Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, and Firewall Management Center (FMC) Software allows a remote, low-privilege authenticated attacker to achieve full confidentiality, integrity, and availability impact with a scope change, per the vendor's CVSS 9.9 rating. Exploitation requires an existing low-privilege session on a reachable ASA, FTD, or FMC instance (PR:L) but no user interaction and only low attack complexity; anonymous attackers cannot trigger it directly. The advisory is a grouped hardening release covering multiple internally discovered issues, so the exact triggering feature or configuration is not disclosed; no public exploit was identified at time of analysis, and no CISA KEV listing or EPSS score was provided.
Authenticated remote code execution in Cisco ISE allows an attacker with low-privileged administrative credentials to execute arbitrary commands on the underlying operating system and elevate to root via insecure deserialization of a crafted Java object sent to the web-based management interface. Exploitation requires network access to the management interface and valid low-privileged admin credentials (CVSS 9.9, PR:L), and successful attacks on single-node deployments can cause a denial-of-service condition that prevents unauthenticated endpoints from accessing the network. No public exploit has been identified at time of analysis.
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain an insufficiently protected credentials vulnerability (CWE-522) that allows an authenticated, low-privilege remote attacker to recover credentials, potentially compromising ISE and, due to a scope change, other connected systems. Rated CVSS 9.9, the flaw requires network reachability and a valid low-privilege session but no user interaction. No public exploit code or active exploitation has been identified at time of analysis. Cisco has released a hardening update; consult advisory cisco-sa-hardening-ise-XU5EwX5T for fixed versions.
Unauthenticated attackers can take over arbitrary WordPress accounts - including administrator accounts - on any site running the TrueBooker - Appointment Booking and Scheduler System plugin through version 1.2.3, by invoking a plugin AJAX action that changes a target user's email address without any authorization check (CWE-862); the attacker then triggers WordPress's standard email-based password reset to that address and gains full control of the account. The issue is remotely exploitable with PR:N (no authentication, no user interaction, no non-default configuration required) and carries a CVSS 3.1 base score of 9.8, though EPSS is a low 0.42% (36th percentile) and no public exploit code or CISA KEV entry has been identified at time of analysis. Independent assessment rates this as a genuine high-priority issue rather than a high-CVSS-but-low-real-risk case: the limiting factor is deployment footprint (a niche booking plugin), not any technical prerequisite.
Unauthenticated privilege escalation in JetFormBuilder - Dynamic Blocks Form Builder plugin for WordPress (versions up to and including 3.6.2) allows remote attackers to create administrator-level user accounts on affected sites. The flaw stems from missing validation that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback, enabling arbitrary user creation with maximum privileges. No public exploit code has been identified at time of analysis, but the CVSS 9.8 critical rating and lack of authentication or user interaction make this a top-priority risk for any site running the vulnerable plugin.
IPv6 IPsec receive processing in the Linux kernel writes one element past the end of the six-slot xfrm_state pointer array in xfrm6_input_addr(), because the depth guard tests '1 + sp->len == XFRM_MAX_DEPTH' instead of '>=', so a secpath already stacked to XFRM_MAX_DEPTH by xfrm_input() and preserved across xfrm_trans_reinject() bypasses the check and stores into sp->xvec[sp->len++]. The attacker must control an inner packet carrying a Mobile IPv6 destination-options Home Address option or a type-2 routing header, and because the write stays inside the larger sec_path allocation it is invisible to KASAN - it is only flagged by UBSAN_BOUNDS and only fatal when the non-default panic_on_warn sysctl is enabled, otherwise it is a logged warning with no functional effect. This means the input CVSS 3.1 vector of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is the generic maximal score auto-assigned to Linux kernel CVEs and is not credible for this bug: the authoritative independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9, availability-only, high attack complexity), since exploitation requires IPsec transport mode with six nested SA transforms, a Mobile IPv6 header, and a UBSAN_BOUNDS kernel with panic_on_warn enabled. Exploitation status: no public exploit identified at time of analysis; EPSS is only 0.21% (11th percentile) and the flaw is not listed in CISA KEV, consistent with the layered prerequisites. Authentication requirements: unauthenticated remote attackers (CVSS vector contains PR:N).
