2026-09-16
Sandbox escape in the Avast/AVG/Norton sandbox minifilter driver (aswSnx.sys) on Windows allows an authenticated, low-privileged process already executing inside the sandbox to break file isolation and escalate to SYSTEM (CVSS 8.8, AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-281). The driver opens the virtualization target with only GENERIC_WRITE and FILE_WRITE_ATTRIBUTES, omitting WRITE_DAC, so every attempt to reapply the original DACL fails silently and virtualized copies of sensitive files are left with permissive permissions; the IRP_MJ_CREATE handler additionally fails to strip WRITE_DAC for sensitive directories, letting a sandboxed process rewrite the security descriptor of a virtualized object, read the virtualized SAM copy, extract local NTLM hashes and run code as SYSTEM. Publicly available exploit code exists (the PrettyPrague proof of concept), the vendor has released patches for the affected Avast, AVG and Norton products, and no CISA KEV entry indicates confirmed active exploitation.
Authenticated users of zlt2000 microservices-platform through 6.0.0 can overwrite the password of any non-administrator account by calling the PUT /users/password endpoint with an arbitrary user id and a new password, because the server never verifies the current password. The flaw is network-reachable, low-complexity, and requires only a low-privilege login session (CVSS 4.0 base 8.7; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:L), and publicly available exploit code exists. Exploitation is limited to non-administrator accounts and is not possible pre-authentication, but a successful attack yields full credential takeover of the targeted account.
Missing authorization in zlt2000 microservices-platform through 6.0.0 lets any authenticated account - including one with zero assigned roles - invoke administrative APIs for user management, role assignment, password resets by user ID, and Elasticsearch index deletion, because the shipped default of zlt.security.auth.urlPermission.enable is false and suppresses all permission checks once authentication succeeds. Exploitation is not pre-auth: it requires a valid low-privilege session against a deployment running the out-of-the-box configuration, and publicly available exploit code exists (VulnCheck-reported PoC scripts covering role-granting, user enumeration, password reset, and ES index deletion), though no confirmed active exploitation (CISA KEV) has been recorded. Assessed severity is high (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8; vendor-published CVSS 4.0 score 8.7) because a zero-role user obtains both read and write access to sensitive administrative functions.
Insufficient scope validation in GitLab Enterprise Edition lets an authenticated user holding only Developer permissions run security policy test pipelines inside projects in their own group and read protected CI/CD variables that are meant to be restricted to Maintainer or Owner roles. All EE releases from 19.0 up to 19.1.8, 19.2.6 and 19.3.2 are affected, and GitLab shipped fixes in those patch releases. Publicly available exploit code exists (a HackerOne report is referenced), but there is no confirmed active exploitation and no CISA KEV listing.
Improper sanitization of user-controlled data in GitLab CE/EE's Markdown JSON table renderer allows crafted content to make a targeted user's browser issue unintended state-changing HTTP requests when the rendered page is viewed, affecting versions from 15.3 through 19.1.7, 19.2.5 and 19.3.1. Exploit details are publicly available through a linked HackerOne report, and the vendor CVSS of 8.2 reflects network reachability, a high attack-complexity rating, required user interaction and a scope change. Vendor-released fixes are 19.1.8, 19.2.6 and 19.3.2.
Unauthenticated denial of service in GitLab CE/EE caused by flawed resource accounting in the GraphQL complexity calculation logic, allowing a crafted query to consume disproportionate server resources. Exploitation affects GitLab 18.4.6 through 19.1.7, 19.2.0 through 19.2.5, and 19.3.0 through 19.3.1 - any Internet- or network-reachable instance with the GraphQL API enabled. Public exploit code exists (a HackerOne report is cited as the source), but there is no CISA KEV listing confirming active in-the-wild exploitation at time of analysis.
Unauthenticated denial of service in GitLab CE/EE (all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2) allows a remote attacker with no credentials to exhaust server resources through the GraphQL API by submitting queries whose true cost the complexity calculation under-counts. The flaw is an improper resource-allocation limit (CWE-770), scored CVSS 7.5 with the entire impact on availability (A:H) and none on confidentiality or integrity. Publicly available exploit code exists - a HackerOne report is linked from the advisory - but there is no CISA KEV listing, so active in-the-wild exploitation is not confirmed; EPSS data was not supplied with this record.
