The upstream fix adds four defense-in-depth length guards.
Out-of-bounds reads in the Linux kernel SUNRPC RPCSEC_GSS privacy (krb5p) receive path allow a malicious or compromised NFS server to crash or leak memory from a connecting client. The function gss_unwrap_resp_priv() validated the opaque token length with a single u32 addition (offset + opaque_len) and no lower bound, so a crafted reply with opaque_len near 0xffffffff wraps the sum below rcv_buf->len and passes the check, while any length below GSS_KRB5_TOK_HDR_LEN is forwarded to gss_krb5_unwrap_v2(), whose pre-decrypt header reads at ptr+4/ptr+6 then run past the token. There is no public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a config-gated, DoS-leaning memory-safety bug rather than a broadly weaponizable RCE.
Denial-of-service (and potential memory corruption) in the Linux kernel's NFS-over-RDMA server (svcrdma) arises from offset arithmetic defects in svc_rdma_read_chunk_range(). A malicious or malformed RDMA client can craft Read-chunk segment lists whose offset/length values trigger a u32 underflow, producing a near-UINT_MAX per-segment length that propagates an enormous nr_bvec into svc_rdma_build_read_segment() and a multi-MiB kmalloc_array_node() allocation, while also silently dropping bytes from rebuilt chunks. Affected kernels are those with NFS-over-RDMA serving enabled from v5.11 onward; there is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Out-of-bounds heap write in the Linux kernel's server-side RPC-over-RDMA transport (svcrdma), used by the in-kernel NFS server, allows a malicious RPC-over-RDMA client to corrupt slab memory. When a client requests a reply (such as an NFS READ payload) without supplying a Write list or Reply chunk, and that reply needs more scatter/gather entries than the RDMA device's Send Queue supports, svc_rdma_pull_up_reply_msg() linearizes the entire reply into the fixed sc_max_req_size buffer; because the reply size is bounded only by the client request, the copy runs past the buffer and the oversized length is also posted to the device. There is no public exploit identified at time of analysis, and EPSS is low (0.17%).
A remotely triggerable use-after-free in the Linux kernel SCTP stack (net/sctp) lets a malicious SCTP peer free an association and its transports mid-processing, then have the kernel operate on the freed memory. By bundling COOKIE ECHO, SHUTDOWN, and SHUTDOWN ACK chunks in one packet, the peer creates an association and immediately drives it to sctp_sf_do_9_2_final(), freeing it; a subsequent chunk in the same packet then writes to the freed transport (last_time_heard) and passes the freed association to sctp_do_sm(). No public exploit is identified at time of analysis and EPSS is low (0.17%, 6th percentile), consistent with a memory-corruption bug in a non-default subsystem rather than a mass-exploited flaw.
Use-after-free in the Linux kernel SCTP stack (net/sctp) allows a peer in an established, authenticated SCTP association to trigger a stale transport reference by removing an IP address via ASCONF DEL-IP while an inbound packet is still being processed. sctp_rcv() caches the resolved transport in chunk->transport, but a concurrent sctp_assoc_rm_peer()/sctp_transport_free() can free it during the backlog window or before bh_lock_sock(), after which a delayed SACK causes sctp_outq_select_transport() to read freed memory. Fix drops such chunks in sctp_inq_push(); no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Out-of-bounds heap write in the Linux kernel's XDP subsystem allows memory corruption when an AF_XDP zero-copy packet is redirected through cpumap. The xdp_convert_zc_to_xdp_frame() routine copies an XSK packet into an order-0 page but advertises the full PAGE_SIZE as usable and records zero headroom, letting the frame overrun the page tail reserved for skb_shared_info and triggering a KASAN slab-out-of-bounds write in skb_gro_receive during GRO processing. No public exploit identified at time of analysis and EPSS is low (0.17%); the vendor has released fixes across stable branches.
Use-after-free in the Linux kernel NFSD server's NFSv4.1+ callback channel lets a slab object be read after it is freed when a client's session is torn down. After a DESTROY_SESSION, the teardown path can kfree() a session while an inflight callback rpc_task on rpciod still dereferences clp->cl_cb_session, because flushing the callback workqueue does not wait for tasks already handed to rpc_call_async() and the 1-second rpc_shutdown_client() drain can be outlived by tasks parked in rpc_delay() during NFS4ERR_DELAY retries. The fix RCU-protects cl_cb_session and switches session freeing to kfree_rcu(); no public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a race-dependent server-side kernel bug rather than a mass-exploitation target.
