Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory traversal with a malicious file upload to place and execute arbitrary scripts, resulting in full loss of confidentiality, integrity, and availability on the management server (vendor-assigned CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability is network-exploitable with no authentication and no user interaction, so the decisive real-world factor is exposure: these servers are normally confined to internal administrative networks, and risk rises sharply if the affected upload endpoint is reachable from an untrusted network. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and affected version ranges are not enumerated in the available data.
Remote code execution affects F5 BIG-IP systems that terminate traffic on a virtual server configured with both an APM (Access Policy Manager) access policy and an OAuth profile, where crafted malicious traffic can trigger a heap-based buffer overflow in the data plane. The flaw is remotely reachable, unauthenticated and low complexity per the vendor's CVSS 4.0 base score of 9.3, and the independent assessment confirms full confidentiality, integrity and availability impact (C:H/I:H/A:H) with no control-plane exposure; Appliance mode does not mitigate it. Exploitability is sharply limited by configuration - instances without APM or without an OAuth profile bound to a virtual server are not affected - and no public exploit code was identified at time of analysis, though the combination of unauthenticated RCE and a widely deployed enterprise appliance makes prompt hotfix deployment the priority.
Unauthenticated remote attackers can reach privileged internal functionality on customer-hosted (on-prem) Arista VeloCloud Orchestrator deployments, potentially compromising the confidentiality, integrity, and availability of the orchestrator itself and the data it manages. The vulnerable code path is exposed pre-authentication (PR:N) with no user interaction required, though the vendor's CVSS 4.0 vector and our independent assessment both assign high attack complexity (AC:H), indicating exploitation depends on specific conditions or non-trivial request crafting rather than a single trivial call. Arista-managed Hosted and Dedicated VCO instances have already been patched and are not at risk; only customer-run on-prem VCO appliances remain exposed, and no public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can manipulate WordPress core's get_page_template() page-template resolution so that it includes a chosen, readable local .php file residing outside the active theme directories; where the required server and active-theme preconditions are both satisfied, that include escalates to remote code execution. The issue carries a CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the high attack complexity reflecting the need for a suitable readable PHP file and matching environment conditions rather than any authentication or user-interaction barrier. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; on hardened or non-matching configurations the impact degrades to local file inclusion and information disclosure.
Default, hard-coded credentials shipped on several administrative and system accounts in HPE's Analytics and Location Engine (ALE) allow an unauthenticated remote attacker to log straight into the management interface and the underlying operating system, yielding full compromise of the appliance. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) because no authentication, user interaction, or special configuration is required - the attacker only needs the known default secrets, which are typically published in advisories or recoverable from firmware - and there is no CISA KEV listing or public exploit code reported at time of analysis. Practical exposure is tempered by deployment context: ALE normally sits inside enterprise WLAN/management networks rather than on the public internet, so real-world risk depends on an attacker already having a foothold or reachability into those internal segments.
Unauthenticated remote command execution in Softaculous Virtualizor before 3.2.9 Patch 9 (and the 3.0.0 branch) lets attackers take root on the host and all managed VPS instances by exploiting the billing module handler. Publicly available exploit code exists, and exploitation requires only network reachability to the billing/panel interface-no authentication or user interaction. Vendor patches are available in 3.2.9 Patch 9 and 3.3.0, making immediate upgrade the top priority.
Missing authentication in the WebSocket Service of the Gigatech PDV5701 point-of-sale terminal (firmware 1.0.31_240305_112640, exposed via /index.html) lets unauthenticated remote attackers reach functionality that should require credentials, yielding full confidentiality, integrity, and availability impact with a CVSS 4.0 score of 9.3. Exploitation needs only network reachability to the device's WebSocket endpoint - no credentials and no user interaction (PR:N/UI:N) - though practical exposure is limited to attackers who can route to the terminal, which is typically deployed on a constrained retail or fiscal LAN rather than the public internet. Publicly available exploit code exists; there is no confirmed evidence of active exploitation (not in CISA KEV), and the vendor was contacted prior to disclosure but did not respond.