An out-of-bounds read in the Linux kernel's ISO9660/zisofs decompression code allows a local attacker to read memory past the end of a page-pointer array (kmalloc-8 slab) by simply read()ing a compressed file from a crafted ISO9660 image. The flaw is reachable only when the image's Rock Ridge 'ZF' record specifies a zisofs block-size shift below PAGE_SHIFT (a value rock.c does not reject) and a sub-page block leaves poffset partway into a page followed by an empty block, so the mount prerequisite and local trigger make this a local availability/limited-disclosure bug rather than a remote one. No public exploit code was identified at time of analysis, and EPSS is low (0.21%, 11th percentile); exploitation is not confirmed in the wild and the vendor's AV:N/PR:N CVSS 9.8 score is not credible for a bug that requires mounting a malicious image on the target - our assessment is AV:L/PR:L with high availability impact and low confidentiality impact.
A use-after-free in the Linux kernel's in-kernel ksmbd SMB3 server allows an authenticated attacker with an established SMB2 session to race an SMB2 TREE_CONNECT request against a concurrent session LOGOFF, so the tree-connection object is freed while smb2_tree_connect() is still initializing it and building the response. Successful triggering yields memory corruption in kernel context that can be leveraged for both confidentiality and integrity impact (KASAN reports slab-use-after-free at fs/smb/server/smb2pdu.c:2872). The CVE carries a 9.8 base score from the kernel CNA, but the assessed vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting that exploitation requires a valid session and precise timing; EPSS is low (0.19%, 9th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Unauthenticated remote command execution as root affects Cisco Secure Firewall Management Center (FMC) Software that has the External Database Access feature configured, via insecure deserialization of a crafted Java byte stream sent to the feature's TCP port (CWE-502). Vendor scoring is 9.8 (AV:N/AC:L/PR:N/UI:N), while our independent assessment rates it AV:N/AC:H/PR:N/UI:N because exploitation additionally requires the attacker to control a host already listed in the external database access list and to reach that specific port - a trust relationship that gates who can hit the vulnerable endpoint. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the attack surface is substantially reduced where the FMC management interface is not exposed to the public internet.
Missing authentication for critical functions (CWE-306) in Cisco Nexus Dashboard allows unauthenticated, remote attackers to access protected functionality, resulting in a CVSS 9.8 (Critical) rating with high impact to confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and real-world exploitation requires network reachability to the management interface, which is typically restricted to isolated management networks. The vulnerability is part of a Cisco hardening release addressing multiple internally discovered issues; exact affected versions and functions are not specified in available data.
Remote code execution in InternLM LMDeploy versions 0.9.1 through 0.10.1 allows unauthenticated network attackers to run arbitrary commands by sending crafted pickle payloads to the AsyncRPCServer RPC endpoint (zmq_rpc.py). The service deserializes raw messages with pickle.loads() and performs no authentication or IP validation, so any attacker who can reach the randomized port-typically found by scanning-can trigger code execution; publicly available exploit code exists (proof-of-concept with reverse shell demo), and the CVSS 3.1 score is 9.8. This is not confirmed actively exploited (no CISA KEV listing), and exploitation is not possible if the RPC service is bound exclusively to localhost; upgrading to 0.10.2 patches the deserialization flaw and restricts the RPC to localhost.
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overflow is reachable through the login process before authentication completes. Because the flaw is triggered during the pre-authentication login path, a remote attacker with network reachability to the management server's login/administration service needs no credentials, no user interaction, and no non-default configuration, and the resulting code execution is described as running with root privileges - consistent with the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not listed in CISA KEV), but the pre-auth, root-level impact and the criticality of the management plane make this a top-priority patch target; CPE data lists the product with a wildcard version, indicating the affected version range is not bounded in the available feed data.
Heap out-of-bounds write in the Linux kernel's ntfs3 driver lets a local attacker who can mount a crafted NTFS image corrupt kernel heap memory, producing a 4-byte write past the end of a kmalloc-1k allocation in ni_create_attr_list() (assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - integrity and availability high, confidentiality unaffected). Any kernel shipping the ntfs3 driver without the fix is affected; exploitation requires mounting an attacker-supplied image (privileged loop-mount or an automount daemon that mounts removable media) and then performing an attribute-inserting operation such as setxattr/setfattr, so the widely circulated 9.8 network vector materially overstates real-world exposure. No public exploit code or confirmed in-the-wild activity was identified at time of analysis, though vendor patches are available in the stable branches listed in the references.