Arbitrary file deletion in zlt2000 microservices-platform through 6.0.0 allows authenticated attackers to delete any user's files and metadata due to missing ownership validation in the file-center module's DELETE /files/{id} endpoint. Attackers can enumerate file identifiers via GET /files and then delete arbitrary files, bypassing authorization controls (CWE-639); publicly available exploit code exists. Exploitation requires a valid, low-privilege account (PR:L) with access to the file-center REST API, and the impact is limited to integrity and availability (no data disclosure), with a CVSS 4.0 base score of 7.2.
Authenticated attackers can read arbitrary Elasticsearch indices in zlt2000 microservices-platform through 6.0.0 by supplying any index name in the POST /search/{indexName} or GET /agg/requestStat/{indexName}/{routing} endpoints, bypassing authorization checks. This exposes sensitive data such as the sys_user index containing user records and password hashes; the vulnerability has a CVSS 4.0 base score of 7.1 and an assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning high confidentiality impact with no integrity or availability effect. Publicly available exploit code exists (no CISA KEV confirmation), and exploitation requires only a valid low-privilege session on a network-reachable search-center service.
Authenticated back-office users of yshop-crm through 2.1.3 can enumerate the complete user directory via GET /admin-api/system/user/page because the endpoint's @PreAuthorize('system:user:list') gate is commented out in UserController.java. The flaw is a broken-access-control issue (CWE-862) that requires valid admin-panel credentials plus a role configured with data scope ALL; without that scope the query returns little of value, but with it an attacker can harvest login names, nicknames, departments, emails, mobile numbers, and last-login metadata. Publicly available exploit code exists (a Python enumeration PoC), and no CISA KEV entry confirms active exploitation at time of analysis. The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning authenticated remote confidentiality loss only - no integrity or availability impact.
Missing authorization in yshop-crm 2.1.3 and earlier lets any authenticated back-office (admin-api) user delete arbitrary approval-workflow steps via DELETE /admin-api/crm/flow/delete-step, bypassing the permission check that should restrict this to workflow administrators. The result is an integrity-only compromise of the approval chains that gate contract, receivable, and invoice finalization; there is no confidentiality or availability impact, and the CVE record's CVSS 4.0 score of 7.1 maps to an independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, i.e. a genuine but moderate-priority missing-authorization flaw rather than a critical takeover. Publicly available exploit code exists (a Python PoC against the delete-step endpoint); no CISA KEV listing or other confirmation of active in-the-wild exploitation was present in the supplied data.
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user - including low-privilege operators - to read the installation-wide audit trail by calling GET /admin-api/crm/operatelog/page, exposing operator names, display nicknames, client IP addresses, User-Agent strings, request URLs, action details, and customer identifiers. Publicly available exploit code exists (a PoC script that queries the endpoint), and although exploitation requires a valid back-office session with network reach to the admin API, no elevated role or user interaction is needed, so the realistic threat is a malicious insider or anyone who has reused or stolen an operator credential. The vulnerability is broken access control (CWE-862) with high confidentiality impact only; it does not permit data modification, service disruption, or pre-authentication compromise.
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to claim and reassign sales leads belonging to other employees by invoking the CrmCluesController receiveCustomer lead-claim endpoint with a manipulated ownerUserId value. The flaw is a broken access control (CWE-862) issue that requires only a valid low-privilege staff login and no administrative role, feature toggle, or user interaction, with the practical impact limited to integrity of lead ownership data (no confidentiality or availability impact). Publicly available exploit code exists in the form of a Python proof-of-concept targeting the endpoint, and the absence of access logging or quota validation on the operation removes any built-in brake on bulk lead theft, though no confirmed active exploitation (CISA KEV) has been observed at time of analysis.
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to issue arbitrary invoices by calling the PUT /admin-api/crm/invoice/issue endpoint, which performs no permission check on the caller. An attacker holding low-privileged back-office credentials can set an invoice's status, overwrite contract invoiced amounts with attacker-chosen values, and trigger invoice emails to arbitrary recipient addresses - a pure integrity impact with no confidentiality or availability loss. Publicly available exploit code exists (a Python PoC in the LinYuanyi1 cve-request-poc repository), but there is no evidence of confirmed active exploitation (CISA KEV).
