Malicious or compromised Model Context Protocol (MCP) server containers run under ToolHive CLI before 0.30.1 or ToolHive Studio before 0.38.0 are not network-isolated by default, allowing them to reach Docker gateway addresses (host.docker.internal, gateway.docker.internal, 172.17.0.1) and, critically, ToolHive's own API and MCP proxy endpoints, which are reachable without authentication (CVSS vector PR:N). A hostile MCP server can therefore read exposed data and logs, invoke sibling MCP tools, alter process or workload state, and disrupt services without ever escaping the container, with the scope change (S:C) reflecting a pivot from the container into the ToolHive control plane; exploitation requires user interaction because an operator must choose to run the untrusted server (UI:R). The vendor rates this 8.8 (High/Critical); no public exploit code was identified at time of analysis and the issue is not in CISA KEV, though the impact is severe for anyone running third-party MCP servers on Docker with default settings. Fixes are available in ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, which flip network isolation to enabled by default.
Arbitrary Python code execution in LMDeploy 0.12.1 through 0.12.2 lets an attacker who publishes a malicious model on HuggingFace Hub run code on any machine that loads it, because the model's `quantization_config.quant_dtype` string is interpolated into `eval(f'torch.{quant_dtype}')` at lmdeploy/pytorch/config.py:620 without any validation. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects that exploitation is remote and unauthenticated but requires the victim to actively load the attacker-supplied model, confirmed by our independent assessment that UI:R is the limiting factor and that the `_update_torch_dtype` whitelist at line 53 only guards `torch_dtype`, not `quant_dtype`. Publicly available proof-of-concept code exists in the vendor advisory (repo-level proof using a mocked HF config that yields `uid=0(root)`), but there is no confirmed actively exploited (CISA KEV) status, and no EPSS score was supplied; a fixed release, 0.12.3, is available.
Pre-authentication denial of service in the Moxa TN-4500B series Ethernet switches: improper validation of the username field length during Web login processing lets a remote, unauthenticated attacker send an overly long username that overflows a buffer and crashes the authentication process. No credentials (PR:N) and no user interaction (UI:N) are required, so any TN-4500B switch whose HTTP/HTTPS management login is reachable from the attacker's network is at risk, and the vendor-supplied CVSS 4.0 vector scores it 8.8 with availability impact rated High. The exploit's practical constraint is exposure rather than complexity - switches with web management confined to an isolated OT/management VLAN are not reachable and therefore not exploitable. Realized impact is limited to a crash-driven loss of availability; no data disclosure or confirmed code execution has been demonstrated, and no public exploit code was identified at time of analysis.
Authorization bypass in the TECHIN2B Application (builds V1.0.7676.13 through 18092026) allows an authenticated low-privilege user to reach objects, records, or functions that belong to other accounts by tampering with a user-controlled key in the request. The vendor was contacted by TR-CERT before publication but did not respond, so no public exploit code has been identified and no vendor-released patch is available at time of analysis. Exposure is limited in practice to organizations actually running an affected build, but for those deployments the flaw is network-reachable, requires no user interaction, and yields high confidentiality and integrity impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, TR-CERT score 8.8).
Unauthenticated stored cross-site scripting in the iGMS Direct Booking WordPress plugin (all versions before 2.0) lets any remote attacker write arbitrary JavaScript into the plugin's widget appearance settings, which is then rendered without escaping and executes in the browser of an administrator opening the settings page or of any visitor viewing a page that displays the booking widget. The write itself requires no credentials (CVSS vector PR:N) and no privileged configuration, so default installations are exposed; however, the payload only fires when a victim loads the affected page (UI:R), and the assessed impact is limited to low confidentiality and integrity with scope change (S:C/C:L/I:L/A:N) rather than the higher CIA values in the NVD base score. Exploitation is realistic rather than theoretical: publicly available exploit code exists, WPScan published the advisory, and a vendor fix is available in version 2.0 - multiple signals converge on this being a genuine priority rather than a paper tiger.
Stored cross-site scripting in the VikBooking Hotel Booking Engine & PMS WordPress plugin (versions before 1.8.15) allows unauthenticated visitors to attach files to the plugin's live-chat feature whose type is not restricted and whose contents are not sanitized, so injected active content executes in the authenticated session of an administrator or staff member who opens the conversation. Injection needs no authentication, but successful execution is gated on user interaction - the targeted admin must view the malicious attachment in the WordPress admin area - and publicly available exploit code exists, with no CISA KEV confirmation of active exploitation. Note that the vendor's 8.8 score overstates the risk for what is fundamentally a cross-site scripting flaw with low confidentiality and integrity impact and no availability impact.