Use-after-free / dangling-pointer corruption in the Linux kernel NFSD server allows an NFSv4.2 client performing an asynchronous server-side COPY to leave a stale IDR entry in the s2s_cp_stateids table, pointing at per-request COMPOUND buffer memory that is immediately recycled. When the NFSD laundromat or manage_cpntf_state() later walks that IDR, it dereferences reused request memory and can be steered into refcount_dec()/idr_remove()/kfree() on attacker-influenced garbage, corrupting kernel memory or crashing the server. No public exploit is identified at time of analysis, EPSS is low (0.17%, 6th percentile), and a vendor patch is available; the CVSS 9.8 rating substantially overstates the practical risk.
A use-after-free in the Linux kernel NFSD server's asynchronous server-side copy (NFSv4.2 COPY offload) lets teardown paths race the copy kthread, corrupting or freeing the copy object early. When an OFFLOAD_CANCEL request, an nfsd export/superblock shutdown, or a per-filesystem cancel runs concurrently with the reaping copy kthread, nfsd_file structures (nf_src/nf_dst) are double-put and freed, the STOPPED flag is set before final dereferences, and the copy_task/callback are used after free - causing NULL derefs, double frees, and UAF that can crash an NFSv4.2-serving host. Fixed in stable kernels 6.18.51, 7.2.4, and 7.3-rc1; no public exploit identified at time of analysis and EPSS is low (0.17%).
Use-after-free in the Linux kernel's NFS server (nfsd) allows a freed nfs4_client structure to be dereferenced during NFSv4 delegation revocation. When a recalled delegation times out, nfs4_laundromat() briefly unhashes it from cl_delegations before revoke_delegation() relinks it onto cl_revoked, and in that window client_has_state() can report no remaining state, letting free_client() run while revoke_delegation() is still about to touch cl_lock. Fixed versions are available; no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Use-after-free in the Linux kernel's ksmbd in-kernel SMB3 server lets any authenticated SMB client holding a durable batch oplock corrupt kernel memory during oplock-break notification. smb2_oplock_break_noti() reads opinfo->conn without a lock and dereferences it after two sleep-capable allocations; if the durable handle owning the oplock is disconnected concurrently, the connection is freed and a racing break from another connection resurrects the stale pointer, leading to a use-after-free in ksmbd_conn_write(). No public exploit identified at time of analysis, and EPSS is low (0.17%), consistent with a race-dependent, DoS-leaning memory-safety bug rather than a turnkey RCE.
Use-after-free in the Linux kernel's NFS server (nfsd4_create_file, the NFSv4 OPEN-with-create path) allows a stale dentry to be dereferenced after being freed. When the exported filesystem is itself NFS (an NFS re-export), dentry_create() can return a different dentry than the one passed in, so the original 'child' dentry already recorded in resfhp may be freed and later dereferenced via fh_compose(), leading to memory corruption and likely a server crash. No public exploit identified at time of analysis; EPSS is low at 0.16% (6th percentile), and the fix is available upstream in stable kernels.
Use-after-free in the Linux kernel CephFS client (check_new_map()) lets a freed ceph_mds_session be dereferenced during MDS map processing, enabling memory corruption and likely denial of service on machines with a mounted CephFS. When check_new_map() releases mdsc->mutex to handle a session's address change, reconnect, or active transition, it fails to take a reference on the session (unlike the forced-close path), so a concurrent thread can unregister and kfree that session before the original thread touches s->s_mutex. This is no public exploit identified at time of analysis; EPSS is low at 0.16%.
Out-of-bounds slab read in the Linux kernel NTFS driver's cluster allocator lets a crafted NTFS image trigger a KASAN-detected memory read when a file on the volume is extended. The free-cluster bitmap array (vol->lcn_empty_bits_per_page) is sized from the volume's nr_clusters at mount, but ntfs_cluster_alloc() bounds its scan by the on-disk $Bitmap size instead; an image whose $Bitmap advertises more clusters than the volume actually has drives the allocator past the array. Reported through the Linux stable tree with an upstream fix; no public exploit identified at time of analysis and EPSS is low (0.16%).