Missing authorization in yshop-crm through 2.1.3 lets any authenticated back-office user, regardless of role or privilege level, invoke the saveRedisSet and getRedisSet endpoints in CrmCustomerController and rewrite the installation-wide Redis keys that drive lead allocation and customer auto-recycling. Because the scheduled CustomerAutoJob consumes those same keys, a low-privilege staff account can disable recycling, block customer creation, or trigger mass customer deletion across the deployment; publicly available exploit code exists (the VulnCheck-referenced CVE request PoC on GitHub), while no active exploitation has been confirmed and the CVE is not listed in CISA KEV. This is a genuine but bounded-priority issue: exploitation requires a valid CRM account (assessed CVSS PR:L, so unauthenticated remote abuse is not possible), and the assessed impact is high integrity loss to shared policy state (I:H) with a limited availability effect (A:L) and no confidentiality loss (C:N - the readable values are configuration/policy keys, not customer records).
Token generation in EspoCRM through 10.0.8 relies on PHP's non-cryptographic rand() function, producing roughly 31-bit identifiers for lead-capture opt-in links, event invitations, and campaign URLs. Remote unauthenticated attackers who can reach those public endpoints can guess or enumerate valid tokens, allowing them to confirm opt-ins, accept or decline event invitations on behalf of other contacts, and read event details. Publicly available exploit code exists (a vendor commit and a public write-up), but there is no evidence of confirmed active exploitation in the wild, and the CVSS 6.3 rating reflects high attack complexity and only low confidentiality/integrity impact.
IPv6 IPsec receive processing in the Linux kernel writes one element past the end of the six-slot xfrm_state pointer array in xfrm6_input_addr(), because the depth guard tests '1 + sp->len == XFRM_MAX_DEPTH' instead of '>=', so a secpath already stacked to XFRM_MAX_DEPTH by xfrm_input() and preserved across xfrm_trans_reinject() bypasses the check and stores into sp->xvec[sp->len++]. The attacker must control an inner packet carrying a Mobile IPv6 destination-options Home Address option or a type-2 routing header, and because the write stays inside the larger sec_path allocation it is invisible to KASAN - it is only flagged by UBSAN_BOUNDS and only fatal when the non-default panic_on_warn sysctl is enabled, otherwise it is a logged warning with no functional effect. This means the input CVSS 3.1 vector of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is the generic maximal score auto-assigned to Linux kernel CVEs and is not credible for this bug: the authoritative independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9, availability-only, high attack complexity), since exploitation requires IPsec transport mode with six nested SA transforms, a Mobile IPv6 header, and a UBSAN_BOUNDS kernel with panic_on_warn enabled. Exploitation status: no public exploit identified at time of analysis; EPSS is only 0.21% (11th percentile) and the flaw is not listed in CISA KEV, consistent with the layered prerequisites. Authentication requirements: unauthenticated remote attackers (CVSS vector contains PR:N).
A use-after-free in the Linux kernel's in-kernel ksmbd SMB3 server allows an authenticated attacker with an established SMB2 session to race an SMB2 TREE_CONNECT request against a concurrent session LOGOFF, so the tree-connection object is freed while smb2_tree_connect() is still initializing it and building the response. Successful triggering yields memory corruption in kernel context that can be leveraged for both confidentiality and integrity impact (KASAN reports slab-use-after-free at fs/smb/server/smb2pdu.c:2872). The CVE carries a 9.8 base score from the kernel CNA, but the assessed vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting that exploitation requires a valid session and precise timing; EPSS is low (0.19%, 9th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overflow is reachable through the login process before authentication completes. Because the flaw is triggered during the pre-authentication login path, a remote attacker with network reachability to the management server's login/administration service needs no credentials, no user interaction, and no non-default configuration, and the resulting code execution is described as running with root privileges - consistent with the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not listed in CISA KEV), but the pre-auth, root-level impact and the criticality of the management plane make this a top-priority patch target; CPE data lists the product with a wildcard version, indicating the affected version range is not bounded in the available feed data.