Stored cross-site scripting (XSS) in the Easy Form Builder by WhiteStudio WordPress plugin (versions 4.0.0 up to but not including 4.2.0) lets unauthenticated attackers submit crafted values to certain form types that are stored and later rendered without escaping in an administrator-facing submissions page. Publicly available exploit code exists, and the vendor has released version 4.2.0 to fix the flaw. Our independent assessment rates this as a scope-changed XSS with low confidentiality and integrity impact, lower than the vendor’s 8.8 CVSS score, because the payload only executes when a privileged user views the plugin’s admin page.
PHP object injection in the ShortPixel Image Optimizer plugin for WordPress (all versions up to and including 6.5.5) allows an authenticated attacker holding Author-level capability or above to feed attacker-controlled serialized data into the plugin's Replacer and OptimizeAiController code paths, which can instantiate arbitrary PHP objects on the target site. Because the plugin ships no usable POP (property-oriented programming) gadget chain, the flaw has zero security impact on a site where only ShortPixel is installed - exploitation requires the additional presence of a co-installed plugin or theme that supplies a working gadget chain, after which the attacker could delete arbitrary files, retrieve sensitive data, or execute code depending on that chain. No public exploit identified at time of analysis; note that our assessed vector (AC:H) is materially less severe than the vendor's 8.8 base score (AC:L), reflecting the mandatory external gadget dependency.
Stack exhaustion in the Node.js 'braces' library (micromatch) through 3.0.3 lets unauthenticated remote attackers crash the hosting Node.js process by supplying brace patterns nested deeply enough to overflow the call stack - for example long chains of '{{{{...}}}}' kept just under the library's internal character-length limit, so length-based input validation does not block the payload. Exploitation requires an application path that forwards attacker-controlled strings into braces' recursive AST walkers (the braces(), expand(), or compile() paths referenced at parse.js L38-40, expand.js L102-105, and compile.js L49-53), such as a web parameter or filename routed through micromatch/chokidar-style globbing; the result is an uncaught RangeError that terminates the process. Per the supplied CVSS vector (PR:N/UI:N) no authentication or user interaction is needed on the vulnerable code path, and the CVSS 4.0 score of 8.7 is driven entirely by availability (VA:H) with no confidentiality or integrity impact; no public exploit code was identified at time of analysis.
Stored cross-site scripting in SiYuan through 3.8.4 lets an attacker who can set a notebook name containing an HTML payload have that markup rendered unescaped when the Daily Note picker dialog is opened, executing JavaScript inside the Electron renderer where Node.js integration is available and escalating to operating system command execution. Exploitation is gated by two preconditions: the attacker must be able to create or inject a notebook carrying the payload (a shared or synced workspace, a server-mode multi-user deployment, or an imported malicious notebook), and the victim must open the picker; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, while the published CVSS 4.0 score of 8.6 carries PR:N/UI:A, so the two scorings disagree on whether prior privileges are needed. This is treated as a genuine high-priority issue rather than a high-score-but-low-real-risk case, because the impact chain terminates in OS command execution rather than mere client-side script execution; no public exploit code and no confirmed active exploitation were identified at time of analysis, and a purely local single-user instance that never ingests external notebooks has a materially smaller attack surface.
Authenticated buffer overflow in the web management interface of the TOTOLINK A3002MU router (firmware build Hh-B20211125.1046) lets an attacker who already holds a valid management session corrupt memory via an oversized 'webpage' argument submitted to /boafrm/formSchedule, with the potential for code execution and full loss of confidentiality, integrity, and availability. The reporting source rates it 8.6 (CVSS 4.0), and publicly available exploit code exists, but there is no confirmed active exploitation and the flaw is not in CISA KEV. In practice this is a genuine but moderate-priority issue: the CVSS vector's PR:L and the device's normally LAN-only management plane mean the attacker needs authenticated access reachable to the router's admin interface, so risk rises sharply only where remote/WAN administration or default credentials are exposed.