Stored/DOM cross-site scripting in the Home Assistant frontend Statistics Graph card lets an authenticated user or a malicious integration inject script-related HTML through an entity's default name, which is passed through getStatisticLabel and computeStateName and interpolated unescaped into ECharts tooltip HTML. The payload renders only when a separate victim hovers over an affected data point in a default Line chart (Bar charts are not affected), so exploitation needs low-privilege authenticated access plus victim interaction, and is therefore rated CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N rather than the vendor-published 9.3 base. No public exploit code or confirmed in-the-wild exploitation has been identified, and the flaw is fixed in Home Assistant 2026.7.0.
Remote code execution in Softaculous Virtualizor before 3.2.9 Patch 9 (and the 3.0.0 line) allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting a PHP object injection flaw in the billing module handler, where untrusted serialized data in the billing_data POST field is passed to unserialize() without allowed_classes restrictions. Publicly available exploit code exists. Our assessment rates this 9.8 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N), while the vendor's CVSS 4.0 score is 9.2 (AC:H), reflecting the dependency on a reachable POP chain; no authentication or user interaction is required.
Hard-coded credentials in LTSecurity LTK3500SF devices allow unauthenticated remote attackers who can reach Telnet or SSH to recover the root and guest passwords from reversible hashes in /etc/shadow and obtain full root-level operating system access. The affected firmware is AC3F_V1.1.0_build191121, and because the hashes are weak/reversible and identical across units, one successful cracking effort can compromise any reachable device. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV); EPSS is 0.51%, and real-world risk is bounded by the narrow deployment base and management-service exposure.
Remote code execution in D-Link DAP-1360 firmware 6.14 and earlier allows unauthenticated attackers to execute arbitrary commands as root via crafted requests to the web management interface. Exploitation requires only network reachability to the device's HTTP management interface-no credentials, user interaction, or non-default configuration-and publicly available exploit code exists, making this a high-priority risk for exposed devices. Successful compromise enables persistent configuration changes and use of the device as a pivot into the local network.
Server-side request forgery in MCP Atlassian (the Model Context Protocol server for Confluence and Jira) prior to 0.22.0 allows remote, unauthenticated attackers to make the server issue HTTP requests to internal or otherwise protected network resources. The flaw lives in validate_url_for_ssrf, which parses a URL's authority differently from the Requests connection layer when the server runs the header-based Jira/Confluence URL authentication flow, so a crafted backslash-containing URL can pass validation as an external hostname while the HTTP client actually connects to an internal host. Exploitation is limited to deployments that accept client-supplied Atlassian base URLs, requires the attacker to win the parser-versus-connection-layer discrepancy reliably, and no public exploit code or confirmed active exploitation was identified at time of analysis.
MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 applies its ENABLED_TOOLS and TOOLSETS least-privilege filters only when tools are enumerated via tools/list, and never re-checks them when a request is dispatched through tools/call. An authenticated, low-privileged MCP client that knows or guesses the exact name of an excluded tool can therefore invoke read, write, and delete operations against Confluence and Jira that the operator deliberately hid, yielding full confidentiality, integrity, and availability impact against Atlassian data (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-862 Missing Authorization). The flaw is meaningful only where the toolset configuration is the trust boundary - the highest risk is in shared-credential or multi-tenant deployments - and no public exploit code was identified at time of analysis. A vendor-released patch is available in version 0.22.0.
Stored cross-site scripting in the Ninja Forms WordPress plugin 3.15.3 lets an unauthenticated visitor plant a script payload inside any publicly accessible form field, which the plugin then renders unescaped on the admin submission-edit screen so it executes in the browser of the high-privileged user who opens that submission. Execution is not automatic: an administrator must review the malicious submission (UI:R), but reviewing submissions is the normal operational workflow, so that interaction gate is weak in practice, and an unauthenticated attacker can plant the payload at will (PR:N). Publicly available exploit code exists and the issue was reported by WPScan; the provided data contains no CISA KEV listing or EPSS score, so there is no confirmation of active exploitation, and our independent assessment rates the impact as changed-scope XSS with low confidentiality and integrity loss and no availability loss, rather than the higher 8.8 score carried alongside the CVE record.
Denial of service in the Vector observability pipeline's `logstash` source (versions 0.15.0 through 0.56.x) allows a remote, unauthenticated attacker to abort the Vector process by sending a stream of deeply nested compressed frames over the Lumberjack/Beats protocol. Because the decoder recursively decompresses `C` frames without a depth limit, each nested layer drives the decoding thread toward stack exhaustion, and the same construction can amplify decompressed data; per the independent assessment the impact is availability only (process termination and lost log ingestion for all tenants sharing the pipeline), with no confidentiality or integrity effect, and it requires an operator to have explicitly enabled the `logstash` source on its default 0.0.0.0:5044 listener. There is no indication of active exploitation (no CISA KEV entry) and no public exploit code identified at time of analysis; the issue is remediated in Vector 0.57.0.