Concurrent NVMe-FC I/O submission in the Linux kernel's qla2xxx QLogic Fibre Channel driver can corrupt the hardware request-ring producer state, producing duplicated or dropped commands. The defect affects hosts running the qla2xxx driver with a QLogic FC HBA configured for NVMe-over-FC that uses ha->base_qpair; qla_nvme_ls_reject_iocb() advances the ring and rings the request-in doorbell via __qla2x00_alloc_iocbs() and qla2x00_start_iocbs() (both of which assume hardware_lock is held) but two of its callers, qla_nvme_xmt_ls_rsp() and qla2xxx_process_purls_pkt(), invoke it without holding qp_lock_ptr. Our independent assessment rates this as a local, race-window-dependent integrity/availability issue (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L), materially lower than the vendor's NVD score of 9.8, because the reject events are driven by Fibre Channel fabric/transport conditions rather than attacker-supplied input and require precise concurrency with normal base-ring submission; there is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV).
A double-completion race in the Linux kernel's qla2xxx QLogic Fibre Channel driver can cause a use-after-free write into a freed on-stack completion structure, leading to kernel memory corruption, a kernel crash, or potential local privilege escalation. Only hosts with a QLogic FC HBA and the qla2xxx driver loaded are affected, and the fault requires qla24xx_async_abort_cmd() to fail while the response ISR completes the same SRB handle at almost the same instant the async IOCB timeout handler re-scans outstanding_cmds[], so the attacker must win a very narrow concurrency window - local access only and no network reachability. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); vendor patches are available in the stable releases 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 and 7.3-rc1, and the NVD score of 9.8 (AV:N/AC:L/PR:N) should not drive prioritization given the assessed vector of AV:L/AC:H/PR:L/UI:N.
Root-level remote code execution affects Pepperl+Fuchs ICE2/ICE3-series and Phoenix Contact IOL-MA8 IO-Link master gateways, where an unauthenticated attacker uploads a crafted IODD (IO Device Description) file that drops and executes an arbitrary shell script as root. The injected script survives reboot, granting persistent full control of the industrial device. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but the CVSS 9.8 rating reflects trivial network reachability and complete device compromise.
Authentication bypass in Pepperl+Fuchs ICE2/ICE3-series IO-Link masters (and OEM-equivalent Phoenix Contact IOL-MA8 modules) lets a remote unauthenticated attacker reach the _account_log function and authenticate as administrator, even on devices where accounts are correctly provisioned. The flaw grants full administrative control of the device management interface with no credentials. Reported by CERT@VDE; no public exploit code and no active-exploitation evidence are present in the available data, though the CVSS 9.8 rating reflects trivial exploitability.
Unauthenticated privilege escalation in JetFormBuilder - Dynamic Blocks Form Builder plugin for WordPress (versions up to and including 3.6.2) allows remote attackers to create administrator-level user accounts on affected sites. The flaw stems from missing validation that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback, enabling arbitrary user creation with maximum privileges. No public exploit code has been identified at time of analysis, but the CVSS 9.8 critical rating and lack of authentication or user interaction make this a top-priority risk for any site running the vulnerable plugin.
The TrueBooker - Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which can be leveraged to reset the account's password and gain access to it.
Server-side request forgery in WuzhiCMS up to and including version 4.1.0 lets an attacker direct the server to fetch an arbitrary URL through the ckditor::saveRemote handler in coreframe/app/attachment/index.php, by manipulating the source[] argument of the Remote Image Fetch component. Publicly available exploit code exists (a public GitHub issue, wuzhicms/wuzhicms#221, documents the flaw) and the vendor was notified early but has not responded, so no fixed release is available at time of analysis. The vulnerability is not confirmed as actively exploited (no CISA KEV listing); the supplied CVSS 4.0 vector scores 6.9 and rates it unauthenticated (PR:N) and remotely reachable with no user interaction, but our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N and cautions that the CKEditor attachment/upload handler is typically reachable only within an authenticated content-editing session - defenders should verify in their own deployment whether saveRemote is exposed pre-authentication.