A buffer overflow in TOTOLINK A3002MU routers running firmware Hh-B20211125.1046 lets an authenticated remote attacker corrupt memory by sending an oversized submit-url value to the formWlAc handler at /boafrm/formWlAc, potentially gaining full control over the device's confidentiality, integrity and availability. Publicly available exploit code exists - a proof-of-concept write-up is published on GitHub and the flaw is documented by VulDB - but there is no evidence of confirmed active exploitation (CISA KEV). Multiple signals align to a moderate-to-high real-world risk, with the practical prerequisite being valid credentials or an active admin session and a management interface reachable from the attacker's network.
Stored cross-site scripting in Semantic MediaWiki 3.1.0 through 6.x lets users with the MediaWiki 'edit' right inject arbitrary HTML and JavaScript via the data-subtab attribute, with execution occurring when a victim views the affected page. Publicly available exploit code exists, but the independent assessment rates this as a moderate-severity issue because it requires edit privileges and user interaction. The flaw is fixed in Semantic MediaWiki 7.0.0.
Unauthenticated SQL injection in the Tz Weekly Radio Schedule WordPress plugin through version 1.8.1 lets remote attackers read arbitrary data from the underlying WordPress database through an AJAX action registered for unauthenticated callers. No login, role, or user interaction is required - the vulnerable endpoint is reachable by anyone who can load the site (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N per the assessed vector) - and publicly available exploit code exists per the WPScan report, though no confirmed active exploitation (CISA KEV) has been reported. Impact is limited to confidentiality: database read and extraction, with no write or availability impact described, and the practical risk is constrained mainly by the plugin's niche deployment footprint.
Unauthenticated SQL injection in the Tz Weekly Radio Schedule WordPress plugin (all versions through 1.8.1) lets any remote attacker inject arbitrary SQL through a publicly reachable AJAX action and read sensitive data from the site's database. No login, role, or user interaction is required - the vulnerable handler is registered as an unauthenticated (nopriv) AJAX action - and publicly available exploit code exists, making this a high-priority fix for any site running the plugin. There is no confirmed evidence of active exploitation (not listed in CISA KEV), and the practical blast radius is limited by the plugin's niche install base and by the confidentiality-only impact (data extraction, with no data modification or denial of service reported).
Unauthenticated SQL injection in the WordPress plugin 'Product Question and Answer' (versions through 1.1.0) lets remote attackers inject arbitrary SQL through AJAX actions that are explicitly exposed to logged-out users, enabling exfiltration of sensitive database contents such as user credential hashes and other site data. The flaw requires no authentication, no user interaction, and no non-default configuration - only that the plugin is installed and active - and publicly available exploit code exists via the WPScan proof-of-concept, so the exploitation barrier is low; there is no indication of confirmed active exploitation (no CISA KEV listing). Our independent assessment rates this CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), slightly below the 8.6 feed score which assumes a scope change; the practical risk driver is the confidentiality-only, full-database read impact combined with trivial remote reachability.
Unauthenticated SQL injection in the Price Drop Alert for Woo Commerce WordPress plugin (all versions through 1.1) allows any remote attacker to inject arbitrary SQL through a publicly reachable AJAX action and read sensitive data from the underlying WordPress database, including user credential hashes, WooCommerce order and customer records, and stored configuration secrets. Publicly available exploit code exists and the issue was reported by WPScan, but there is no CISA KEV listing and no confirmed evidence of widespread exploitation, so the practical risk is concentrated on the subset of WordPress sites that actually run this niche WooCommerce add-on. No vendor-released patch has been identified at time of analysis, meaning the only reliable mitigation today is deactivating and removing the plugin or virtually patching the AJAX endpoint.
Unauthenticated SQL injection in the WordPress plugin 'wp shortcut link and advertisement baner' (all versions through 1.2.0) allows remote attackers to inject arbitrary SQL through a parameter passed to an AJAX action that is registered for non-logged-in users, exposing the site's database contents. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) confirms the flaw is exploitable without any credentials and with no user interaction, and that impact is limited to confidentiality; publicly available exploit code exists, so scanning and exploitation attempts are feasible, though the plugin's low profile and likely abandonment mean real-world exposure is narrower than the raw 8.6 score implies. No CISA KEV listing is associated with this CVE, so confirmed active exploitation is not established. This is a genuine, actionable issue but is probably lower operational priority than the vendor score suggests, unless the plugin is actually installed on an internet-facing site.
