Unauthenticated stored XSS in the YouTube Embed WordPress plugin (versions 10.0-10.3) allows any unauthenticated site visitor to inject and persist arbitrary JavaScript in the WordPress database by exploiting an AJAX endpoint that performs no authorization check beyond a nonce embedded in every public-facing page. The stored payload executes in the browser session of any subsequent visitor or administrator who views the affected content, enabling session hijacking, administrative account takeover, or full site compromise. A publicly available exploit exists (reported by WPScan), materially elevating real-world risk for any site running the affected plugin versions.
The GenieWords WordPress plugin versions 1.5.27 through 1.5.34 allows unauthenticated attackers to overwrite plugin configuration via unprotected REST API and AJAX endpoints, then achieves persistent stored XSS on every front-end page because stored values are decoded and printed without sanitization. Any site visitor who loads a front-end page becomes an XSS victim, enabling session hijacking, credential theft, or malicious redirects at scale. A publicly available exploit exists (WPScan); no active exploitation is confirmed in CISA KEV at the time of analysis, but the unauthenticated attack path and low complexity make opportunistic mass-scanning feasible.
Unauthenticated stored XSS and theme settings destruction in the Hoo Companion WordPress plugin (≤1.0.2) allows any remote attacker to inject persistent JavaScript into the active theme's settings via the plugin's ungated import endpoint, causing malicious scripts to execute in every visitor's browser including administrators. The same single request unconditionally overwrites and destroys the site's existing theme settings, combining a persistent cross-site scripting attack with immediate site defacement. A publicly available exploit exists via WPScan; no public exploit identified at time of analysis for active exploitation (not in CISA KEV).
Local privilege escalation in Tonec Internet Download Manager (IDM) versions up to 6.42 Build 63 on Windows allows a low-privileged local attacker to gain full SYSTEM-level kernel control by exploiting improper access controls in the idmwfp.sys kernel driver (CWE-284). A public proof-of-concept exploit is available on GitHub under the repository name IDM_LPE_PoC, substantially lowering the barrier to exploitation. The vendor was notified prior to disclosure but did not respond, and no patch has been released at time of analysis.
Sandbox escape in CrewAI's CodeInterpreterTool allows untrusted Python code to break out of the in-process restricted execution environment and execute arbitrary commands on the host system. Pre-fix versions implemented import-time module name blocking as the sole security boundary, which is bypassable because Python's complete object graph remains accessible - for example, `ctypes.CDLL(None)` loads the C standard library via the dynamic linker without invoking any import machinery, and `__class__.__mro__` traversal can recover the original `__import__` built-in. All crewai-tools deployments using CodeInterpreterTool without Docker (triggering the now-removed fallback sandbox) are affected. No public exploit code or KEV confirmation exists at time of analysis, though the researcher advisory and vendor commit both describe the escape technique explicitly.
Unauthenticated permanent deletion of arbitrary WordPress content is possible in sites running the MDJM Event Management plugin (before 1.7.8.5) or Mobile Events Manager plugin (through 1.4.8.3). Both plugins expose a playlist entry removal endpoint that performs no capability check, nonce validation, or post-type verification before permanently deleting the post identified in the request, bypassing the WordPress trash mechanism. A publicly available proof-of-concept exploit reported by WPScan makes this trivially exploitable against any affected installation, with irreversible content destruction as the outcome.
Two-factor authentication bypass in the Really Simple Security WordPress plugin (versions before 9.8.1) allows an attacker who already holds a target account's password to eliminate that account's email 2FA requirement entirely and obtain the resulting session, up to administrator level. The root flaw is an unauthenticated endpoint that resets a completed email 2FA enrollment, collapsing multi-factor authentication to single-factor for the attack window. A publicly available exploit has been published via WPScan, and the vendor has released a fix in version 9.8.1.
Privilege escalation in the User Registration & Membership WordPress plugin (versions 4.4.6 through pre-5.2.8) allows any subscriber-level authenticated user to be granted the WordPress role attached to a paid membership plan without completing payment, by exploiting a missing capability check and absent payment method and plan validation on the purchase endpoint. Where site administrators have configured membership plans mapped to privileged WordPress roles - including administrator - this results in full privilege escalation from subscriber to administrator without financial transaction. A publicly available proof-of-concept exploit from WPScan confirms the attack path is well-documented and reproducible against sites with open user registration.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.8 allows any authenticated user holding an Author-level role or above to assign themselves an arbitrary WordPress role, including Administrator, resulting in full site takeover. The plugin fails to enforce server-side authorization checks when creating membership plans and when users attach plans to their own accounts, permitting role manipulation that bypasses WordPress's native access-control hierarchy. A publicly available exploit exists via WPScan, and the CVSS 7.2 score understates real-world risk because the provided PR:H metric conflicts with the description's requirement of only Author-level access - a low-privilege role - suggesting a closer real-world base score of approximately 8.8.