A kernel crash (oops) in the CephFS client can be triggered when the fscrypt filename-decryption path hands vmalloc()-backed message buffers to a crypto API that requires linearly mapped memory. Only systems that mount CephFS with fscrypt filename encryption are affected, and triggering is probabilistic - it requires memory fragmentation severe enough that kvmalloc() places the MDS reply buffer in the vmalloc region (the author measured roughly 1 in 8,000 readdir messages), with non-x86 platforms markedly more likely to fault. Per the authoritative assessment, this is a local, high-complexity, availability-only issue (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), not the remote, unauthenticated code-execution-grade event implied by the vendor-published 9.8 score; no public exploit code was identified at time of analysis and there is no evidence of active exploitation. Vendor-released fixes exist in stable releases 6.18.51, 7.2.5, and 7.3-rc1.
A use-after-free in the Linux kernel NFSD (kernel NFS server) export-state revocation path can crash the server when a privileged administrator runs 'exportfs -u' to revoke an export while an NFSv4 client is concurrently expiring. Only recent 7.2.x kernels before 7.2.5 (and mainline before 7.3-rc1) are affected, and the trigger requires root/CAP_SYS_ADMIN on the NFS server plus a narrow race in which nn->client_lock is dropped across revoke_one_stid() and a subsequent read of clp->cl_minorversion, allowing a teardown to free the nfs4_client still being dereferenced. The realistic impact is a kernel crash / denial of service on the NFS server rather than remote code execution or data compromise; the vendor-supplied CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) drastically overstates real-world risk, and no public exploit code has been identified at time of analysis. A vendor patch is available (7.2.5 stable and 7.3-rc1).
Use-after-free in the Linux kernel's NFSv4 server (NFSD) lets an NFSv4 client that already holds authorized state on an exported filesystem trigger a kernel memory-corruption denial of service by racing the close_lru laundromat against a concurrent client expiry. Only hosts actively exporting NFSv4 filesystems are exposed, the attacker must be an authenticated client able to open and CLOSE files so that an nfs4_openowner is left on nn->close_lru, and the required timing window is narrow, so real-world impact is availability loss (kernel oops/crash) rather than code execution - no public exploit identified at time of analysis. Vendor-released patch: 6.18.51, 7.2.5 and 7.3-rc1 correct the missing client pinning; note that the widely published 9.8/AV:N/AC:L/PR:N vector overstates this defect, and the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H.
A use-after-free race in the Linux kernel's in-kernel NFS server (NFSD) can crash the kernel when the blocked-lock reaper (the per-net 'laundromat') frees a bare lock owner at the same moment force_expire_client() is tearing down the same nfs4_client, so the final nfs4_put_stateowner() dereferences the client's cl_lock in freed memory. Unpatched kernels from approximately 4.9 up to (but not including) 6.18.51 / 7.2.5 are affected; the flaw is reachable by a remote NFS client that can queue a blocked byte-range lock - unauthenticated per the CVSS vector (PR:N), though in practice gated by NFS export permissions and network reachability of the service. Impact is availability-only: kernel memory corruption leading to a crash/denial of service, not code execution or data disclosure, and exploitation requires winning a narrow, non-deterministic timing race. The vendor's CVSS of 9.8 overstates the risk; our independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H, consistent with a hard-to-trigger, DoS-class kernel bug. No public exploit code was identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV); fixes are available in stable releases 6.18.51 and 7.2.5, with 7.3-rc1 in mainline.
Kernel oops and duplicate/incorrect DMA unmapping in the Linux kernel SPI core can occur when __spi_map_msg() partially fails: if the RX scatter-gather mapping fails after the TX mapping succeeds, or if a later transfer's TX mapping fails after earlier transfers were mapped, the tx_sg_mapped/cur_tx_dma_dev bookkeeping is left inconsistent, so the subsequent spi_unmap_msg() may unmap a TX mapping twice or call dma_unmap_sg_attrs() with a NULL or stale device struct. Affected systems are Linux kernels 6.11 through the pre-fix stable trees, and exploitation requires local execution on a platform whose SPI controller performs DMA-mapped transfers (typically embedded/ARM SoC hardware) plus an actual DMA mapping failure, which normally arises only under memory pressure or address-space/IOMMU exhaustion and cannot be induced remotely; no public exploit code was identified at time of analysis. Note that the vendor-supplied CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is severely inconsistent with the technical description and should be treated as boilerplate auto-scoring, not a real signal - the independent assessment is AV:L/AC:H/PR:L/UI:N/C:N/I:N/A:H, i.e., a local, high-complexity availability-only defect.