Forged content modification in django-page-cms through 2.0.13 lets unauthenticated remote attackers exploit five CSRF-exempt admin mutation views in pages/admin/views.py to store unescaped page content that then renders to every site visitor as stored cross-site scripting. The attack is unauthenticated from the attacker's side (CVSS vectors list PR:N) but requires user interaction: an authenticated editor or admin must be lured to attacker-controlled HTML while holding an active CMS session (UI:P), so this is a genuine but conditional risk rather than a drop-everything emergency. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the secondary effects are bounded - the forged mutation only persists once a privileged victim's browser has sent the request successfully.
Cross-scope secret disclosure in Perses (versions 0.43.0 through 0.54.0-rc.0) allows an authenticated user holding only GlobalDatasource:create or a project-level datasource-creation right to attach a project or global Secret they are not permitted to read to a datasource they control, causing Perses to forward the decrypted secret in plaintext to an attacker-operated endpoint. Exploitation requires an account with datasource-create permission in a deployment where Datasource and Secret scopes are separately granted, plus the ability to point the datasource at attacker-controlled infrastructure; the vendor fix enforces a Secret read-permission check on both the datasource-creation service and the unsaved-datasource proxy paths, and older releases can be fully protected by creating datasources via provisioning and revoking the datasource-create right. No public exploit code has been identified at time of analysis, and there is no indication of active exploitation (CISA KEV).
The legacy DOC renderer in File Viewer emits document-controlled hyperlink targets into generated HTML after character escaping but without restricting URL schemes, so a crafted legacy .doc file can render a live javascript:, vbscript:, or data: link and execute script in the embedding application's origin when a user clicks it. Applications are affected if they use @file-viewer/doc up to and including 2.3.0 or the msdoc-viewer compatibility package up to and including 0.2.1 to render untrusted .doc files; exploitation is conditionally gated, requiring a victim to open the preview and click the malicious link (CVSS 8.2, UI:R, scope changed). No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor-released fixes exist in @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2.
zot container registry versions prior to 2.1.18 mis-map the HTTP DELETE method to the "push" scope action in its bearer authentication handler, so an authenticated client holding a token scoped only to pull and push can delete manifests and blobs inside that token's repository scope. Because bearer-authenticated requests also skip the fine-grained DistSpecAuthzHandler and the DeleteManifest/DeleteBlob handlers perform no independent permission check, no delete authorization is ever required; the attacker can make images unavailable and alter repository history (CWE-285, CVSS 8.1). Exploitation requires the registry to be configured for bearer/JWT authentication and the attacker to already possess a valid, unexpired token covering the target repository - no public exploit code has been identified at the time of analysis, and the flaw is fixed in 2.1.18.
An authorization bypass in the Filter Gallery WordPress plugin (farazfrank:filter_gallery) affects all versions up to and including 1.1.4, allowing any authenticated user with subscriber-level access or above to delete arbitrary gallery records - including their filters, image mappings, settings, and details options - by supplying attacker-controlled gallery IDs. The delete handler never verifies ownership or capabilities, and the accompanying nonce check can be evaded simply by omitting the nonce POST field entirely, although a present-but-invalid nonce is correctly rejected. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H (8.1), and no public exploit code and no confirmed active exploitation were identified at time of analysis; sites that permit open user self-registration are the most exposed, so vendor CVSS 8.1 is well supported by the description.
Memory exhaustion in the adm-zip Node.js library before 0.6.1 allows remote, unauthenticated attackers to crash or severely degrade any service that reads entries from untrusted ZIP archives: a 105-byte crafted archive whose central directory declares an uncompressed size of ~1.77 GB forces the library to commit roughly 1.8 GB of resident memory before validation fails, which OOM-kills memory-constrained processes (containers, serverless, small VMs) and, with concurrency, can exhaust larger hosts. Publicly available exploit code exists - the vendor advisory includes a self-contained 105-byte base64 PoC (sha256 980d34356fbb248fe527b9d0ac3eabc5c99393a374014be6199523de16709386) - and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms a network-reachable availability-only impact with no privileges or user interaction required. There is no indication of confirmed active exploitation (not in CISA KEV), and applications that never parse attacker-controlled ZIPs are not exposed; the practical severity is governed by host memory limits rather than by any authentication or configuration bar.