SQL injection in code-projects Matrimonial System 1.0 allows remote, unauthenticated attackers to inject arbitrary SQL through the /search.php endpoint of the Regular Search component by manipulating any of the sex, mothertongue, maritialstatus, country, state, religion, agemin, or agemax parameters. The vendor-scored CVSS 4.0 base of 6.9 reflects limited per-dimension impact, but our independent assessment rates it more severely on confidentiality (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), since a successful injection can expose the full contents of the backend database with no credentials, user interaction, or non-default configuration required. Publicly available exploit code exists (a GitHub proof-of-concept repository targeting the sex and mothertongue parameters), but there is no indication of confirmed active exploitation (CISA KEV) and no EPSS data was provided. The practical risk is tempered by the application's likely negligible production footprint as a tutorial-grade PHP project.
Unauthenticated remote code execution affects Arista EOS platforms on which the non-default P4Runtime service has been explicitly enabled, letting an attacker who can reach that service take complete administrative control of the switch. The defect is a code-injection flaw (CWE-94) triggered by a crafted packet during P4Runtime session initiation, rated 9.5 Critical under CVSS 4.0 and assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, with high attack complexity and a changed scope because compromise of the switching platform can extend to subsequent systems. Exposure is limited: P4Runtime is disabled by default, so stock EOS deployments are not at risk, and successful exploitation also depends on a specific timing/condition requirement (AT:P, 'Attack Requirements: Present'); Arista discovered the issue internally, reports no malicious exploitation in customer networks, and no public exploit code has been identified at time of analysis.
SAML single sign-on handling in Delinea Secret Server (On-Prem) 10.5.0 through 12.1.3 allows an unauthenticated remote attacker to impersonate another Secret Server user by presenting a valid SAML IdP response under certain conditions, giving high confidentiality and integrity impact to the impersonated account and to connected components (CVSS 4.0 base 9.5; assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). No pre-existing Secret Server credentials and no victim interaction are required, but the vulnerability only affects deployments actually configured to use SAML-based SSO, and exploitation hinges on unspecified preconditions in the SAML assertion-handling path (reflected as AC:H/AT:P), so the raw 9.5 score overstates how easily the flaw can be triggered. There is no CISA KEV listing and no public exploit identified at time of analysis; environments using local or AD-backed authentication and versions later than 12.1.3 are not affected per the assessed exploitation conditions.
Authenticated gRPC users on Arista EOS devices that have AAA-based gRPC authorization enabled for OpenConfig can have their requests evaluated at the wrong privilege level and matched against the wrong AAA method list, granting read and configuration-write access they should not hold. The flaw (CWE-266, incorrect privilege assignment) is confined to the gRPC OpenConfig path; Arista explicitly states that non-gRPC OpenConfig requests such as NETCONF are not affected, and the vulnerable configuration is not a default state. A vendor patch is available via Arista Security Advisory 0163, and no public exploit code has been identified at time of analysis; the supplied CVSS 4.0 score of 9.4 should be treated with caution, as it reflects an authorization mismatch on a management interface that requires an already-authenticated user (CVSS vector PR:H) plus a non-default AAA configuration rather than an unauthenticated, scope-changing compromise.
RabbitMQ's amqp091-go Go client library, in all versions before 1.13.0, builds TLS configuration from amqps:// URIs without setting a minimum protocol version, so builds that use a Go runtime permitting TLS 1.0 or 1.1 can negotiate an obsolete protocol. An active man-in-the-middle positioned on the network path could then force a downgrade and weaken the confidentiality and integrity of AMQP traffic, including credentials, though the independently assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) shows this requires a high degree of attacker positioning plus the legacy-toolchain precondition, and the published 9.4 CVSS 4.0 score overstates real-world exposure for modern deployments. The fix is a two-line MinVersion change shipped in version 1.13.0; no public exploit identified at time of analysis.
Unauthenticated OS command injection in the WNC T-Mobile 5G Box IDU router (firmware below 1.1.0.651412) lets an attacker on the adjacent network run arbitrary shell commands as root through a crafted cli_cookie parameter POSTed to /cgi-bin/portal.cgi. Because the affected parameter is concatenated straight into a shell 'find' command with no sanitization, successful exploitation yields full root-level control of the device - high confidentiality, integrity, and availability impact - and the CVSS 4.0 score of 9.4 reflects that severity. The decisive limiting factor is reachability: the vector is AV:A (adjacent), so the attacker must already sit on the LAN/Wi-Fi side or the same L2 segment unless the management interface is exposed to the WAN. There is no CISA KEV entry and no public exploit code identified at time of analysis, but a vendor patch exists, and CERT-PL is credited with reporting the issue.