Denial of service in the Linux kernel NFS server (nfsd) pNFS layout subsystem allows an authenticated NFSv4.1+ client to leak layout stateids, gradually exhausting kernel memory. A race in the layout fence/recall path (lm_breaker_timedout) lets the block-lease breaker acquire a duplicate sc_count reference that is never released, pinning the layout stateid forever. Rated CVSS 9.8 but the real-world impact is availability-only and gated on a niche pNFS export configuration plus a race window; no public exploit identified at time of analysis and EPSS is very low (0.15%, 5th percentile).
Out-of-bounds kernel memory write in the Linux kernel ntfs3 driver allows a local attacker to corrupt memory by mounting a crafted NTFS image. ntfs_attr_update_meta() shifts an attribute name forward by eight bytes when converting a non-sparse attribute to sparse (to insert the compressed_size field), but the record validator never confirms name_offset is within bounds, that the name does not overlap the mapping pairs, or that eight free bytes exist after mapping_pairs_offset - so a malicious MFT record can force a write past the attribute boundary. No public exploit identified at time of analysis; EPSS is low at 0.15% (5th percentile) and the issue is fixed in kernel 7.2.4 and 7.3-rc1.
Unauthenticated PHP Object Injection in the ThemeREX Addons (trx_addons) WordPress plugin before 2.45.0 lets remote attackers inject arbitrary serialized PHP objects into the application. Because no authentication is required (CVSS 9.8, PR:N/UI:N), an attacker can supply crafted serialized data to a vulnerable entry point; when combined with a suitable POP gadget chain present in the plugin, another plugin, a theme, or WordPress core, this can escalate to code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection affects the Everest Forms WordPress plugin (wpeverest) in all versions up to and including 3.6.0, allowing remote attackers to pass attacker-controlled serialized data into a PHP unserialize() call. If a suitable POP (property-oriented programming) gadget chain is present in the plugin, an installed theme, or WordPress core, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack; no public exploit identified at time of analysis, and no EPSS or KEV signal was provided.
Sensitive information embedded in the source code of Fortinet FortiMonitorOnSight (7.2.0-7.2.2 and 7.2.4-7.2.7) can be recovered by an attacker and leveraged to bypass access controls. The exposed data (CWE-540) may include credentials, keys, or other secrets that grant unauthorized access to protected functionality. No public exploit is identified at time of analysis, and the CVE's own attack-vector text is an unfilled placeholder, so the exact delivery path is not documented by the vendor.
Unsafe UAV swarm trajectory planning in Robotics-STAR-Lab's RACER exploration framework (SYSU STAR Group, commit abcdef1234567890) arises from a missing default case in the finite-state machine: when a drone transitions into the IDLE state, it silently stops publishing swarm trajectories, which can lead peer drones to plan collision-prone paths and physically collide. This is a logic/safety defect in academic research code rather than a memory-corruption or data-exposure flaw. A gist writeup is referenced (publicly available exploit code exists as a proof-of-concept), but there is no CISA KEV listing and no EPSS signal provided.
Authentication bypass in the Xiongmai XM530 IP camera firmware (HMT.CM2005-v220608.1837 and earlier) lets remote unauthenticated attackers execute privileged ONVIF actions - PTZ control, RTSP/stream URL retrieval, and system reboot - by sending a crafted SOAP request supplying the admin username with any arbitrary password whenever the account's stored password is empty. The flaw sits in the WS-Security (wsse:UsernameToken) verification routine of the Sofia IPC daemon, which fails to reject a token when no password is set. Publicly available exploit code exists (GitHub research repository); no public evidence of active in-the-wild exploitation at time of analysis.
Local privilege escalation in the ST Engineering iDirect iQ200 VSAT satellite terminal (firmware 23.0.1.0) allows a holder of the factory-installed low-privilege field-technician account to gain full administrative control of the device. Because the low-privilege account ships pre-configured on every unit, no credentials must be phished, obtained, or brute-forced - the initial foothold is built in. No public exploit has been identified at time of analysis; the flaw was reported through CISA ICS-CERT (advisory ICSA-26-183-01).