Moquette MQTT brokers running versions prior to 0.18.1 fail to enforce topic write ACLs on Last Will and Testament messages, letting a remote, unauthenticated client (CVSS vector contains PR:N) publish attacker-controlled payloads into ACL-protected topics it is not permitted to write to. The attacker sets a restricted topic as the Will Topic in the CONNECT packet and then drops the connection abnormally (for example with a TCP RST) so the broker fires the Will through PostOffice.publishWill() → publish2Subscribers() without ever calling authorizator.canWrite(), the check that guards normal QoS 0/1/2 PUBLISH paths. The published CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N); our independent assessment concurs on network reachability, no privileges and no user interaction, with integrity-only impact, though it rates the per-event integrity effect as low because each bypass delivers only a single message (repeatable by reconnecting). No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is fixed in 0.18.1.
Authenticated path traversal in Perses before 0.54.0-rc.0 allows any user holding a valid Perses account to read arbitrary YAML and JSON files accessible to the Perses process by injecting directory-traversal segments (e.g. ../) into the project query parameter of list endpoints such as /api/v1/dashboards. The flaw is conditional: it only affects instances running the file-system database backend - deployments using the SQL backend are not vulnerable and that is the vendor's stated workaround - and the impact is limited to confidentiality (file read and cross-project enumeration), with no write, integrity, or availability effect. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the issue is fixed in 0.54.0-rc.0.
Privilege escalation in the All-in-One WP Migration and Backup WordPress plugin before 7.111 allows an authenticated user who has been granted the plugin's export capability - but not its import capability - to obtain an installation-wide secret and replay it against the plugin's import AJAX actions, importing an arbitrary site archive and gaining administrator access. Exploitation is not possible against a default install: it requires a non-default configuration in which an administrator has delegated the plugin's export capability to a role that does not also hold import capability, and the target site must run a version older than 7.111. Publicly available exploit code exists (reported via WPScan), making the flaw attractive to attackers who already hold a low-privileged account on a misconfigured site; the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (high impact, but with a hard configuration prerequisite).
Cross-tenant credential disclosure in Convoy (frain-dev/convoy) prior to version 26.6.8 lets an authenticated user or project-scoped API key holder read another tenant's Source record - including unredacted AMQP, Kafka, SQS, and Google PubSub broker credentials - by substituting a foreign Source identifier in GET /api/v1/projects/{projectID}/sources/{sourceID}. The endpoint correctly authorizes the project in the URL but Handler.GetSource resolves the Source purely by sourceID, so the object-level ownership check is missing (IDOR/BOLA, CWE-639). Exploitation requires only a low-privilege authenticated credential (CVSS:4.0 PR:L, CVSS:3.1 PR:L) plus knowledge or enumeration of the target Source UID; the list endpoint remains properly project-scoped and is not affected. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and a vendor-released patch is available in 26.6.8.
Authenticated users holding only viewer rights on a single project can read the dashboards, datasources, and variables of every other project in Perses deployments prior to 0.54.0-beta.3, by overriding the project in scope with a client-supplied 'project' query parameter on project-scoped list endpoints. Exploitation requires a low-privilege authenticated account (PR:L), needs no user interaction or non-default configuration, and yields read-only cross-tenant disclosure of full resource specifications rather than any modification. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released fix is version 0.54.0-beta.3.
Capsule, the Kubernetes multi-tenancy and policy framework (projectcapsule/capsule), mishandles case-insensitive sorting in its forbidden-list lookup on versions prior to 0.13.7, allowing an authenticated tenant owner to slip denied metadata keys past api.ValidateForbidden and bypass configured namespace, Service, or delegated node metadata restrictions - potentially altering cluster policies, network exposure, or pod scheduling outside the tenant boundary. Exploitation is conditional: the cluster administrator's forbidden list must mix capitalized and lowercase keys (or otherwise produce different case-insensitive and byte-order sortings), which is why the assessed vector is AV:N/AC:H/PR:L with scope change and high integrity impact. The flaw maps to CWE-697 (Incorrect Comparison), and no public exploit code or confirmed in-the-wild activity has been identified at time of analysis; a vendor fix is available in 0.13.7.