A use-after-free race in the Linux kernel CephFS client allows a local process to crash the kernel while opening a file on an in-kernel CephFS mount, with a secondary integrity impact on the access-check result. The bug lives in ceph_mds_check_access(), which walks the mdsc->s_cap_auths array without holding mdsc->mutex, so a concurrent MDS session OPEN (reopen) that replaces and frees that array under the mutex can free the strings mid-traversal - the oops trace shows ceph_mds_check_access reached via ceph_atomic_open and do_sys_openat2. Affected systems are Linux 6.10 and later (where the s_cap_auths access-checking code exists) that mount CephFS with the in-kernel client; exploitation is local-only, requires a narrow timing window (AV:L/AC:H/PR:L per our assessment), and no public exploit code has been identified at time of analysis. The vendor-assigned CVSS of 9.8 (AV:N/AC:L/PR:N) is severely inflated relative to the described local race.
A use-after-free race in the Linux kernel NVMe driver allows a local user with basic privileges to crash the kernel (denial of service) by forcing the namespace-allocation error path in nvme_alloc_ns to run while a concurrent thread is still iterating the multipath sibling list under SRCU. Exposure is limited to hosts running the NVMe subsystem with native multipath configured, that actually hit a namespace allocation failure, and within a narrow timing window; the impact assessed is kernel memory corruption leading to a crash, with no confirmed path to data disclosure or code execution. No public exploit code was identified and there is no CISA KEV confirmation of active exploitation at time of analysis, although the upstream fix is publicly documented; the vendor's CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is a severe over-score relative to the assessed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H.
A race condition in the Linux kernel's NVMe-over-Fabrics target authentication code (nvmet-auth) can leave a queue structure (struct nvmet_sq) freed or reused while the auth_expired_work delayed-work callback is still executing, potentially crashing or corrupting the memory of the target host. Exposure is limited to Linux systems acting as NVMe-oF targets (nvmet) with in-band DH-HMAC-CHAP authentication enabled: an attacker must be positioned on the NVMe-oF fabric (TCP or RDMA), be able to open and tear down authenticated sessions, and win a narrow, non-deterministic timing window during transport teardown, which is why our independent assessment rates the issue well below the vendor's 9.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) and finds no confidentiality impact despite the 'Information Disclosure' tag. Vendor patches are available in the stable branches (6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 and 7.3-rc2), and no public exploit or confirmed active exploitation has been identified at time of analysis.
An out-of-bounds write in the Linux kernel's NVMe-over-Fabrics TCP target (nvmet-tcp) allows a network-reachable initiator to write four attacker-controlled bytes past a 128-byte receive buffer by sending a duplicate ICReq PDU after a header digest has been negotiated, corrupting adjacent queue state. The bug is reachable before authentication (CVSS PR:N), and the assessed impact is high availability (target crash or teardown) with a limited integrity effect and no confidentiality impact. Vendor patches exist for all supported stable trees, and no public exploit code or confirmed active exploitation was identified at time of analysis; practical exposure is confined to hosts that actually export an NVMe/TCP target subsystem, typically on port 4420.
Concurrent NVMe-FC I/O submission in the Linux kernel's qla2xxx QLogic Fibre Channel driver can corrupt the hardware request-ring producer state, producing duplicated or dropped commands. The defect affects hosts running the qla2xxx driver with a QLogic FC HBA configured for NVMe-over-FC that uses ha->base_qpair; qla_nvme_ls_reject_iocb() advances the ring and rings the request-in doorbell via __qla2x00_alloc_iocbs() and qla2x00_start_iocbs() (both of which assume hardware_lock is held) but two of its callers, qla_nvme_xmt_ls_rsp() and qla2xxx_process_purls_pkt(), invoke it without holding qp_lock_ptr. Our independent assessment rates this as a local, race-window-dependent integrity/availability issue (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L), materially lower than the vendor's NVD score of 9.8, because the reject events are driven by Fibre Channel fabric/transport conditions rather than attacker-supplied input and require precise concurrency with normal base-ring submission; there is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV).
A double-completion race in the Linux kernel's qla2xxx QLogic Fibre Channel driver can cause a use-after-free write into a freed on-stack completion structure, leading to kernel memory corruption, a kernel crash, or potential local privilege escalation. Only hosts with a QLogic FC HBA and the qla2xxx driver loaded are affected, and the fault requires qla24xx_async_abort_cmd() to fail while the response ISR completes the same SRB handle at almost the same instant the async IOCB timeout handler re-scans outstanding_cmds[], so the attacker must win a very narrow concurrency window - local access only and no network reachability. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); vendor patches are available in the stable releases 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 and 7.3-rc1, and the NVD score of 9.8 (AV:N/AC:L/PR:N) should not drive prioritization given the assessed vector of AV:L/AC:H/PR:L/UI:N.