A DMA-isolation misconfiguration in the Linux kernel's Intel VT-d IOMMU driver (iommu/vt-d) allows Access Control Services (ACS) to remain disabled while the IOMMU is force-enabled by tboot. The detect_intel_iommu() routine did not account for trusted-boot state, so when a user opt disabled ACS but tboot_force_iommu() later forced the IOMMU on, peer-to-peer DMA isolation could be silently weaker than the platform intended. The fix adds a tboot check so ACS is requested whenever tboot is active. No public exploit identified at time of analysis; EPSS is 0.17% (6th percentile).
Unauthenticated root-level remote code execution affects WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922. The sync_server daemon listening on TCP port 13136 builds a shell command via sprintf() using an attacker-supplied filename and passes it to system() without sanitization, so a crafted filename containing shell metacharacters yields arbitrary command execution as root. Public exploit code exists (GitHub POC by camdsmith), reported by VulnCheck; the flaw is network-reachable with no authentication and no user interaction.
Arbitrary file write in Mistral Vibe (the AI coding agent), introduced in version 1.3.4, lets an attacker create or overwrite files anywhere the Vibe process can reach - without triggering the tool's user-approval gate. The root cause is that shell redirection targets (e.g. '>' and '>>') are stripped from permission evaluation, so an otherwise allowlisted command can silently redirect its output to paths outside the active workspace. Reported by HiddenLayer; publicly detailed in their security advisory, with no public exploit code identified at time of analysis and no CISA KEV listing.
Sandbox/permission-restriction bypass in the Hugo static site generator (versions after v0.43, fixed in v0.165.0) lets a Node tool invoked during a build read and write files outside the project's working directory. Because TailwindCSS ships in the default security.exec.allow list and must be run with highly permissive Node flags (--allow-addons, --allow-child-process, --allow-worker), the Node permission model that was supposed to contain build tools (from the fix for GHSA-x597-9fr4-5857) is effectively neutralized. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file disclosure in the Hugo static site generator (versions after v0.123.0 and before v0.165.0) lets an attacker read files outside the intended project boundary by planting a symlink in a mounted directory. Because parent-directory symlinks were not dropped during direct resource lookups, functions like resources.Get and os.ReadFile follow the symlink and embed the target file's contents into the built site. Reported by VulnCheck; no public exploit identified at time of analysis, and this is an incomplete-fix follow-up to two prior advisories (GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw).
Stored cross-site scripting in the WWBN AVideo Bookmark plugin lets a video owner persist a JavaScript payload through the bookmark/chapter name parameter, which is concatenated into public watch-page HTML without output encoding (CWE-79). Every viewer of the affected video then executes attacker-controlled script in the AVideo origin, enabling session/account compromise of ordinary users and administrators. Reported by VulnCheck with a public advisory; no CISA KEV listing and no weaponized exploit code identified, though technical detail in the advisory lowers the barrier to reproduction.
Stored cross-site scripting in the LoginControl plugin of WWBN AVideo allows an authenticated low-privilege user to persist malicious JavaScript by submitting a crafted PGP public key, which is echoed unencoded into a textarea and executes in an administrator's browser session when the admin views the attacker's profile tab. This is a privilege-escalation vector - attacker-controlled script runs with admin session context, enabling account/platform takeover. VulnCheck reported it with a published GitHub Security Advisory; no public exploit is identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo's CustomizeUser plugin lets an administrator persist an unsanitized field_name value through the add.json.php endpoint, which later executes as script when any user or admin renders the extra-info pages or profile forms via the typeToHTML function. The flaw affects AVideo up through commit c3edcc274c389816d434acadac07ee78eaf330c1 and was reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo (through commit c3edcc27) lets an authenticated user poison their own 'donationLink' profile field, which is later rendered unencoded inside an <a href="..."> attribute on the video watch page. Because User::save() validates the value only with FILTER_VALIDATE_URL (which accepts embedded double quotes and event handlers) and getDonationLink() applies only strip_tags(), an attacker can break out of the href attribute and execute JavaScript in the browser of any visitor - including an administrator - who hovers over the donation button. Reported by VulnCheck; publicly available exploit code exists via the advisory, and the issue was unfixed at time of reporting.