Path traversal in MCP Atlassian releases prior to 0.22.0 lets a caller of the confluence_upload_attachment MCP tool read arbitrary files readable by the server's OS user and exfiltrate them by pushing them to Confluence as attachments. The upload code path converts a caller-supplied file_path to an absolute path without the workspace confinement that had already been added to the download path (CVE-2026-27825), so relative or absolute traversal sequences escape the intended workspace. The independent assessment scores the flaw CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (confidentiality only, no integrity or availability impact), requiring an authenticated caller with access to the MCP tool; the vendor's advisory scored it 8.6 with PR:N and S:C. No public exploit identified at time of analysis, and instances at 0.22.0 or later are not affected.
Unauthenticated arbitrary file read in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 lets a remote network caller abuse the streamable HTTP transport, which accepts requests carrying no user identity and silently falls back to the operator's global Atlassian credentials, to force the upload_attachment tool to read any file readable by the MCP process and push its contents into an attacker-chosen Jira issue or Confluence page, where the attacker can retrieve them. Exploitation requires the server to be running the streamable HTTP transport, reachable by the attacker, and configured with shared operator credentials - stdio-only deployments and deployments that enforce per-user identity/tokens are not exposed - and impact is confidentiality-only (file exfiltration), with no integrity or availability effect. There is no evidence of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the underlying issue is a path-traversal flaw (CWE-22) fixed in version 0.22.0, and the practical risk is bounded more by who actually deploys this MCP server over the network than by exploit maturity.
Arbitrary local file read leading to data exfiltration affects sooperset's MCP Atlassian server (mcp-atlassian) prior to 0.22.0, where the Jira update_issue tool converts a caller-supplied attachments argument into local filesystem paths and passes them to the attachment upload implementation without any workspace confinement. A caller able to invoke the update_issue tool can therefore use the server as a confused deputy, reading arbitrary files (e.g. credentials, config, SSH keys) readable by the server process and attaching their contents to a Jira issue the caller controls, with confidentiality impact only - no write or code execution through this flaw. Exploitation is access-gated: the vendor rates it AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N (8.6), while our independent assessment scores it PR:L/S:U, since a permitted MCP caller and a shared-credential deployment are realistic prerequisites; no public exploit code has been identified at time of analysis.
Unauthenticated attackers can rewrite any tenant's account balance in Softaculous Virtualizor before 3.2.9 (Patch 9) and in 3.0.0 by POSTing crafted 'act' and 'from_billing_module' parameters together with a 'billing_data' body containing arbitrary uid and balance values to the admin panel dispatcher, which executes a parameterized UPDATE against the users table without performing any authorization check. Publicly available exploit code exists, and vendor patches are available (3.2.9 Patch 9 and 3.3.0). Because no credentials, privileges, or user interaction are required (CVSS:3.1 PR:N/UI:N), any internet-reachable Virtualizor admin panel is directly exposed; the assessed impact is integrity-only - account balance manipulation that can drive automated service suspension for targeted accounts - not code execution or data disclosure.
Unauthenticated server-local file exfiltration in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows a remote caller to read any file accessible to the MCP process and have it uploaded to an attacker-controlled endpoint. The issue affects only deployments running the HTTP transports (streamable-http or sse) with READ_ONLY_MODE=false, where a request that carries X-Atlassian-Confluence-Url and X-Atlassian-Confluence-Personal-Token but no Authorization header is accepted as a 'pat' identity, so the attacker-chosen Atlassian URL is used to build the attachment client and the confluence_upload_attachment (or Jira attachment) tool accepts an arbitrary server-side file_path. CVSS 3.1 rates it 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) with confidentiality-only impact, a public Docker-based proof of concept was confirmed by the reporter so publicly available exploit code exists, and EPSS is low at 0.30% (23rd percentile) with no confirmed actively exploited (CISA KEV) status; version 0.22.0 fixes the flaw.