Unauthenticated remote code execution affects Arista EOS platforms on which the non-default P4Runtime service has been explicitly enabled, letting an attacker who can reach that service take complete administrative control of the switch. The defect is a code-injection flaw (CWE-94) triggered by a crafted packet during P4Runtime session initiation, rated 9.5 Critical under CVSS 4.0 and assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, with high attack complexity and a changed scope because compromise of the switching platform can extend to subsequent systems. Exposure is limited: P4Runtime is disabled by default, so stock EOS deployments are not at risk, and successful exploitation also depends on a specific timing/condition requirement (AT:P, 'Attack Requirements: Present'); Arista discovered the issue internally, reports no malicious exploitation in customer networks, and no public exploit code has been identified at time of analysis.
Protection-mechanism failures in Cisco Secure ASA, Cisco Secure Firewall Threat Defense, and Cisco Secure Firewall Management Center software allow an unauthenticated attacker on an adjacent network to achieve high confidentiality and integrity impact, with low availability impact, under a CVSS 9.6 vector. Cisco issued this grouped hardening CVE for multiple internally discovered CWE-693 issues; no public exploit has been identified at time of analysis and active exploitation is not confirmed. The main exposure limitation is adjacent-network access rather than internet-routable reachability, and the advisory lacks granular technical detail or a stated non-default configuration prerequisite.
SAML single sign-on handling in Delinea Secret Server (On-Prem) 10.5.0 through 12.1.3 allows an unauthenticated remote attacker to impersonate another Secret Server user by presenting a valid SAML IdP response under certain conditions, giving high confidentiality and integrity impact to the impersonated account and to connected components (CVSS 4.0 base 9.5; assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). No pre-existing Secret Server credentials and no victim interaction are required, but the vulnerability only affects deployments actually configured to use SAML-based SSO, and exploitation hinges on unspecified preconditions in the SAML assertion-handling path (reflected as AC:H/AT:P), so the raw 9.5 score overstates how easily the flaw can be triggered. There is no CISA KEV listing and no public exploit identified at time of analysis; environments using local or AD-backed authentication and versions later than 12.1.3 are not affected per the assessed exploitation conditions.
SQL injection in SourceCodester Inventory and Monitoring System 1.0 allows remote attackers to manipulate database queries through the difficulty_id parameter of the /admins/assessments/databank/btn_functions.php?action=add endpoint. Publicly available exploit code exists, and the vendor-supplied CVSS 4.0 score of 6.9 treats the flaw as remotely reachable without authentication (PR:N); however, our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N because the /admins/ path implies an administrative function that typically sits behind a login, so a valid staff or admin session may be required, which materially lowers realistic risk. Impact is limited to low-confidentiality and low-integrity effects on the backend database; there is no evidence of active exploitation, and the affected product is a niche PHP application with a very small deployment footprint, making broad opportunistic targeting unlikely.
Heap-based buffer overflow in GPAC 26.07.0's Remotery-style WebSocket remote-monitoring handler (rmt_client_handle_ws_frame in src/utils/rmt_ws.c) lets remote attackers corrupt heap memory by sending a WebSocket frame whose advertised payload_size is manipulated, since the value is trusted when computing how much extra data to read. The CVSS 4.0 score is 6.9 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N and the E:P exploit-maturity flag; an independent assessment rates the memory-safety consequence more severely (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H), reflecting that availability impact can be complete once the interface is reached. Publicly available exploit code exists - a Python PoC (poc_rmt_ws_malicious_frame.py) is attached to the upstream GitHub issue - but there is no confirmation of active exploitation (no CISA KEV listing). The practical limiting factor is exposure: the rmt_ws handler must be compiled in, enabled, and network-reachable, which is not the default posture for typical GPAC/MP4Box usage.
Parsing desynchronization in the RabbitMQ amqp091-go AMQP 0.9.1 client library before 1.13.0 lets a malicious or compromised broker - or anyone positioned to modify broker traffic - send a table field carrying a longstr whose declared length exceeds 0x7FFFFFFF; the client accepts it silently instead of returning ErrSyntax, leaves the declared bytes unread, and then parses every following field and frame from the wrong offset. The independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H, i.e. unauthenticated remote input that can corrupt parsing integrity and disrupt connection availability, but with high attack complexity because the victim application must first connect to an attacker-controlled or subverted broker (or be subject to a man-in-the-middle on that connection), and with no confidentiality impact since the Go library is memory-safe and this is a logic-level desynchronization rather than memory corruption. Vendor-released patch v1.13.0 fixes the defect; no public exploit code identified at time of analysis, and the vendor's CVSS 4.0 score of 9.5 with full High subsequent-system impact overstates real-world risk.