Stored cross-site scripting in the YPTWallet plugin of WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets an authenticated low-privilege user plant malicious markup via a CryptoWallet configuration value that is base64-encoded but never HTML-escaped before being written to wallet_log.information. When an administrator reviews pending withdrawal requests in pendingRequests.php, the payload executes in their session, enabling attacker-driven administrative actions through same-origin fetch requests. Reported by VulnCheck with a vendor GitHub Security Advisory (GHSA-fvp5-q9jp-29mx); no public exploit identified at time of analysis.
Privilege escalation in Cloud Foundry UAA (User Account and Authentication server) lets users who authenticate via a federated OIDC provider obtain the powerful uaa.admin scope even though operators intended to restrict that provider using the externalGroupsWhitelist configuration. The flaw manifests only when an OIDC identity provider is configured with groupMappingMode: AS_SCOPES together with a wildcard (*) externalGroupsWhitelist entry, causing the wildcard to grant all mapped external groups as scopes - including uaa.admin. No public exploit has been identified at time of analysis, and the vulnerability requires a specific non-default IdP configuration.
Unauthenticated administrative access to a bundled inventory-management component (CVE-2026-90456) is possible when operators deploy the shipped example configuration file, which contains a fixed, publicly-known default administrative password. Any deployment that copies this example environment file into active configuration without executing the setup routine that regenerates credentials exposes the component's admin interface to anyone who knows the well-documented default value. Reported through CISA ICS-CERT (advisory icsa-26-254-01); no public exploit identified at time of analysis, though the default credential is inherently 'public' by nature of shipping in the distribution.
Full user impersonation in the Laci Synchroni sync server (backend prior to 1.2.3) lets an attacker take over any account by editing the client-side `UID` in their local config.json before login. The server's OAuth2 flow never verified that the authenticated OAuth2 identity actually owned the requested UID, so `AuthorizeOauthAsync` in SecretKeyAuthenticatorService would issue session tokens for an arbitrary target user. Publicly available fix code exists (PR #28, commit 5bc3efd); no known active exploitation and no EPSS/KEV signal was provided.
Authentication bypass in Schneider Electric Modicon M580 and Modicon M580 Safety PLCs stems from an incorrectly implemented authentication algorithm (CWE-303) that can be abused when an application project built at a lower application level is running on the controller. Remote attackers can compromise the confidentiality, integrity, and availability of the PLC, per the vendor's CVSS 4.0 base score of 9.2. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Arbitrary file read in Mistral Vibe (Mistral AI's agentic coding assistant), introduced in version 2.6.0, lets attackers read files outside the active workspace sandbox without triggering user approval. The flaw stems from improper handling of quotation marks during path validation: a quoted absolute path embedded in an allowlisted shell command is treated as permitted, bypassing the workspace restriction that normally confines the agent. No public exploit identified at time of analysis and no EPSS/KEV signal is available, but the HiddenLayer advisory documents the bypass technique.
XML external entity (XXE) injection in Perforce's Akana API Platform allows remote unauthenticated attackers to abuse improperly restricted external references during XML-to-JSON processing. Affected builds are 2026.1, 2025.1.1, and every release before 2024.1.6 (including older unsupported versions); Perforce has shipped a security patch in the latest supported releases. No public exploit identified at time of analysis, but the CVSS 4.0 score of 9.2 and the unauthenticated network vector make this a high-priority patch for any exposed Akana gateway.
Stored cross-site scripting in WWBN AVideo (open-source video CMS) allows an administrator holding the canAdminUserGroups permission to persist malicious HTML/JavaScript through UserGroups::setGroup_name(), which then executes in the browser of any other administrator who opens the user manager interface. Affects all builds through commit c3edcc274c389816d434acadac07ee78eaf330c1. Reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Unintended ACL deletion in the Linux kernel NFSD server affects the NFSACL v2 SETACL path, where nfsacld_proc_setacl() passes both the access and default ACL pointers to set_posix_acl() unconditionally even when the request mask omits one of them. Because set_posix_acl(..., NULL) is the VFS 'remove this ACL type' operation, an NFS client sending a SETACL that carries only NFS_ACL silently strips the directory's default ACL, and a mask of 0 strips both, corrupting on-disk access controls. This is the NFSACL v2 counterpart of the same defect already fixed in nfsd3_proc_setacl(); it is a fixed upstream integrity bug with no public exploit identified at time of analysis and a low EPSS score (0.21%).