HTML injection in the Royal Elementor Addons WordPress plugin before version 1.7.1067 lets unauthenticated visitors inject arbitrary HTML into the administrator notification emails generated by the plugin's form widget. Because form submissions are not sanitized before being embedded in the email body, an attacker can place crafted markup, malicious links, or spoofed content in mail that lands in the site administrator's inbox. Publicly available exploit code exists, and exploitation hinges on the administrator opening the notification email (CVSS UI:R), giving a base score of 6.1; no CISA KEV listing or EPSS score was supplied with the source data.
Command injection in Arista EOS-based products lets an authenticated user of the gRPC Network Security Interface (gNSI) Certz service escalate privileges and run arbitrary OS commands as root by sending a crafted Certz Rotate request, resulting in full device compromise; the Bootz service is affected by the same flaw. The issue is a CWE-78 OS command injection reported by Arista and carries a CVSS 4.0 base score of 9.4. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated OS command injection in the edgserver management service of Advantech EKI-1242EIMS and EKI-1242IEIMS gateways running firmware V1.06.01 lets remote attackers execute arbitrary operating-system commands with root privileges via crafted requests sent to TCP port 5058. No credentials or user interaction are required (CVSS 4.0 vector PR:N/UI:N, provider score 9.3; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact), and default configurations are affected. Exploitation is gated only by network reachability to the management port - there is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the issue is a genuine high-priority risk on any deployment where port 5058 is exposed beyond a trusted management segment.
OS command injection in the WNC T-Mobile 5G Box IDU router's portal.cgi password-change function allows an attacker who already holds high-privilege portal credentials and is positioned on the adjacent network to run arbitrary operating-system commands as root, yielding full device compromise (CVSS 4.0 base 9.3). The root cause is improper neutralization of shell metacharacters in the http_passwd_hidden and http_passwdConfirm_hidden parameters, so a crafted password-change request is interpreted by the underlying shell rather than treated as inert input. Only firmware below 1.1.0.651412 is affected and the issue is fixed in 1.1.0.651412; exploitation is constrained by AV:A (LAN/Wi-Fi-side reachability, not the public internet) and PR:H (valid admin credentials required first), and no public exploit identified at time of analysis.
Authenticated OS command injection in the WNC T-Mobile 5G Box IDU router's web management portal lets an admin-level attacker on the adjacent network run arbitrary shell commands as root. The flaw (CWE-78) sits in the ping diagnostic feature of /cgi-bin/portal.cgi, where the ping_ip, ping_size, and ping_times POST parameters are concatenated into a system command without validation or sanitization; no user interaction is required once credentials are held. All firmware versions below 1.1.0.651412 are affected, and exploitation is constrained by two prerequisites - network reachability to the portal (AV:A, adjacent/local rather than internet-facing) and valid high-privilege (PR:H) portal access - so the practical risk, despite the 9.3 CVSS 4.0 base score, is bounded by the fact that the attacker must already be an authenticated admin on the local network segment. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV) at time of analysis; CVE-2026-40855 was reported by CERT-PL and a vendor patch exists.
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to read CRM approval-workflow data through GET /admin-api/crm/flow/flow-users, disclosing approval chain topology, step ordering, approver identifiers, and personal information such as login names, nicknames, departments, email addresses, mobile numbers, and last-login IP addresses. The endpoint does enforce authentication but omits any role or permission check, so a single low-privilege admin-panel account is sufficient - no elevated privileges, user interaction, or special configuration are required. Publicly available exploit code exists for this issue, although the CVE is not listed in CISA KEV; the practical barrier to exploitation is the requirement to hold or obtain a valid back-office session.
Missing authorization in the StoreProductController onSale handler of Yshop CRM through 2.1.3 allows any authenticated back-office user (regardless of assigned role) to toggle product sale status by calling GET /admin-api/product/store-product/sale with sequential product IDs, letting them withdraw entire catalogs from sale or re-enable withdrawn products. The flaw is an integrity-only issue (CVSS 3.1 base 5.3, PR:L) - it is not reachable anonymously and causes no data disclosure or service outage. Publicly available exploit code exists (a Python PoC published alongside the request), but there is no confirmed active exploitation (not in CISA KEV); this is a genuinely low-to-moderate risk issue despite the CRITICAL-sounding CWE-862 label.
