Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the repository commits API, which fails to confine paths and does not enforce authentication. All 18.7 releases through 19.3.2 are affected across the fix lines (before 19.1.8, 19.2.6, and 19.3.2). This is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, making it an emergency-patch priority for any internet-reachable GitLab instance.
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Chat access to exfiltrate Advanced Search (Elasticsearch) instance configurations and stored credentials by supplying a specially crafted GraphQL subscription argument that bypasses serialization and forces an internal server object lookup. It affects EE 18.3 through 19.1.8, 19.2 through 19.2.6, and 19.3 through 19.3.2, was reported by GitLab, and publicly available exploit code exists (HackerOne #4012289). No CISA KEV listing at time of analysis, so this is POC-backed but not confirmed as actively exploited.
Remote code execution in The Events Calendar plugin for WordPress (StellarWP) affects all versions up to and including 6.17.4, allowing unauthenticated attackers to run arbitrary PHP on the server via unsafe deserialization. The is_safe_widget_instance guard is bypassed because PHP fires magic methods during pre-parse and enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() executes; the malicious block markup reaches the sink through the V2 single-event template running do_blocks() over buffered comment HTML. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, though the vulnerability is well-documented with pinpointed source-line references.
Man-in-the-middle interception of protected ICS communications affects the ASE/Kalkitech ASE2000 V2 Communication Test Set versions 2.35 through 2.37 on Windows, whose IEC 60870-5-104 TLS client (Task Mode) improperly validates server certificates. A network-positioned attacker can present a certificate containing multiple simultaneous defects that the client accepts, defeating TLS authentication and exposing/altering traffic between the test set and a downstream RTU/IED. No public exploit code or CISA KEV listing is identified at time of analysis, and no EPSS score was provided; risk is elevated by the ICS/OT context rather than by evidence of active exploitation.
Remote code execution in The Events Calendar WordPress plugin (StellarWP) through version 6.17.3 lets unauthenticated attackers run arbitrary PHP on the server by abusing Element_Classes::parse_array(). A plain-array widget 'classes' payload evades the is_safe_widget_instance() object check and reaches a callable-invocation sink; the chain fires when do_blocks() renders a single-event page whose comment area contains a crafted wp:legacy-widget block. Reported by Wordfence with a 9.8 CVSS; no public exploit identified at time of analysis, and the flaw is only reachable on sites that enable comments on tribe_events posts.
Remote code execution in the Masteriyo LMS WordPress plugin before 3.4.1 allows an attacker holding a minimal account (e.g. subscriber/student) to inject arbitrary PHP objects via user-supplied metadata that is unserialized on read-back, and to leverage a gadget class in a bundled library to write and execute arbitrary code on the server (CWE-502). A weaker unauthenticated variant of the same flaw yields arbitrary file write rather than full code execution. Publicly available exploit detail exists via WPScan; EPSS is low (0.17%, 6th percentile) and there is no public exploit identified as weaponized in the wild.
Remote code execution in the DS Ad Rotator WordPress plugin (all versions through 0.8) allows unauthenticated attackers to upload arbitrary files, including PHP scripts, because the image upload handler enforces no capability check, no nonce verification, and no file-type validation. Any anonymous visitor can drop a web shell into a web-accessible directory and execute it for full server compromise. WPScan reports the flaw with a public advisory; no public exploit is identified at time of analysis and EPSS risk is low (0.20%), but the exploitation technique is trivial and well understood.
Authentication bypass in the Frontegg SAML SSO WordPress plugin through version 1.0.1 lets unauthenticated remote attackers log in as any user, including administrators, because the plugin establishes a session from a SAML authentication response without verifying its cryptographic signature or issuer. Attackers can also create arbitrary accounts, giving them a persistent foothold. No public exploit identified at time of analysis; EPSS is low (0.19%, 8th percentile) but this reflects lack of observed activity, not difficulty of exploitation.
Unauthenticated remote code execution in the 'WP images upload on piclect' WordPress plugin (versions through 1.0) arises because the plugin writes uploaded files to a publicly accessible directory without validating the filename or MIME/content type. Any remote attacker can upload a PHP file and request it directly to run arbitrary code as the web server. Reported by WPScan with a maximal 9.8 CVSS; no public exploit code is identified at time of analysis and EPSS remains low at 0.16%.
Unauthenticated site takeover in the WP Component WordPress plugin through version 2.2.4 stems from an AJAX-style action exposed to logged-out users that performs no capability or nonce validation and blindly writes an attacker-supplied option name and value. Because the handler can overwrite arbitrary wp_options entries, an attacker can flip 'users_can_register' on and set 'default_role' to administrator, then self-register an admin account. Reported by WPScan; carries CVSS 9.8 with EPSS 0.14% (3rd percentile) and no public exploit identified at time of analysis.
Arbitrary file deletion in the CODE MONKEYS PROPOSALS WordPress plugin (all versions through 1.0.1) allows any authenticated user - including a low-privileged subscriber - to delete arbitrary files on the server, because the plugin neither validates the user-supplied file path nor checks the caller's capability. Deleting critical files such as wp-config.php can force WordPress into a reinstallation state, enabling full site takeover. Reported by WPScan; publicly available exploit code exists via the WPScan advisory, though EPSS remains low at 0.15% (4th percentile) and it is not listed in CISA KEV.
Arbitrary file deletion in the WebTotem Backups WordPress plugin (through version 1.0.1) allows any authenticated low-privilege user, including a subscriber, to delete arbitrary files on the server. The plugin fails on three fronts at once: it does not validate the user-supplied file path, performs no capability check on the requester, and discards the outcome of its own CSRF nonce check. Deleting critical files such as wp-config.php can trigger a full site takeover. No public exploit has been identified at time of analysis and EPSS is low (0.11%), but the flaw was reported by WPScan.
Stack buffer overflows in sngrep through 1.8.4 allow unauthenticated remote attackers to crash or execute arbitrary code on any host running sngrep while actively capturing SIP traffic. The flaws reside in `call_get_attribute()` (src/sip_call.c) and `msg_get_attribute()` (src/sip_msg.c), where unbounded `sprintf` calls copy SIP header values - including Call-ID, X-Call-ID, Reason, From, To, Contact, and request/response strings - into a fixed 255-byte stack buffer without length enforcement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the upstream fix commit is publicly accessible, making independent weaponization feasible.