Stack buffer overflow in SIPp through 3.7.7 allows unauthenticated remote attackers to crash the process by sending a crafted SIP message whose To header tag parameter is 2049 bytes or longer. The get_peer_tag() function in sip_parser.cpp copies the tag value into a fixed-size static buffer without a bounds check, enabling the overflow and resulting in a process crash. No public exploit has been identified at time of analysis, but the trigger condition is trivial to reproduce given the precise byte threshold documented by VulnCheck, and an upstream fix has been committed.
Stack-based buffer overflow in SIPp through 3.7.7 allows a malicious SIP server to crash the client process by sending a crafted 401 or 407 authentication challenge containing an oversized algorithm parameter. The flaw originates in createAuthHeader() at src/auth.cpp:183-192, where the original code uses strncpy bounded by end-start (an attacker-controlled length derived from the algorithm field) rather than the fixed size of the stack-allocated algo buffer. No public exploit has been identified at time of analysis, but upstream fix code is publicly available via GitHub PR #880.
Arbitrary code execution in ESPnet before v.202609 is triggered when a user loads an attacker-crafted PyTorch checkpoint through any of the framework's model initialization, fine-tuning, or averaging pipelines. The root cause is CWE-502 (Deserialization of Untrusted Data): ESPnet called torch.load with weights_only=False across at least four distinct code paths, allowing pickle-embedded payloads to execute arbitrary commands with the privileges of the ESPnet process. No public exploit has been identified at time of analysis, but the attack technique - crafting malicious PyTorch pickle checkpoints - is thoroughly documented in the ML security community and requires minimal skill to reproduce.
Cross-tenant code execution in Apache Storm Client 3.0.x allows any authenticated cluster user to pre-position a malicious JAR under a predictable blob key and have it loaded into a victim tenant's worker topology. The blob key for `--artifacts` dependency uploads is derived solely from the Maven coordinate, making it identical and guessable for all cluster principals; when the key already exists the client silently reuses the blob without verifying ownership or content integrity. Exploitation results in arbitrary code execution inside the victim's Storm topology, enabling full access to the data and credentials that topology processes. No public exploit has been identified at time of analysis.
Path traversal in rustypaste before 0.18.1 permits unauthenticated remote attackers to write uploaded content to arbitrary filesystem locations by supplying path traversal sequences (e.g., '../../') in the optional custom `filename` HTTP header. The flaw is a validation-ordering error in `src/paste.rs`: the upload destination is validated against the configured upload directory before the attacker-controlled filename header is applied, so the directory-escape check never evaluates the final resolved path. No public exploit has been identified at time of analysis, but the fix commit and GitHub issue make the exact vulnerable code pattern publicly visible, substantially lowering the barrier for reproduction.
Denial of service in UnrealIRCd's embedded webserver (versions 6.0.5-6.2.6) allows unauthenticated remote attackers to exhaust server memory by sending an HTTP request containing an unbounded number of headers, rendering the IRC daemon unresponsive. The attack surface exists only when a WebSocket or JSON-RPC listener is explicitly enabled, both of which are disabled in the default configuration. The issue is resolved in version 6.2.7 per the vendor advisory, and no public exploit code has been identified at time of analysis.
SIPp's get_header() parser function in versions through 3.7.7 is vulnerable to a classic CWE-120 stack buffer overflow triggered by SIP messages containing header content exceeding approximately 20,490 bytes. Any unauthenticated network peer reaching the SIPp listener can crash the process with a single crafted SIP packet; the CVSS 4.0 vector (VA:H, no C/I impact) and source code evidence confirm this is an availability-only impact with no confirmed code-execution path. The upstream fix (commit 8ddfb43, PR #881) replaces unbounded sprintf() calls with snprintf() bounds enforcement, but no official tagged release incorporating the fix has been confirmed at time of analysis.
Quadratic time complexity in Nodemailer's addressparser component, versions 9.1.0 through 10.0.4, allows remote unauthenticated attackers to block the Node.js event loop for multiple seconds by supplying crafted email addresses containing RFC 5322 comment-separated atoms. The root cause is a `slice(-1)` call on a growing string accumulator in `_handleAddress` that forces JavaScript engine string-flattening on every token, producing O(n²) parse time - empirical test data in the fix commit shows 1.5 MB of crafted input caused approximately 10 seconds of event-loop stall before the patch. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the attack payload is trivially constructable by simple string repetition and requires no authentication.