Unauthenticated stored cross-site scripting in WordPress core allows an attacker to plant a DOM-based script payload through the public comment feature and have it execute in the browser of any visitor or administrator who later views the affected page. The flaw is reachable on a default installation, because comment moderation is disabled by default and the requirement that a commenter have a previously approved comment can be bypassed; impact is gated by user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), so the injected script only fires once someone opens the affected content. Every core branch from 4.7 through 7.1 below its fixed maintenance release is affected, and at time of analysis no public exploit code was identified, though the low skill floor and the default-configuration reachability make it a genuine patching priority.
Authenticated low-privileged WordPress users can overwrite the content of arbitrary posts and wipe the Filter Gallery plugin's stored gallery options on sites running Filter Gallery versions 1.1.2 through before 1.1.5. The plugin's AJAX handlers skip nonce verification when the nonce field is omitted and perform no capability check, so any logged-in account - including subscribers - can invoke privileged actions over the network without user interaction. Publicly available exploit code exists and the WPScan entry documents the attack path, though there is no confirmation of active exploitation (CISA KEV); EPSS data was not provided. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, base 7.1) and our independent assessment agree on high integrity impact and low availability impact with no confidentiality loss.
Silent privilege-separation failure in AnyIO 4.14.0 and 4.14.1 on POSIX: when an application passes extra_groups to anyio.run_process() or anyio.open_process() to drop or clear supplementary groups before launching a less-privileged child, the library forwards the wrong variable (the group argument) to the backend, so an intended extra_groups=[] reset is ignored and the child silently inherits the parent's supplementary groups; if group is also supplied, the integer is passed where an iterable is expected and the launch aborts with TypeError. Impact is limited to local, non-network scenarios and only affects applications that already run with the privileges being dropped (PR:H) and rely on this specific code pattern to establish a privilege-dropping boundary, with no consequence unless the spawned child is subsequently compromised; no public exploit identified at time of analysis.
Local privilege escalation in Sublime Text for Windows - Sublime Text 4 through Build 4192 and Sublime Text 3 through Build 3207 - lets an authenticated local attacker who already holds an unprivileged account plant a malicious DLL in the user-writable update staging directory under %LOCALAPPDATA%, mark it read-only to defeat the installer's cleanup pass, and have the elevated installer copy the payload into the protected installation directory, where it executes in the context of any higher-privileged user who later launches the editor. The attack is local-only and conditional: it requires a prior foothold on the host, depends on the update staging mechanism being reached, and fires only when an elevated user subsequently opens the application (passive user interaction). Risk is real but situational rather than a mass-exploitation threat, and publicly available exploit code exists in the form of a published gist, so EPSS-style prioritization should focus on multi-user Windows endpoints where a standard user and an administrator both use the same Sublime Text install. No vendor-released patch is identified in the available data at time of analysis.
Unauthenticated access to the network video streaming service in CareCam CM2507 (HMT CM2507) IP cameras exposes live camera video to anyone who can reach the device across the network. Because the streaming endpoint ships with no authentication requirement at all (CWE-306), a remote attacker needs only network reachability - no credentials, no user interaction, and no special mode or configuration - to pull the live feed. The realistic blast radius is bounded by exposure and product footprint rather than by exploit difficulty: devices that are internet-facing or reachable through port forwarding are the ones at genuine risk, while units isolated on a dedicated LAN/VLAN are far less exposed. No public exploit code has been identified at the time of analysis, no confirmed active exploitation is indicated by the available intelligence, and CISA ICS-CERT has published advisory ICSA-26-258-08 describing the issue.
CM2507 IP cameras expose a privileged ONVIF management account that accepts an empty password, allowing anyone who can reach the camera's ONVIF service to log in with no credentials and read privileged device, user, media-profile, and stream configuration data. The flaw is fully remote, unauthenticated, and low complexity (CVSS 4.0 base 8.7; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality impact and no integrity or availability impact), but its practical reach is bounded by network exposure: the ONVIF service must be directly reachable, which for most deployments means the local LAN segment unless the camera is internet-facing or port-forwarded via UPnP. No public exploit code was identified in the available intelligence and there is no indication of confirmed active exploitation (not listed in CISA KEV); CISA ICS-CERT published advisory ICSA-26-258-08 covering the CareCam HMT CM2507 firmware line.