Server-side request forgery in WuzhiCMS up to and including version 4.1.0 lets an attacker direct the server to fetch an arbitrary URL through the ckditor::saveRemote handler in coreframe/app/attachment/index.php, by manipulating the source[] argument of the Remote Image Fetch component. Publicly available exploit code exists (a public GitHub issue, wuzhicms/wuzhicms#221, documents the flaw) and the vendor was notified early but has not responded, so no fixed release is available at time of analysis. The vulnerability is not confirmed as actively exploited (no CISA KEV listing); the supplied CVSS 4.0 vector scores 6.9 and rates it unauthenticated (PR:N) and remotely reachable with no user interaction, but our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N and cautions that the CKEditor attachment/upload handler is typically reachable only within an authenticated content-editing session - defenders should verify in their own deployment whether saveRemote is exposed pre-authentication.
SQL injection in code-projects Matrimonial System 1.0 allows remote, unauthenticated attackers to inject arbitrary SQL through the /search.php endpoint of the Regular Search component by manipulating any of the sex, mothertongue, maritialstatus, country, state, religion, agemin, or agemax parameters. The vendor-scored CVSS 4.0 base of 6.9 reflects limited per-dimension impact, but our independent assessment rates it more severely on confidentiality (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), since a successful injection can expose the full contents of the backend database with no credentials, user interaction, or non-default configuration required. Publicly available exploit code exists (a GitHub proof-of-concept repository targeting the sex and mothertongue parameters), but there is no indication of confirmed active exploitation (CISA KEV) and no EPSS data was provided. The practical risk is tempered by the application's likely negligible production footprint as a tutorial-grade PHP project.
Authenticated gRPC users on Arista EOS devices that have AAA-based gRPC authorization enabled for OpenConfig can have their requests evaluated at the wrong privilege level and matched against the wrong AAA method list, granting read and configuration-write access they should not hold. The flaw (CWE-266, incorrect privilege assignment) is confined to the gRPC OpenConfig path; Arista explicitly states that non-gRPC OpenConfig requests such as NETCONF are not affected, and the vulnerable configuration is not a default state. A vendor patch is available via Arista Security Advisory 0163, and no public exploit code has been identified at time of analysis; the supplied CVSS 4.0 score of 9.4 should be treated with caution, as it reflects an authorization mismatch on a management interface that requires an already-authenticated user (CVSS vector PR:H) plus a non-default AAA configuration rather than an unauthenticated, scope-changing compromise.
HTML injection in the Royal Elementor Addons WordPress plugin before version 1.7.1067 lets unauthenticated visitors inject arbitrary HTML into the administrator notification emails generated by the plugin's form widget. Because form submissions are not sanitized before being embedded in the email body, an attacker can place crafted markup, malicious links, or spoofed content in mail that lands in the site administrator's inbox. Publicly available exploit code exists, and exploitation hinges on the administrator opening the notification email (CVSS UI:R), giving a base score of 6.1; no CISA KEV listing or EPSS score was supplied with the source data.
RabbitMQ's amqp091-go Go client library, in all versions before 1.13.0, builds TLS configuration from amqps:// URIs without setting a minimum protocol version, so builds that use a Go runtime permitting TLS 1.0 or 1.1 can negotiate an obsolete protocol. An active man-in-the-middle positioned on the network path could then force a downgrade and weaken the confidentiality and integrity of AMQP traffic, including credentials, though the independently assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) shows this requires a high degree of attacker positioning plus the legacy-toolchain precondition, and the published 9.4 CVSS 4.0 score overstates real-world exposure for modern deployments. The fix is a two-line MinVersion change shipped in version 1.13.0; no public exploit identified at time of analysis.
Unauthenticated OS command injection in the WNC T-Mobile 5G Box IDU router (firmware below 1.1.0.651412) lets an attacker on the adjacent network run arbitrary shell commands as root through a crafted cli_cookie parameter POSTed to /cgi-bin/portal.cgi. Because the affected parameter is concatenated straight into a shell 'find' command with no sanitization, successful exploitation yields full root-level control of the device - high confidentiality, integrity, and availability impact - and the CVSS 4.0 score of 9.4 reflects that severity. The decisive limiting factor is reachability: the vector is AV:A (adjacent), so the attacker must already sit on the LAN/Wi-Fi side or the same L2 segment unless the management interface is exposed to the WAN. There is no CISA KEV entry and no public exploit code identified at time of analysis, but a vendor patch exists, and CERT-PL is credited with reporting the issue.