Loading a crafted Notepad++ plugin that reports more than 30 external lexers can overflow a 30-element stack array inside PluginsManager::loadPluginFromPath(), corrupting adjacent control data and potentially yielding arbitrary code execution in the Notepad++ process; the flaw affects all releases prior to 8.9.8. The attack is local and requires user interaction (the victim must install and load the malicious native plugin DLL), and because any loaded native plugin already runs in-process with full editor privileges, the incremental risk over simply distributing malicious plugin code is minimal - no public exploit identified at time of analysis, and the issue is not reachable remotely or through opened documents. Vendor-released patch: 8.9.8 (CVSS 8.6 base score; our assessment keeps the same 8.6 but treats scope as Unchanged rather than Changed).
Server-side request forgery in MCP Atlassian prior to 0.22.0 lets an attacker who controls or has already compromised the configured Atlassian backend return a 3xx redirect pointing at an internal address (for example the 169.254.169.254 cloud metadata service), which the MCP server's HTTP session then follows - potentially returning cloud IAM credentials or other internal service data to the attacker. Only deployments configured through the basic-auth or oauth_pat branches are exposed, because those fetcher sessions fail to attach the _make_ssrf_safe_hook redirect validator that the header-PAT branch sets via attach_ssrf_hook=True; header-PAT deployments are not affected. Publicly available exploit code exists (no CISA KEV listing, so no confirmed active exploitation), the vendor fix ships in 0.22.0, and EPSS remains low at 0.32% (26th percentile) with the assessed vector requiring high attack complexity and a malicious upstream prerequisite.
MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 lets a low-privileged authenticated MCP caller write attacker-chosen files into the server's working directory, because validate_safe_path defaults its base directory to os.getcwd() and the Confluence attachment call sites omit base_dir. Overwriting an importable Python module in that location can escalate to code execution once the application imports the modified module, and the vector intentionally bypasses the earlier remediation tracked as CVE-2026-27825. Exploitation requires permitted MCP tool access (CVSS vector shows PR:L, i.e. authenticated with low privileges) and a subsequent import or re-import of the overwritten module, so code execution is not immediate; no public exploit code has been identified at time of analysis and there is no CISA KEV entry. The vendor rates this 8.3, while an independent assessment confirms it is a genuine remote-exploitable code-execution path whose real-world priority is moderated by those preconditions.
Server-side request forgery in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows a low-privileged authenticated caller to force the MCP server to send requests to an arbitrary destination of the attacker's choosing by supplying the X-Atlassian-Jira-Url or X-Atlassian-Confluence-Url headers, which are consumed by _process_authentication_headers without passing through validate_url_for_ssrf. A successful attack redirects the server's Atlassian fetchers at internal services or cloud metadata endpoints, leaking response data back to the caller (scope-changing, high confidentiality impact, no integrity or availability impact per the assessed vector); no public exploit code was identified at time of analysis and EPSS data was not supplied. The defect is an incomplete remediation of the earlier SSRF CVE-2026-27826, and the project shipped a fix in version 0.22.0.
Arbitrary local file read in MCP Atlassian (mcp-atlassian) prior to 0.22.0 allows an authenticated MCP caller who can reach the Jira or Confluence upload_attachment tool over the HTTP-exposed 'streamable-http' transport to supply a traversal or absolute file_path that is not confined to the workspace, causing the server process to read sensitive local files and exfiltrate them as Atlassian attachments. The vendor rates this 8.3 (CVSS 4.0) with PR:L, high confidentiality impact and no integrity or availability impact, consistent with our independent assessment of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. Exploitation is limited by prerequisites: working Atlassian upload credentials and tool access must already be held, the HTTP transport must be exposed rather than stdio-only, and reachable data is bounded to files readable by the server process user; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
Arbitrary server-local file read and exfiltration in MCP Atlassian (sooperset/mcp-atlassian) prior to 0.22.0 lets an authenticated, low-privileged MCP caller abuse the upload_attachment tool for Confluence or Jira to read files on the server host via a caller-supplied file_path, then retrieve the pages' contents as a normal attachment. The vulnerability is CWE-22 (path traversal): the pre-0.22.0 code only normalized the path with os.path.abspath and performed no workspace confinement, so absolute paths and traversal sequences that escape the working directory are accepted. Impact is confidentiality-only (no write or code execution) and exploitation is conditionally gated - it matters primarily in shared-credential or multi-tenant deployments where a caller's legitimate upload capability exceeds its intended file-read scope; single-user, locally trusted deployments face negligible additional exposure. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the vendor fix is available in version 0.22.0.