Remote code execution in Spug through v3.4.0 allows authenticated users holding monitor permissions to inject arbitrary OS commands via the `/monitor/run_test/` HTTP endpoint, where user-supplied ping target addresses are interpolated directly into Python f-string shell commands executed with `subprocess.run(..., shell=True)`. Exploitation yields arbitrary command execution as the Spug process user, enabling full server takeover. No public exploit identified at time of analysis, but the vulnerable code path is trivially constructable from public source and the upstream patch commit is publicly visible.
Missing task ownership verification in CAPEv2's REST API allows any authenticated user to enumerate, read, and delete malware analysis submissions belonging to other users. Affecting all CAPEv2 installations through commit 471ee4b, the flaw resides in the task view and delete endpoints within `web/apiv2/views.py`, where the API authenticates the caller but never checks whether the caller owns the requested task. No public exploit has been identified at time of analysis, but the low attack complexity and entirely network-accessible API surface make this trivially exploitable by any user with a valid account on a multi-tenant CAPEv2 instance.
Heap buffer overflow in MKVToolNix through 101.0 allows code execution when a victim processes a crafted AVI file with mkvmerge. The bundled avilib 0.6.10 library's ODML superindex parser performs 32-bit size arithmetic on attacker-controlled entry counts, producing an integer wraparound (CWE-680) that causes an undersized heap allocation; subsequent data writes overflow the buffer. An attacker who delivers a malicious AVI file and induces a user or automated pipeline to process it with mkvmerge can achieve arbitrary code execution with user-level privileges. No public exploit has been identified and no KEV listing exists, but a patch commit is available on Codeberg.
Server-side request forgery in Open Notebook before 1.11.0 allows authenticated users to pivot through the application server to reach cloud instance metadata services, internal network hosts, and localhost-bound services by supplying arbitrary URLs to the POST /api/sources endpoint. The vulnerable parameter is passed directly to the server's HTTP client without any allowlist or blocklist validation, making the application a proxy for internal reconnaissance. No public exploit code has been identified at time of analysis, but the impact is high given the cloud metadata access path (e.g., AWS IMDSv1 credential theft).
Stored cross-site scripting in Amundsen Frontend through 4.3.0 allows authenticated users with description-write access to inject arbitrary JavaScript into table, dashboard, and feature description fields, executing attacker-controlled code in the browser of every user who subsequently views search results. The root cause is React's dangerouslySetInnerHTML used without any HTML sanitization in ResourceListItem components (TableListItem and siblings), meaning payloads such as img elements with onerror handlers stored via the metadata service or Elasticsearch persist and fire on each page load. No public exploit code has been identified at time of analysis, but the attack pattern is elementary for anyone with metadata write access.
TLS certificate verification is disabled by default in Socket Firewall (socketdev/socket-registry-firewall) before version 2.0.0, enabling network-positioned attackers to conduct man-in-the-middle attacks against the firewall's outbound connections to both the Socket API and upstream package registries. When the api_ssl_verify and upstream_ssl_verify keys are omitted from socket.yml, the generated configuration explicitly sets both to false, causing the OpenResty/Lua HTTP client to accept any certificate - including self-signed and untrusted certificates - without chain validation. A successful attacker can substitute malicious package content or alter the allow/block policy decisions the firewall enforces, effectively weaponizing the supply chain security control against the organizations it protects. No public exploit has been identified at time of analysis.
Authenticated Storm operator sessions are exposed to arbitrary web origin reads via three independent misconfigurations in Apache Storm Webapp 3.0.0: Logviewer CORS origin reflection combined with credentialed responses, a CORS filter initialization parameter mismatch that causes containers to silently apply permissive defaults, and unrestricted JSONP callback wrapping on all GET endpoints that bypasses the Same-Origin Policy entirely. Any malicious web page visited by an authenticated operator can silently exfiltrate cluster topology, configuration, and worker log data on the operator's behalf without requiring any additional privileges. No public exploit has been identified at time of analysis; vendor-released patch version 3.1.0 is available.
Rebalance operations in Apache Storm Nimbus 3.0.0 allow an authenticated attacker with topology rebalance rights to inject unauthorized blobstore map entries into configuration overrides, causing Supervisor nodes to fetch and locally cache blobs whose ACLs do not grant the caller access. A companion authorization-bypass in the listBlobs operation exposes the full blobstore key namespace to any caller reaching the Nimbus Thrift port without any subject check, supplying the key names that make the rebalance bypass actionable. No public exploit is identified at time of analysis; the vendor-confirmed fix is version 3.1.0 of org.apache.storm:storm-server.
