Stored XSS in Concrete CMS 9.0.0-9.5.2 allows an authenticated editor to escalate privileges to administrator by injecting malicious JavaScript into the custom page alias name (customAliasName) field. The Edit Alias dialog applied only a trim() call to the submitted value with no HTML encoding or output neutralization, causing the alias to render unescaped in the administrative Sitemap panel. Any administrator or editor who subsequently opens the Sitemap panel automatically executes the stored payload, enabling session hijacking and full privilege escalation from editor to administrator. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored XSS in Concrete CMS before 9.5.3 allows a user with edit_block permission to inject malicious JavaScript into a page's YouTube embed block by supplying an unsanitized iframe width or height value. Because only PHP's trim() is applied before the values are written into HTML attribute context, an attacker can persist an event-handler payload that executes in every visitor's browser - and, when the victim holds administrative privileges, the script acts with those privileges. No public exploit code or active exploitation has been identified at time of analysis; the vendor has patched the issue in version 9.5.3.
Stored XSS in Concrete CMS 8.3.0-9.5.2 permits a registered user with calendar event creation rights to inject script payloads via unsanitized event names that later execute in an administrator's browser through unescaped rendering in the dashboard "Waiting For Me" workflow notification block. Because the injected script runs under an active administrator session, an attacker can leverage it to silently create a new administrator account, achieving full CMS compromise. No active exploitation or public proof-of-concept has been identified; the vendor has released version 9.5.3 as the fix and assigned this a CVSS 4.0 score of 7.3.
Memory corruption in Apple's image-handling code across iOS 27, iPadOS 27, macOS Golden Gate 27 and visionOS 27 allows an attacker to achieve arbitrary code execution when a user processes a maliciously crafted image. Apple removed the vulnerable code entirely in the 27-generation releases, which are the only versions containing the fix; all earlier supported builds remain affected. The flaw is rated 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), meaning exploitation needs local positioning plus some user interaction, and there is no public exploit code or CISA KEV entry identified at time of analysis.
An out-of-bounds write (CWE-787) in the Apple frameworks that parse 3D model files lets a maliciously crafted model corrupt memory when it is opened on an affected device, potentially giving the attacker code execution in the context of the processing application. The flaw affects iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate 27, tvOS before 27, visionOS before 27 and watchOS before 27, and Apple has shipped fixes for all of them. Exploitation likelihood is low: EPSS is 0.17% (7th percentile), CISA SSVC records exploitation as 'none' and the vulnerability is not in KEV — no public exploit code has been identified, and the local attack vector with required user interaction makes mass exploitation unlikely.
Memory corruption in Apple's 3D model parsing pipeline allows a local attacker with low privileges to trigger a classic buffer overflow (CWE-120) on iOS/iPadOS, macOS, tvOS, visionOS and watchOS when a victim opens a maliciously crafted 3D model file. Apple addressed the flaw with improved memory handling in iOS 26.7/27, iPadOS 26.7/27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27 and watchOS 27. Exploitation requires local access and user interaction, no public exploit code has been identified at time of analysis, and the EPSS score is very low at 0.17% (7th percentile), so this is a credible patching priority for Apple fleets rather than a mass-exploitation emergency.
CSV formula injection in Apache Syncope allows authenticated low-privilege users to embed spreadsheet formula payloads in their own user attributes. When an administrator exports users to CSV and opens the file in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, the stored formula is evaluated in the spreadsheet's execution context - enabling data exfiltration from the spreadsheet or arbitrary command execution on the administrator's workstation. No public exploit code has been identified at time of analysis, and SSVC classifies exploitation status as none and not automatable.
Stored cross-site scripting via authorization bypass in Concrete CMS 9.2.0-9.5.2 allows an authenticated content editor to inject persistent JavaScript into the HTML head element of every page served by the site. The REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) enforces only basic content-editing authorization, omitting checks for page-property, page-template, and page-type changes; the `header_extra_content` attribute is rendered unescaped site-wide. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the stored XSS payload targets all visitors including privileged reviewers, enabling session hijacking and effective privilege escalation in multi-user editorial deployments.