Path traversal in the MCP Atlassian server (mcp-atlassian) prior to 0.22.0 allows an authenticated MCP client to read files from the host running the server and exfiltrate them as Jira or Confluence attachments, because the upload tools open caller-supplied file_path / file_paths arguments without confining them to the workspace. The privilege boundary only exists in remote or multi-user deployments (HTTP/streamable-http transport with operator Atlassian credentials shared across clients), since in a single-user stdio install the caller already owns the host; exploitation requires a permitted client authorized to invoke upload_attachment/upload_attachments (including via jira update_issue), and the read is bounded to files the server process can access. No public exploit code identified at time of analysis and no confirmed active exploitation; vendor-released patch: 0.22.0.
Information disclosure in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows an authenticated caller of the MCP server to read Jira issues, agile boards, and Confluence pages that the operator intended to exclude via JIRA_PROJECTS_FILTER or CONFLUENCE_SPACES_FILTER, because the Jira search path only checks whether a project clause is present rather than whether it is permitted, the Confluence search path applies an incomplete case-sensitive space check (and lets a caller-supplied spaces_filter replace rather than narrow the configured allowlist), and the Jira board APIs (get_board_issues, get_agile_boards) omit project-filter enforcement entirely. The flaw requires low privileges (an accepted MCP client) and no user interaction, but it only yields data beyond the intended scope when the server's shared operator credentials hold broader Atlassian access than the configured filter - the typical shared-credential, delegated, or multi-tenant MCP deployment. There is no confirmed active exploitation and no public exploit identified at time of analysis; the issue is fixed in 0.22.0, and an independent assessment rates it a moderate-priority filter-bypass/authorization control failure rather than a top-tier emergency.
Notepad++ installations prior to 8.9.8 crash when a local attacker can control the -settingsDir= command-line argument and points it at an abnormally long directory path. When Notepad++ subsequently saves its session, NppParameters::writeSession copies the derived session path into a fixed MAX_PATH stack buffer with unbounded wcscpy/wcscat calls and appends the session-backup suffix, overflowing the buffer; on protected release builds the stack canary halts the process, producing a denial of service rather than exploitable code execution. Exploitation requires local influence over launch arguments (for example a malicious shortcut or portable install) plus the victim actually launching Notepad++ and reaching a session-save, so default installations using normal-length settings directories are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor's CVSS of 7.8 overstates impact given the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).
Arbitrary code execution in Notepad++ prior to 8.9.8 on Windows 10 and Windows 11 occurs when the editor's 'Folder as Workspace' → 'Run by system' action resolves a sibling file instead of the path the user actually selected. If an attacker can place a script named after the selected text file with a .cmd extension appended (for example notes.txt.cmd next to notes.txt), invoking 'Run by system' on the text file causes that script to execute as the current user instead of opening the file. The flaw is local with a required, non-default user workflow (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8), and no public exploit identified at time of analysis; the vendor-released patch is Notepad++ 8.9.8.
MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows an accepted MCP caller to read arbitrary files from the host on which the server runs: the confluence_upload_attachment tool opens a caller-supplied file_path after only converting it with os.path.abspath, with no check that the resolved path stays inside the workspace, and then uploads the contents as a Confluence attachment the caller can download back. The vulnerability is an access-gated, confused-deputy arbitrary-file-read (CWE-22, assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, high confidentiality impact, no integrity or availability impact); exploitation requires an authenticated MCP caller (PR:L), a server older than 0.22.0 configured with Confluence credentials that can write attachments, and a space the attacker can read back - single-user local stdio deployments where the caller already owns the host gain nothing. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in version 0.22.0.
Arbitrary server-local file disclosure in MCP Atlassian (sooperset/mcp-atlassian) prior to 0.22.0 lets an authenticated, permitted Confluence MCP caller read any file accessible to the server process by passing a traversal or absolute path to the upload_attachment tool and receiving the contents back as a published attachment. Exploitation requires only a valid MCP caller session (no user interaction, low privileges per PR:L), and the scope change in the CVSS vector reflects the server process acting as a confused deputy on behalf of the caller, yielding high confidentiality impact with no integrity or availability effect. There is no public exploit identified at time of analysis and no CISA KEV listing; the practical risk is highest in shared-credential or multi-tenant MCP deployments where the caller is less privileged than the server process, and is low in single-user deployments where the caller already owns the underlying filesystem. Vendor-released patch: 0.22.0.