Local privilege escalation in Apache Storm Worker Launcher 3.0.0 allows an authenticated Storm topology tenant to gain root on supervisor nodes by exploiting a TOCTOU race in the setuid-root worker-launcher binary: the binary chowns the entire worker directory to the untrusted topology user before re-reading the supervisor-written command file, creating a window in which the tenant can substitute attacker-controlled content. For Docker workers, the injected command executes with real uid 0 through an insufficiently constrained argument sanitizer that passes -v, --device, --cap-add, --security-opt, --user, --net, and positional arguments verbatim; for OCI workers, arbitrary host paths can be bind-mounted read-write and execution can be forced as another tenant's uid. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 3.1.0.
Local privilege escalation to root in Apache Storm's setuid-root `worker-launcher` binary (storm-core 3.0.0) allows a tenant user with code execution on a supervisor node to redirect root-owned `lchown` and `chmod` operations to arbitrary host files via a symlink race. The binary uses FTS to walk worker directories and then re-resolves pathnames at syscall time, creating a TOCTOU window exploitable by any topology user who can write to an intermediate directory component. Because worker relaunches and blob updates repeatedly re-trigger the walk, exploitation is low-cost and repeatable; this defeats the isolation boundary that `supervisor.run.worker.as.user` is designed to enforce. No public exploit is identified at time of analysis.
Improper access control in CyberPanel before 2.4.4 allows an authenticated low-privilege user to bypass alias-domain filtering logic in the child-domain management subsystem, with potential cross-account integrity impact. The flaw stems from using a Django ORM `.filter(alais=0)` call to identify non-alias child domains - a comparison that can behave differently than a Python-level equality check - combined with a missing ownership rejection branch in `checkOwnership()` that allowed certain code paths to fall through without denying access. The CVSS S:C/I:H vector indicates the impact can cross tenant boundaries on shared CyberPanel instances. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV.
HTTP request smuggling in HAProxy 3.3.0-3.4.4 affects deployments running an HTTP/3 (QUIC) frontend forwarding traffic to HTTP/1.1 backends over reused pooled connections with chunked transfer encoding. The H3 multiplexer in src/h3.c emits an untrusted client-declared DATA frame length verbatim as the HTTP/1.1 chunk size before payload bytes arrive; when a remote unauthenticated attacker under-delivers payload then ends the stream, HAProxy returns the desynchronized backend connection to the idle pool, enabling bypass of path-based frontend deny rules and exposure of concurrent clients' Authorization headers as attacker-visible request body. No public exploit code has been identified, though the attack is probabilistic and freely retryable.
Null pointer dereference in Zephyr RTOS's MQTT-SN client subsystem allows a malicious or on-path network actor to crash any Zephyr device running an active MQTT-SN session by suppressing gateway keepalive responses. The defect is a missing assignment from the SYS_SLIST_PEEK_HEAD_CONTAINER macro in process_ping(): gw is never populated, remains NULL, and is subsequently dereferenced and passed to the memory slab allocator. The outcome is a kernel panic (with CONFIG_MEM_SLAB_POINTER_VALIDATE) or silent slab free-list corruption on targets where address 0 is writable. No public exploit has been identified at time of analysis, and no KEV listing exists; however, the trivial trigger condition and absence of MQTT-SN authentication make this straightforward for any party controlling or impersonating the client's gateway.
Insecure direct object reference in Rhymix CMS before 2.1.31 allows authenticated users to access and potentially delete uploaded files belonging to other documents by supplying arbitrary file serial numbers in document extra variable fields. The root cause is missing ownership validation in the extravar module: file-type extra variables accepted any file SRL from user input and rendered or deleted the referenced file without confirming it belonged to the current document. No public exploit code is identified; vendor patch is available in version 2.1.31, tracked as RVE-2026-1.
SSH key injection in Froxlor before 2.3.12 allows authenticated customers to write arbitrary lines into server-side authorized_keys files by embedding newline characters in SSH public key submissions to the SshKeys::add() API endpoint. An attacker with a valid customer account can plant SSH key entries bearing OpenSSH option directives (e.g., command=, from=, restrict) that persist beyond explicit key-deletion and access-revocation actions performed by administrators. No public exploit has been identified at time of analysis, but the vendor advisory confirms the flaw and the fix version.
Out-of-bounds read in PostGIS address_standardizer through 3.7.0 allows authenticated database users to crash the entire PostgreSQL cluster by supplying rule rows with out-of-range Weight values. The Weight field is consumed directly as an array index into the load_value array inside rules_add_rule() (src/gamma.c:338) without any bounds validation, so a Weight of -1 or >= NUMBER_OF_WEIGHTS triggers an OOB read that terminates the PostgreSQL backend process and drops all active cluster sessions. No public exploit code has been identified at time of analysis; patch commits are available upstream.