Reflected cross-site scripting in Delinea Secret Server (On-Prem) versions 10.2.19 through 11.9.48 allows an attacker to craft a malicious link that, when clicked by a legitimate Secret Server user, causes the browser to execute attacker-supplied JavaScript in the context of the Secret Server web application. The attacker requires no authentication (PR:N per the CVSS 4.0 vector), but exploitation is not self-contained: a human victim must be lured into clicking the link (UI:A), and the practical impact scales with the victim's privileges - a privileged vault user's session and access could be abused to read or modify secrets, producing high confidentiality and integrity impact on both the vulnerable system and subsequent systems (VC:H/VI:H, SC:H/SI:H, S:C). CVSS 4.0 base score is 9.3 (Critical) and the independently assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N; no public exploit code and no confirmed active exploitation were identified at time of analysis, and note that only on-premises deployments in the stated version range are affected - SaaS/cloud instances are not listed as affected.
Unauthenticated attackers can book time slots in the Appointment Hour Booking WordPress plugin (before 1.5.95) that have already reached their configured capacity, because each appointment in a multi-appointment booking submission is not validated against the capacity limit of its own slot. The plugin assigns a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only impact), meaning any anonymous visitor can submit a crafted booking form and overwrite or occupy fully booked slots, denying legitimate customers their reservations. Publicly available exploit code exists per WPScan, but the issue is not listed in CISA KEV and EPSS-style mass exploitation signals are absent, so this is best treated as a business-logic abuse and booking-integrity risk rather than a code-execution emergency.
A mis-sized TLB invalidation in the Linux kernel's KVM/arm64 stage-1 handling can leave stale translations resident in the TLB when the stage-1 MMU is disabled during a VNCR (nested virtualization / FEAT_NV2) invalidation, so a workload able to drive nested-guest TLB operations on a vulnerable arm64 host may retain access to mappings that should have been flushed. The bug is a correctness defect in TLB-invalidation size computation rather than an exposed remotely reachable primitive: it requires an arm64 host running KVM with nested virtualization enabled on an affected kernel, and our independent assessment rates it AV:L/AC:H/PR:L (local access, high attack complexity), materially lower than the published CVSS 9.3, because no path from a stale-TLB condition to a concrete memory-safety effect has been demonstrated. EPSS is 0.18% (8th percentile) and no public exploit code has been identified at time of analysis; vendor patches are available.
Unauthenticated visitors can mark unpaid Eventin orders of any value as paid by replaying a single genuine low-value payment transaction, because the plugin only checks that the gateway reports success and never validates the amount, currency, or which order the transaction belongs to. The flaw affects WordPress sites running the Eventin event-management plugin before version 4.1.24, and exploit detail is publicly available via the WPScan advisory. There is no indication in the supplied data that this is being actively exploited (no CISA KEV listing), and EPSS data was not provided.
Authenticated customers on PrestaShop storefronts running the blockwishlist module through 3.0.2 can retrieve share tokens for arbitrary wishlists due to a missing ownership check in the getUrlByIdWishListAction method, exposing other customers' private wishlist contents. The flaw is an IDOR (CWE-639) exploitable by supplying sequential numeric wishlist identifiers; it does not allow modification of data or account takeover, and our independent assessment rates it a genuine but low-severity authorization weakness. Publicly available exploit code exists, but active exploitation has not been confirmed.
Authenticated customers on PrestaShop stores that have the psgdpr GDPR-compliance module installed at version 1.4.3 or earlier can forge GDPR consent audit records belonging to other customers by supplying attacker-chosen customer identifiers to the module's front-office consent AJAX endpoint (FrontAjaxGdpr.php), corrupting the integrity of consent logs. Only a valid customer account is required - no administrator privileges, no user interaction, and no special store configuration beyond an active module - and publicly available exploit code exists. The flaw is not in CISA KEV (no confirmed active exploitation), and the impact is confined to integrity of the consent audit trail: no data disclosure, account takeover, or availability loss results from this issue.
Unauthenticated attackers can fully compromise UVdesk Community Skeleton instances up to version 1.1.8 by submitting crafted requests to unprotected installation wizard endpoints in the ConfigureHelpdesk controller, allowing them to repoint the database and create super administrator accounts. The vulnerability (CWE-306) is present by default and exploitable even on fully installed instances, as the wizard does not check authentication or validate installation state. No public exploit code has been identified at time of analysis, but the critical CVSS 4.0 score of 9.3 and the independent assessment confirm this is a genuine high-priority issue requiring immediate mitigation.