Denial of service in the request-filtering-agent npm package (all versions prior to 3.2.1) lets remote attackers terminate a Node.js process by causing the application to request a literal private or reserved IP address such as 127.0.0.1 or the cloud-metadata address 169.254.169.254. RequestFilteringHttpAgent and RequestFilteringHttpsAgent threw synchronously from createConnection when rejecting such a literal IP; because Node's http.request/http.get expect connection failures to arrive asynchronously, the throw escaped req.on('error') and surfaced as an uncaught exception that crashes the process (CWE-248). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), so exploitation is unauthenticated but strictly an availability impact - the private-IP filter itself still rejects the request, and no confidentiality or integrity loss is assessed. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing; successful exploitation additionally requires the consuming application to let attacker input reach the agent as a bare IP literal rather than a hostname.
Unauthenticated denial of service in the sipgo SIP library (versions up to and including 1.4.2) lets any remote attacker who can reach a SIP-over-WebSocket (WS or WSS) listener crash or memory-exhaust the server process. WSConnection.Read allocates a buffer directly from the client-declared WebSocket frame length - a value the attacker controls up to 2^63-1 - before MaxFrameSize or the downstream ParseMaxMessageLength check is ever applied, so a single header-only frame with a huge declared length triggers a makeslice panic that terminates the whole process (sipgo does not recover it), or forces an oversized allocation. No authentication, credentials, or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CVSS 7.5, CWE-789), a working proof-of-concept frame is documented in the vendor advisory, and the flaw is fixed in 1.4.3; impact is confined to availability, with no confidentiality or integrity effect, and only services that actually enable the WS/WSS transport are exposed.
Memory-exhaustion denial of service in the SIPGO Go library (versions up to and including 1.4.0) lets an unauthenticated remote peer crash or destabilize any SIP service built on it that exposes a stream listener. A single SIP message sent over TCP, TLS, WebSocket, or WebSocket-Secure with an oversized, attacker-declared Content-Length header (up to 2^32-1) causes the stream parser to allocate a body buffer of that size before the library's 65535-byte max-message-length guard is evaluated, exhausting process memory. The flaw is fixed in version 1.4.1, the vendor advisory (GHSA-pg59-5vwg-4jxq) includes a working proof-of-concept, so publicly available exploit code exists; impact is availability-only with no code execution or data disclosure, consistent with the CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Denial of service in psd-tools before 1.17.4: PSDImage.composite() and PSDImage.numpy() size their output buffers directly from the geometry declared in an untrusted PSD header (width, height, channels, depth, and per-layer rectangles) before validating those values against the bytes actually present in the file, so a 49-byte crafted PSD can force a roughly 3.35 GB allocation. Any service that composites or rasterizes attacker-supplied PSD files - an upload-and-thumbnail pipeline, for example - can be driven out of memory and terminated, and no authentication, privileges, or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Impact is confined to availability, no public exploit has been identified at time of analysis, and the issue is fixed in 1.17.4.
Server-side request forgery in MCP Atlassian (sooperset) versions before 0.22.0 lets unauthenticated callers drive the server into issuing HTTP requests to internal or cloud-metadata addresses by exploiting a DNS-rebinding race in the header-based authentication flow. Only deployments on the header_pat branch, which trust caller-supplied X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers, are exposed; the URL is validated for SSRF once and then re-resolved by the HTTP client at connection time, so a low-TTL attacker-controlled hostname can return a public IP during validation and 127.0.0.1 or 169.254.169.254 during the actual request, with roughly 50 percent success per attempt. Publicly available exploit code exists (a DNS-rebinding proof of concept using rbndr.us), EPSS is low at 0.42 percent (36th percentile), there is no KEV listing indicating confirmed actively exploited (CISA KEV) status, and the vendor-released patch is version 0.22.0.
PHP Object Injection in the Ninja Forms WordPress plugin 3.15.3 allows unauthenticated attackers to plant serialized payloads in user-submitted form field values that are later deserialized when an administrator exports submissions to CSV. Publicly available exploit code exists, but full impact - arbitrary file operations or remote code execution - is conditional on a suitable POP gadget chain being present in another installed plugin or theme; without such a chain, the object injection has limited practical impact. The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (7.5) reflects the admin-initiated export action and POP-chain prerequisites rather than guaranteed code execution.