Authenticated back-office users can abuse yshop-crm through 2.1.3 to send SMS and email to arbitrary customers via POST /admin-api/crm/customer/send-sms and /send-mail, because CrmCustomerController does not enforce authorization on those actions. Publicly available exploit code exists, but exploitation requires a valid back-office account (PR:L), is remote with no user interaction, and yields only limited integrity impact; no confidentiality or availability impact is assessed. The practical risk is therefore concentrated on malicious insiders or attackers who have already obtained CRM credentials, not pre-auth compromise of default installations.
Address-rollover bug in the Linux kernel's KVM/arm64 TLB-by-VA invalidation path causes the hypervisor to silently skip an invalidation when the range ends at the last page or block of the TTBR1 VA space, because the exclusive end computation (base + size) wraps to zero. The faulty logic was introduced in Linux 6.16 and is fixed in 6.18.51, 7.2.5 and 7.3-rc1; hosts running unpatched kernels are exposed where a guest vCPU can drive trapped TLB-by-VA invalidations, while the IPA-invalidation path never suffered the rollover. The assessed vector is local (AV:L) with low privileges (PR:L) and high attack complexity (AC:H) because of the narrow address-layout precondition, with scope change and high availability impact; no public exploit code and no confirmed active exploitation (no CISA KEV entry) have been identified, and the provided reference CVSS of 9.3 overstates the practical risk relative to that assessment.
Race conditions in the arm64 KVM path that invalidates VNCR translations can leave a stale stage-1 TLB entry installed for a page-table mapping that another vCPU has just invalidated, so a guest can keep using a translation the host believes is gone, corrupting host state and potentially crashing the host. The flaw only affects arm64 hosts running KVM with nested virtualization (FEAT_NV2 / VNCR fixmap) enabled where an attacker already controls a guest with at least two concurrently executing vCPUs, and exploitation hinges on winning a narrow race window between invalidate_vncr_va() on one vCPU and a VNCR translation fault-in on another (one vCPU rewriting S1 page tables and issuing TLBI S1E2 while the other is mid-walk). Because the path is local-only and nested virtualization on arm64 is rarely deployed, the independent assessment rates the issue well below the vendor's CVSS 9.3 (assessed AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H - high availability impact, low integrity impact, no confidentiality impact); no public exploit identified at time of analysis, and vendor patches are available in Linux 7.2.5, 6.18.51 and 7.3-rc1.
Missed TLB invalidations in the arm64 KVM nested-virtualization path of the Linux kernel can leave stale translations for an L1-supplied VNCR page in L0, allowing a guest with control of an L1 vCPU on an arm64 host to cross the guest-to-host boundary in a timing-sensitive way. Affected systems are those running kernel 6.16 or later with arm64 nested virtualization (FEAT_NV2 / VNCR page support) enabled and exposed to a guest; the flaw is a guest-to-host (L1-to-L0) issue, so exploitation requires guest-vCPU privileges and is local to the host, which contradicts the vendor's PR:N vector. Vendor-released patches exist in Linux 6.18.52, 7.2.5, and 7.3-rc1, and no public exploit code has been identified at time of analysis; the vendor's CVSS of 9.3 substantially overstates real-world risk given that nested virtualization is off by default and deployed on only a small subset of arm64 KVM hosts, and the missed-invalidation window is opportunistic and mapping-state dependent rather than deterministic.
Range-based TLB invalidation in the arm64 KVM hypervisor of the Linux kernel is computed against the wrong address range because the decode_range_tlbi() helper omitted the required virtual-address sign-extension when it was reused for stage-1 TLBI handling, and the same helper can overflow physical-address bits when invoked for stage-2 invalidation. Only arm64 hosts running KVM are affected, and the attacker must already control a guest VM/vCPU able to issue range-based TLBI operations (low-privilege guest context, no user interaction, no network reachability); kernels from the 6.16 introduction through the fixes in 6.18.51, 7.2.5 and 7.3-rc1 are in scope. Exploitation results in stale or incorrectly scoped TLB entries on the host, with the assessed impact being availability loss (A:H) plus limited integrity impact (I:L) and no confidentiality impact; no public exploit identified at time of analysis.