OS command injection in the web management server of PLANET IGS-5225-8P2T4S industrial managed switches lets a remote, low-privilege authenticated attacker run arbitrary operating-system commands and obtain root on the device. Only switches running V1 firmware before 1.2412b260707 or V2 firmware before 2.2412b260519 are affected; patched builds from the vendor address the flaw. Exploitation requires network reachability to the switch's web interface plus valid credentials (PR:L), so exposure is limited to segmented OT/industrial networks where the management UI is reachable; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though the high EPSS-relevant characteristics of authenticated command injection in edge/OT devices make prompt patching advisable.
Physical-access arbitrary code execution on Carecam HMT.CM2507 IP cameras, where firmware automatically runs a predetermined script from attached removable media without verifying its authenticity or integrity. An attacker who can reach the camera's SD/USB interface and insert crafted media can execute code in the device's security context, achieving high confidentiality, integrity and availability impact; the assessed CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no credentials or user interaction are needed once physical access is obtained, and that this is the primary limiting factor since there is no network-facing path to the flaw. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV - exploitation requires an attacker with hands-on access to the hardware.
Command injection in NUUO Network Video Recorder 2.0.0 lets remote, unauthenticated attackers (PR:N per the CVSS vector) execute arbitrary OS commands through the handle_import_privilege.php endpoint, although the CVSS UI:R metric indicates that some user interaction is required to trigger the flaw. The vendor software passes unsanitized input to an OS command (CWE-77), and SSVC rates the issue as automatable with total technical impact; publicly available exploit code exists via a referenced public gist, but there is no evidence of confirmed active exploitation (CISA KEV). Because NVRs are frequently internet-exposed, this is a genuine high-priority issue for any deployment of version 2.0.0.
Cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated user with access to the management interface inject script that executes in the browser of another logged-in user who views the poisoned page, enabling session theft or actions performed with the victim's privileges. The vendor rates this CVSS 8.9 (High) with scope change, but the CWE-79 classification and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) identify it as an input-neutralization/XSS flaw rather than the remote code execution implied by some tagging; exploitation requires a valid account (PR:L, authenticated) plus victim interaction (UI:R) and does not work unauthenticated. No public exploit code and no CISA KEV listing were identified at time of analysis, and the vendor has published a patch advisory, so risk is real but constrained by the authentication and user-interaction prerequisites.
Cross-site scripting in IBM Guardium Data Protection 12.2 allows an attacker holding valid low-privilege web interface credentials to inject content that executes scripts in a second, typically higher-privileged user's browser session when that user views the improperly neutralized page. Although the vendor description and the 'RCE' tag suggest arbitrary code execution, CWE-79 (improper neutralization of input during web page generation) and the assessed vector restrict impact to the victim's browser session in the web application's security context, not native code execution on the appliance, and exploitation requires both authenticated access and victim interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and IBM has published a patch advisory at https://www.ibm.com/support/pages/node/7288035.
Cross-site scripting (CWE-79) in IBM Guardium Data Protection 12.2 allows an authenticated remote user to supply crafted input to the web management console that is later rendered by a second, separate user's browser, executing attacker-controlled script in that victim's session. Exploitation requires two distinct conditions - a valid Guardium account to plant the payload and a privileged victim who loads the affected page - so it is not self-executing and cannot be triggered before authentication; despite the vendor description's reference to 'arbitrary code', the demonstrated impact is bounded to client-side script execution within the victim's browser session (session/token theft, forged UI actions, data exfiltration from the console), not server-side command execution. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and the vendor's 8.9 CVSS score overstates real-world risk relative to the assessed vector (PR:L/UI:R, confidentiality and integrity impact limited, no availability impact).
Authenticated command injection in IBM Cloud Pak for Data 5.1.2 lets a network-reachable, low-privileged user run arbitrary operating-system commands with elevated privileges on the underlying system. The flaw is an improper-neutralization-of-special-elements issue (CWE-78) in how user-supplied input is validated before being passed to a shell, and it rates CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning full loss of confidentiality, integrity and availability on the affected host once the attacker has any valid account. IBM has published a fix via its support advisory; no public exploit code has been identified at the time of analysis and there is no confirmation of active exploitation (CISA KEV).
Authenticated OS command injection in IBM Guardium Data Protection 12.2 lets a user holding only low-privilege console credentials execute arbitrary operating-system commands on the affected appliance through the exportCertificate functionality, resulting in full loss of confidentiality, integrity, and availability (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the attack requires valid credentials and network reachability to the Guardium management interface, it is not usable by unauthenticated outsiders; CISA's SSVC assessment records Exploitation as 'none' and Automatable as 'no', and no public exploit code has been identified at time of analysis. EPSS is 0.63 percent (49th percentile), consistent with a targeted, credentialed issue rather than a broadly exploited one, and IBM has published a vendor patch.