Authenticated non-administrator users in File Browser 2.5.0-2.63.23 can recursively delete directories beyond their authorized scope by exploiting an error-cleanup path in the direct-upload endpoint. A POST to an existing directory target with `?override=true` causes `writeFile` to fail; the failure-cleanup unconditionally invokes `Fs.RemoveAll` on the request path without evaluating the `Perm.Delete` permission or the `checkDescendants` rule walk enforced by legitimate delete operations. No patched version is available at time of analysis, and no public exploit or KEV listing has been identified.
XML External Entity injection in IBM Business Automation Workflow allows authenticated remote attackers to read arbitrary server-side files or exhaust memory by submitting crafted XML payloads to processing endpoints. Both containerized (Kubernetes/OpenShift) and traditional on-premises deployments across versions 24.0.0 through 26.0.0 are confirmed affected. No public exploit code or CISA KEV listing exists at time of analysis; IBM has released interim fixes for all four affected version branches.
Stack-based buffer overflow in the Tenda W20E router firmware (version 15.11.0.61068_1546_841_CN_TDC) allows a low-privileged remote attacker to crash the device by sending a crafted HTTP request with an oversized IPMacBindRule argument to the formIPMacBindAdd handler. A public researcher advisory exists on GitHub from Amalll-Sec, indicating the vulnerability has been analyzed and documented with reproduction steps. Impact is assessed as high availability loss; remote code execution has not been independently confirmed from available data but cannot be excluded given the CWE-121 class.
XML external entity (XXE) injection in IBM MQ 9.1.x, 9.2.x, 9.3.x, 9.4.x LTS/CD and 10.0.0.0 lets a remote attacker who holds low-privileged MQ access submit specially crafted XML that the product parses without disabling external entity resolution. Successful exploitation can disclose sensitive local files (confidentiality impact rated High) or exhaust memory and degrade availability (rated Low), yielding an overall CVSS base score of 7.1. There is no indication of confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, though the vulnerability is trivially automatable once parser entry points are reachable.
XML external entity (XXE) injection in IBM MQ (9.1, 9.2, 9.3, 9.4 LTS/CD lines and 10.0.0.0) lets a remote attacker who can already authenticate to MQ and get XML content parsed by the product cause the parser to resolve attacker-supplied external entities. Successful exploitation exposes sensitive information readable by the MQ process (high confidentiality impact) and can consume memory resources, degrading availability. CVSS 3.1 scores this 7.1 (AV:N/AC:L/PR:L/UI:N), so exploitation requires low-privileged authenticated access rather than being fully unauthenticated; no public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.
XML External Entity (XXE) injection in IBM Business Automation Workflow containers and traditional deployments allows an authenticated remote attacker to read arbitrary files from the server or perform server-side request forgery due to vulnerable XML processing enabled by default in programming model artifacts. Affected versions span the 24.0.0, 24.0.1, 25.0.0, and 26.0.0 release lines, all below their respective latest interim fixes. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
An XML external entity (XXE) injection flaw in IBM MQ's reply-message processing lets an authenticated attacker who can place messages on a queue cause the broker to resolve externally defined entities, resulting in arbitrary file disclosure from the MQ server and server-side request forgery against internal networks. The issue spans a wide swath of supported releases - MQ 9.1 LTS through 9.1.0.37, 9.2 LTS through 9.2.0.43, 9.3 LTS through 9.3.0.41 and 9.3 CD through 9.3.5.1, 9.4 LTS through 9.4.0.25 and 9.4 CD through 9.4.5.1, plus MQ 10.0.0.0 Managed File Transfer. IBM rates it CVSS 7.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality, low integrity impact); no public exploit code and no CISA KEV entry were identified at time of analysis.
