Missing authorization on an AJAX endpoint in the CryptoPayment Gateway WordPress plugin (versions 1.2.1 through 1.2.2) lets remote unauthenticated attackers invoke administrative operations. An attacker can delete arbitrary files on the server, overwrite the payment gateway configuration, and read stored wallet credentials in cleartext. Publicly available exploit detail exists (reported by WPScan); there is no public evidence of active exploitation at time of analysis, though the CVSS vector (10.0, AV:N/AC:L/PR:N/UI:N/S:C) marks it as trivially exploitable.
ZooKeeper credential disclosure in Apache Storm 3.0.0 exposes `storm.zookeeper.topology.auth.payload` through two independent channels: Nimbus serves the full topology configuration verbatim to any caller holding read-only permissions, and the submission client logs the same payload at INFO level on every submission while SASL handlers emit it at DEBUG. An authenticated user with only read-only topology view rights can recover the ZooKeeper write credential and use it to forge or suppress worker heartbeats, backpressure, and error state for the affected topology, or indirectly obtain it via log aggregation pipelines or support bundles. No public exploit has been identified; vendor-released patch version 3.1.0 is available.
Unauthenticated remote attackers can exhaust the heap of the Apache Storm DRPC server by sending requests with arbitrarily many distinct function names, causing a permanent, unbounded memory leak that accumulates until the process is killed by OOM. Affected is org.apache.storm:storm-server versions 3.0.0 through 3.0.x; version 3.1.0 is the fix release. Because drpc.authorizer is unset in the default configuration, no credentials are required to trigger the condition, making this a zero-configuration DoS against any network-reachable DRPC endpoint. No public exploit code has been identified at time of analysis.
Unauthenticated remote memory exhaustion in Apache Storm Worker (org.apache.storm:storm-client 3.0.0-3.0.x) allows any TCP peer reachable to a worker slot port to drive arbitrarily large JVM heap allocations with a single crafted frame. The Netty pipeline installs the message decoder ahead of SASL authentication handlers, and the default value of storm.messaging.netty.authentication is false, meaning no credentials are required regardless of configuration. Impact is availability-only - worker process crash or severe GC pressure at the 768 MB default heap - with no code execution or data exfiltration path. No public exploit has been identified at time of analysis; the vulnerability was discovered via automated Claude agent security research and validated by the Apache Storm project.
Authorization bypass in Apache Storm Client 3.0.0 permits any authenticated Nimbus principal to perform unrestricted user-level cluster operations when access control is configured via `nimbus.groups` alone. The `SimpleACLAuthorizer` evaluates user-level commands by returning early with a grant when `nimbus.users` is empty, never reaching the group evaluation branch, so group restrictions are silently ignored. Operators who followed the documented `nimbus.groups`-only access control pattern in `docs/SECURITY.md` would believe their cluster was restricted while every authenticated credential held full permission to submit topologies, upload files, and retrieve Nimbus configuration. No public exploit code exists and no CISA KEV listing is present at time of analysis.
Stored cross-site scripting in Strapi's headless CMS admin panel allows a low-privileged Author to inject persistent JavaScript that runs in the session of Editor or Super Admin reviewers. The WYSIWYG preview component (PreviewWysiwyg.tsx) rendered markdown through a sanitize-html configuration set to allowedTags:false, permitting script tags to survive into the DOM; when a higher-privileged user expands the preview pane the payload executes, enabling account takeover. It affects Strapi 4.x through 4.26.2 and 5.x before 5.48.1, was reported by VulnCheck, and carries a CVSS 4.0 base of 9.3, with no public exploit identified at time of analysis.
Administrator account takeover in LangBot before 4.10.11 stems from password-recovery keys generated with only 24 bits of entropy (secrets.token_hex(3)) combined with a total absence of rate limiting on the unauthenticated reset-password endpoint. A remote attacker who knows the administrator's email address can fire concurrent requests to exhaust the ~16.7M-value keyspace and reset the admin password, seizing full control of the instance. VulnCheck reported the issue and a vendor patch exists (4.10.11); no public exploit is identified at time of analysis, and the flaw is not in CISA KEV.
Cross-tenant blob deletion and cluster-wide denial of service in Apache Storm Nimbus 3.0.0 allow authenticated topology submitters to arbitrarily delete blobstore keys owned by other tenants or permanently disable cluster leadership. Nimbus accepts `dependency_jars` and `dependency_artifacts` lists without validating their contents at submission time: during topology cleanup Nimbus deletes listed keys as itself (bypassing ACL checks), and on acquiring leadership Nimbus surrenders leadership for any topology whose dependency keys are absent - allowing a single malicious submission to loop all Nimbus daemons into perpetual leader-election, leaving the cluster inoperable. No public exploit has been identified at time of analysis, but the DoS path requires only valid topology submission credentials.