IBM MQ queue managers that process XA (X/Open distributed) transactions are vulnerable to a memory-corruption buffer overflow triggered when a malformed XA transaction identifier (XID) is parsed, allowing an authenticated attacker with network access to crash the queue manager and potentially execute arbitrary code in its context. Exploitation requires valid credentials and the ability to drive XA transaction operations over an MQ channel (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, vendor score 8.8), so the reliably achievable outcome is denial of service while code execution remains a potential, not guaranteed, consequence. There is no public exploit identified at time of analysis and no confirmed active exploitation, but a vendor patch is available and the low attack complexity combined with the complete loss of confidentiality, integrity and availability impact makes prompt remediation important.
Integer overflow (CWE-190) in IBM MQ distribution list processing lets an authenticated user with PUT authority to a distribution list send a crafted MQPUT message that corrupts memory handling, reliably crashing the queue manager and potentially enabling arbitrary code execution. The flaw is network reachable with low complexity and no user interaction (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High), but requires a valid MQ session plus put/queue authority on a reachable queue manager, so it is not exploitable by unauthenticated attackers. No public exploit code or confirmed active exploitation has been identified at time of analysis; an RCE outcome is not confirmed and the reliably achievable impact against affected versions is denial of service, while IBM has published a vendor fix.
Arbitrary file upload in WP Cloud Plugins (Use-your-Drive, Out-of-the-Box/Dropbox, Share-one-Drive/OneDrive-SharePoint, and Lets-Box/Box) versions 2.0 through 3.8.3 lets attackers with subscriber-level access write executable files to the WordPress uploads directory, enabling remote code execution (CVSS 8.8). The vulnerable download_file_to_uploads function is reachable through an import AJAX action that is also registered via wp_ajax_nopriv_ and lacks a capability check in can_import(), so the effective authentication prerequisite may be lower than the CVSS PR:L rating suggests, though exploitation still requires one of the four plugins installed and active and depends on the host allowing PHP execution inside wp-content/uploads. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV.
Heap-based buffer overflow in IBM MQ allows an authenticated, low-privilege attacker who can reach a queue manager to cause a denial of service or potentially escalate privileges by issuing an MQPUT operation that carries a malformed distribution header (the MQDH distribution-list header). The flaw is network-reachable, low complexity, and requires no user interaction (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with the assessed impact spanning confidentiality, integrity, and availability, although reliable privilege escalation beyond a crash remains unconfirmed. No public exploit identified at time of analysis, and the vendor has published a patch advisory at IBM support node 7287778.
Authenticated attackers holding only Subscriber-level access on a WordPress site can overwrite arbitrary user metadata through the Mapster WP Maps plugin (all versions up to and including 1.23.0), because the my_profile_update() handler forwards an attacker-controlled acf-photo-gallery-groups POST meta key and value directly into update_user_meta() with no nonce verification, no capability check, and no allowlist of permitted keys. Independent assessment rates the practical impact as integrity-only: the vendor description explicitly states privilege escalation is not possible, so Wordfence's CVSS 8.8 vector (C:H/I:H/A:H) is materially overstated and should be read as an arbitrary user-meta write primitive rather than a confidentiality or availability compromise or an admin-takeover path. Exploitation requires the site to permit low-privilege registration (or the attacker to otherwise obtain a Subscriber account), and no public exploit code was identified at time of analysis; no KEV or EPSS data was supplied.
Authenticated OS command injection in IBM Guardium Data Protection 12.2 allows a remote attacker holding a valid low-privilege session to execute arbitrary operating-system commands on the affected appliance, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8). The flaw is rated AV:N/AC:L/PR:L/UI:N/S:U, so exploitation requires credentials - authentication requirements are confirmed as authenticated (PR:L) by the assessed vector - but no user interaction and no non-default configuration; the specific vulnerable feature and input parameter are not disclosed in the advisory, and no public exploit code has been identified at time of analysis (not listed in CISA KEV). Realistic risk therefore centers on malicious insiders, compromised or reused operator accounts, and attackers who have already established a foothold on the management network, and IBM states a vendor patch is available.