Heap memory exhaustion in filebrowser through 2.63.23 allows any authenticated user to crash the server by sending arbitrarily large WebSocket messages to the /api/command endpoint. The server buffers incoming WebSocket frames before performing permission checks, meaning the DoS path is reachable regardless of whether the EnableExec setting is active or the user holds Execute permission - conditions administrators typically rely on to restrict command access. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
An out-of-bounds read in Apple's kernel (CWE-125) lets an app already running on the device read past the end of a kernel buffer, potentially leaking kernel memory or crashing the system. Affected platforms span iOS/iPadOS before 26.6.1, macOS Sequoia before 15.8, macOS Tahoe before 26.6.2, and tvOS, visionOS and watchOS before 27, with a CVSS 3.1 base of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H). There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), so this is a local, app-mediated kernel hardening issue rather than a remotely exploitable emergency.
Missing CSRF token validation on the orphaned block removal action (`removeOrphanedBlocks`) in Concrete CMS 9.0.0 through 9.5.2 enables remote attackers to permanently destroy all block content on any page the victim can edit. By tricking an authenticated editor into loading a crafted URL, an attacker triggers deletion of every block on the targeted page's current version; blocks not aliased elsewhere are additionally purged from the global Blocks table and their block-type data tables, making the destruction irreversible without a database backup. No public exploit code identified at time of analysis; the Concrete CMS security team assigned a CVSS 4.0 score of 7.1 reflecting high integrity impact gated on one user interaction.
Processing a maliciously crafted disk image on an unpatched Apple macOS system can trigger an out-of-bounds read that terminates the affected application unexpectedly. The issue affects macOS releases before Golden Gate 27, Sequoia 15.8, and Tahoe 26.7, and requires a local user with no privileges (PR:N) to open or mount the crafted image, meaning user interaction (UI:R) is the trigger rather than remote network access. Apple has shipped fixes in the three affected release trains, and there is no public exploit identified at time of analysis; EPSS is low at 0.17% (6th percentile), reflecting the local, interaction-dependent nature of the issue.
An integer overflow in Apple macOS document processing can trigger an out-of-bounds read when a user opens a maliciously crafted file, resulting in potential disclosure of adjacent memory contents and/or a crash of the affected application. Affected versions are macOS releases below Golden Gate 27, below Tahoe 26.7, and below Sequoia 15.8; exploitation requires local handling of the crafted document plus mandatory user interaction (the victim must open the file), and no privileges are required per the CVSS vector (PR:N), but there is no remote or network-service exposure. Apple has released patched versions (Golden Gate 27, Tahoe 26.7, Sequoia 15.8), and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is 0.17% (6th percentile), consistent with a low-likelihood, user-interaction-dependent flaw, and the realistic impact is bounded to memory disclosure or denial of service rather than code execution.
XML External Entity injection in Flowable flowable-engine through 8.0.0 allows authenticated users holding process deployment privileges to exfiltrate arbitrary local files or perform server-side request forgery against internal network endpoints. The vulnerability resides in ProcessDiagramLayoutFactory.parseXml(), which processes user-supplied BPMN XML without disabling external entity resolution, and is present in both the main flowable-engine module and the legacy flowable5-engine (Activiti-derived) module. No public exploit code has been identified at time of analysis, and no confirmed patched release version is available from the referenced data.
Expression Language injection in Activiti through 7.1.0.M6 allows authenticated users to execute arbitrary code within the Spring application context. The ExpressionResolver fails to validate hash-brace deferred expressions (#{...}) when stored as process variables, meaning crafted payloads bypass the existing expression filter. When a BPMN mail task subsequently evaluates a variable-backed body field, the stored #{...} expression is resolved in the full Spring EL context, enabling method invocation on any registered application bean. No public exploit has been identified at time of analysis, and exploitation requires an authenticated user with process variable write access.