Unauthenticated attackers can book time slots in the Appointment Hour Booking WordPress plugin (before 1.5.95) that have already reached their configured capacity, because each appointment in a multi-appointment booking submission is not validated against the capacity limit of its own slot. The plugin assigns a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only impact), meaning any anonymous visitor can submit a crafted booking form and overwrite or occupy fully booked slots, denying legitimate customers their reservations. Publicly available exploit code exists per WPScan, but the issue is not listed in CISA KEV and EPSS-style mass exploitation signals are absent, so this is best treated as a business-logic abuse and booking-integrity risk rather than a code-execution emergency.
Unauthenticated visitors can mark unpaid Eventin orders of any value as paid by replaying a single genuine low-value payment transaction, because the plugin only checks that the gateway reports success and never validates the amount, currency, or which order the transaction belongs to. The flaw affects WordPress sites running the Eventin event-management plugin before version 4.1.24, and exploit detail is publicly available via the WPScan advisory. There is no indication in the supplied data that this is being actively exploited (no CISA KEV listing), and EPSS data was not provided.
Reflected cross-site scripting in Delinea Secret Server (On-Prem) versions 10.2.19 through 11.9.48 allows an attacker to craft a malicious link that, when clicked by a legitimate Secret Server user, causes the browser to execute attacker-supplied JavaScript in the context of the Secret Server web application. The attacker requires no authentication (PR:N per the CVSS 4.0 vector), but exploitation is not self-contained: a human victim must be lured into clicking the link (UI:A), and the practical impact scales with the victim's privileges - a privileged vault user's session and access could be abused to read or modify secrets, producing high confidentiality and integrity impact on both the vulnerable system and subsequent systems (VC:H/VI:H, SC:H/SI:H, S:C). CVSS 4.0 base score is 9.3 (Critical) and the independently assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N; no public exploit code and no confirmed active exploitation were identified at time of analysis, and note that only on-premises deployments in the stated version range are affected - SaaS/cloud instances are not listed as affected.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices (and OEM equivalents from Phoenix Contact and others) allows a low-privileged authenticated attacker to execute arbitrary OS commands as root via the PHP endpoint /index.php/ajax/get_iodd_menu_info. Any valid user or operator account - the lowest access tiers on the device - is sufficient to achieve full device compromise. No public exploit has been identified at time of analysis, but the vulnerability is straightforward (CWE-78) and reported across three separate CERTVDE advisories covering multiple vendor SKUs, indicating a shared firmware base.
A crafted DNSKEY whose owner name is a compression pointer into its own RDATA overflows the digest buffer in the DNSSEC validator of NLnet Labs Unbound 1.26.0 and earlier, letting an attacker who controls an authoritative zone crash a validating recursive resolver and, depending on heap layout, potentially execute code with attacker-influenced data. Exploitation is unauthenticated over the network per the CVSS vectors but is gated on DNSSEC validation being active and on inducing the resolver to query a name in the attacker's zone; the independently assessed impact is primarily denial of service (availability High, confidentiality and integrity Low), with remote code execution only possible rather than demonstrated. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, although the vendor rates the issue 9.1 under CVSS 4.0 and an advisory has been published.
Out-of-bounds heap reads in the Linux kernel's ext4 inline-directory code (ext4_read_inline_dir()) let a local actor who can present a crafted inline-data ext4 directory - by creating one on a writable ext4 volume with the inline_data feature enabled, or by mounting a malicious ext4 image (e.g. via removable-media automount) - leak kernel heap memory and crash the kernel through an ordinary getdents64()/iterate_dir() call. The kernel emits a KASAN slab-out-of-bounds report in __ext4_check_dir_entry when the size-2 rec_len probe is dereferenced past the end of the kmalloc(inline_size) buffer. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is 0.21% (11th percentile), indicating low predicted exploitation activity; the supplied CVSS of 9.1 (AV:N/PR:N) is inconsistent with the flaw's local-only reachability and should be treated as mis-scored, with the assessed vector being AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H (High).