Remote unauthenticated attackers can bypass all role-based access control on Feast feature servers (feast-dev/feast) through version 0.66.0 by presenting a forged JWT that the OIDC token parser accepts without verifying its signature, granting the attacker a trusted internal identity and unchecked read and write access to entities, feature views, data sources, and permission policies. Exploitation requires the server to be deployed with OIDC authentication and RBAC authorization enabled; an instance running with no authentication has nothing to bypass, and a properly verifying token path is the intended state. No public exploit code has been identified at time of analysis, but the issue is high priority because a network-reachable, unauthenticated attacker can obtain complete loss of confidentiality, integrity, and availability of the server's data.
Tag-based page access restrictions in Wiki.js through 2.5.314 are bypassed because several GraphQL resolvers return page metadata without evaluating page tags, allowing an authenticated user to enumerate titles, descriptions, paths, and tags of pages they should not see. Publicly available exploit code exists, and the supplied intelligence maps the issue to CWE-863, but the authoritative assessment rates it as a low-severity information-disclosure bug: it requires an account with GraphQL API access, affects deployments that actually use tag-based page rules, and exposes metadata only, not page content, with no integrity or availability impact.
Unauthenticated remote code injection in HP Advance can let an attacker with network reachability to the print-management server hosting HP AC Print & Scan or HP Output Central achieve elevation of privilege, remote code execution, or arbitrary file write, as described in HP's self-published advisory hpsbpi04149 (CVSS 4.0 base score 9.3 Critical, CWE-94). The vendor scores both the vulnerable component (VC:H/VI:L) and subsequent systems (SC:H/SI:H) as impacted, and our independent assessment retains a high-severity rating (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) while noting that HP's explicit 'under certain conditions' wording implies a specific feature, endpoint, or deployment mode is a likely precondition despite the AC:L rating. Exploitation requires no authentication and no user interaction per the CVSS vector, but there is no CISA KEV entry, no public exploit code identified at time of analysis, and no affected version range published by the vendor.
Unauthenticated remote code execution and privilege escalation in HP Advance software can lead to full server compromise, but exploitation requires specific, undisclosed configuration or deployment conditions according to HP's advisory. The flaw affects the HP AC Print & Scan and HP Output Central components hosted on the HP Advance server. No public exploit code has been identified at time of analysis, though the vendor's CVSS 4.0 vector rates it 9.3 critical while an independent assessment adjusts attack complexity to High due to the gating conditions.
Heap-based buffer overflow (CWE-122) in HP's HPLIP - the HP Linux Imaging and Printing Software stack shipped as the default printer/scanner driver on most Linux distributions - can be triggered when attacker-influenced data is processed by a vulnerable component, potentially leading to remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. This is a bundled advisory covering multiple externally reported flaws across several HPLIP components, so the precise prerequisites vary per sub-vulnerability; the vendor assigns CVSS 4.0 score 9.3 (Critical) with a remote, unauthenticated, low-complexity vector, while the independent assessment is more conservative at CVSS 3.1 AV:N/AC:H/PR:N/UI:N, reflecting that the system must be running HPLIP and actually process malicious input. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Heap-based buffer overflow and related memory-safety flaws in HP Linux Imaging and Printing (HPLIP) can allow remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification on Linux hosts where HPLIP is installed and the affected component is active. This is an aggregate HP bulletin (hpsbpi04151) that bundles multiple externally reported issues under one CVE, so the published CVSS 4.0 score of 9.3 (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H) represents the worst-case component rather than any single flaw, and the assessed CVSS 3.1 score is lower (AV:N/AC:H) because several sub-issues are more likely local than remote and heap exploitation requires reliable memory grooming. No public exploit code or confirmed active exploitation was identified at time of analysis, and the exposure is limited to Linux systems on which HPLIP is deployed rather than being a universal service.
Unauthenticated access to the Kubero notifications API endpoints in versions through 3.1.1 allows remote attackers to read stored webhook secrets and service URLs and to create or delete webhook configurations, because those endpoints lack authentication guards (CWE-306). The independent CVSS 3.1 assessment rates this as network-exploitable with no privileges or user interaction required, high confidentiality impact from secret exposure, low integrity impact from webhook manipulation, and no availability impact; the primary limiting factor is network exposure, as instances whose API is bound only to trusted internal networks or protected by an upstream authenticating reverse proxy are not exploitable by external unauthenticated attackers. No public exploit code was identified at time of analysis.