Path traversal in PyMuPDF's object-extraction CLI lets a crafted PDF, EPUB, XPS, or FB2 file write arbitrary files outside the user-selected output directory. The extract_objects() font branch joins an attacker-controlled BaseFont name onto the output path without stripping '../' or absolute-path sequences (CWE-22), yielding a CVSS 4.0 base score of 7.1 with high integrity impact but no confidentiality loss. A fix is available upstream in commit b2c8f3a; no public exploit code or CISA KEV activity is known at time of analysis.
Gallery - Private Photo Vault 1.0.41 (Android, by Brain Trust) exposes an unauthenticated HTTP server on TCP port 8080 that is reachable by any device on the same local network, serving full directory listings and file contents from Android external storage - the very media the app is marketed to protect. Any network-adjacent attacker can trivially enumerate and exfiltrate photos, videos, and other files without credentials or user interaction. No public exploit code is required beyond a standard web browser or curl; Fluid Attacks' advisory confirms a proof-of-concept exists, but no CISA KEV listing has been identified at time of analysis.
Missing authorization on three License API admin endpoints in laradashboard through 1.2.2 allows any authenticated low-privileged user to read, overwrite, or delete premium module license keys without admin rights. The affected endpoints - GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove - perform no role or permission check beyond basic authentication, exposing confidential license material and enabling destructive writes. A POC reportedly exists per SSVC exploitation status; no confirmed active exploitation is recorded in CISA KEV.
Memory exhaustion in File Browser through 2.63.23 allows authenticated users with download permission to trigger unbounded server memory consumption via the subtitle conversion endpoint. The endpoint loads entire .srt, .ass, or .ssa files into memory without size constraints, and concurrent requests amplify impact to a full denial of service. A proof-of-concept exists per SSVC data, though no active exploitation has been confirmed and the vulnerability is not listed in the CISA KEV catalog.
Missing authorization in Mattermost's playbook run creation allows authenticated channel members to add arbitrary users to restricted channels by abusing the run owner field. Affected versions span three active release trains (11.9.x, 11.8.x, 11.7.x) and the LTS branch (10.11.x). An attacker with only channel-member access can silently bypass channel membership-management permissions to grant themselves or others access to content they are not authorized to view, producing a confidentiality exposure rated C:H in the CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in Concrete CMS versions 5.0.0 through 9.5.2 lets an editor-level account inject unsanitized custom style values through the Block Design dialog, which are then written into page CSS via a DOM sink and execute in the browser of any higher-privileged user who views the affected page. Because the payload runs in an administrator's session, an editor can hijack the admin session and escalate to full administrative control of the site. No public exploit code or in-the-wild exploitation is identified at time of analysis (SSVC Exploitation: none; not listed in CISA KEV), and the vendor-rated CVSS v4.0 score is 7.0 with a passive user-interaction requirement (UI:P).
Stored XSS in Concrete CMS 9.0.0-9.5.2 allows a low-privileged user with delegated access to the Page Containers dashboard to inject malicious script via a crafted container icon value that breaks out of an img src attribute due to missing output encoding. The payload persists in the database and executes in the authenticated session of any administrator or editor who subsequently views the Containers dashboard list or editor views, enabling session token theft and unauthorized privileged CMS actions. No public exploit code and no CISA KEV listing have been identified at time of analysis; the vendor released a fix in version 9.5.3.
Arbitrary file rename across the Joomla filesystem is possible in SP Page Builder (Free and Pro) versions 4.0.0 through 6.9.0 due to missing directory confinement in the media rename controller task. Authenticated administrators or users with media management permissions can pair any valid media identifier with an unrelated filesystem path, bypassing the boundary checks that protect other folder operations in the same controller. An attacker exploiting this flaw can rename files outside the intended media directory - including renaming configuration.php - effectively taking the entire Joomla site offline or disrupting its integrity. No public exploit or active exploitation has been identified at time of analysis.