An out-of-bounds write in the MQTT client module of the lwIP TCP/IP stack lets an adversary who controls or impersonates the MQTT broker that a device connects to corrupt heap/stack memory and potentially achieve full code execution on that device. Only devices built with lwIP's optional MQTT client compiled in are exposed, and because MQTT connections are client-initiated the device is not directly reachable inbound: the attacker must operate a malicious broker, compromise the legitimate broker, or hold a man-in-the-middle position on the client-to-broker path (feasible where TLS is absent or certificate validation is disabled). No authentication or user interaction is required once that broker-side position is achieved, but no public exploit code has been identified at time of analysis and no CISA KEV listing exists; the vendor CVSS 4.0 score of 9.3 (AV:N/AC:L/AT:N) presents this as trivially exploitable, whereas the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the significant broker-control/MITM prerequisite.
Authentication bypass in 9Router (npm package '9router') before 0.5.6 lets a remote, unauthenticated attacker reach the public LLM API under /api/v1/* by simply adding the header X-9r-Real-Ip: 127.0.0.1, which the application's isLocalRequest() logic in src/dashboardGuard.js trusts when deciding whether canAccessPublicLlmApi() may skip API-key validation. Successful abuse grants unauthorized use of the instance owner's configured LLM providers, consumption of paid credits, and enumeration of configured providers and models; the verified affected route is GET /api/v1/models. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, 7.3), no authentication or user interaction is required, but exploitation is only possible on deployments where requests reach Next.js directly without the bundled custom-server.js wrapper and where the LLM API is network-reachable (the default bind is 0.0.0.0); instances correctly served through custom-server.js are not exploitable. The vendor advisory includes a proof-of-concept showing a 401 baseline request succeeding with 200 OK after the sole header is added.
Improper signature verification in the Notepad++ updater path allows a locally planted or modified GUP.exe updater binary to be accepted and launched even though its Authenticode digest is invalid, affecting versions 8.9.7 up to (but not including) 8.9.8 on Windows and fixed in 8.9.8. Exploitation is not remote and does not by itself yield remote code execution: it requires an attacker who already has the ability to replace or plant the updater-related file in the installation path (typically requiring elevated/admin rights for a default Program Files install, or a user-writable install directory), plus a victim who actively triggers the updater path (user interaction). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); this is a code-signing verification defect rather than a directly reachable remote vulnerability.
Arbitrary code execution in Adobe Campaign Classic, documented in Adobe security advisory APSB26-142, lets remote attackers run code in the context of the running ACC service. The vendor's CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) marks it as maximum severity: network-reachable, low-complexity, unauthenticated, requiring no user interaction, with a scope change and full loss of confidentiality, integrity, and availability. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis, so the practical exposure driver is whether an unpatched ACC instance is reachable over the network.
Unauthenticated remote code execution in Adobe Campaign Classic lets any attacker who can reach the server run arbitrary code in the context of the affected process, and the CVSS 3.1 base score is the maximum 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with scope changed, meaning a successful compromise can cross the component's security boundary and affect resources beyond its intended authority. No user interaction and no authentication prerequisite are required, so the practical exposure is driven almost entirely by whether an ACC instance is reachable from untrusted networks. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the structural severity signals make this a top-priority patch item; Adobe's bulletin APSB26-142 is the authoritative source for fixed builds.
Unauthenticated remote code execution in Adobe Campaign Classic (ACC) allows a network-reachable attacker to execute arbitrary code in the context of the current user, as described by the vendor CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (score 10.0). The flaw is a CWE-94 code injection issue tracked via CPE cpe:2.3:a:adobe:adobe_campaign_classic, with exact vulnerable and fixed builds enumerated only in Adobe advisory APSB26-142, which the provided data points to but does not quote. No public exploit code and no confirmed active exploitation were identified at time of analysis, but because exploitation requires no authentication and no user interaction, any ACC instance reachable from untrusted networks should be treated as high risk.
Unauthenticated remote code execution in Adobe Campaign Classic allows an attacker who can reach the application to execute arbitrary code with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); no user interaction is required, and the scope change means impact is not necessarily confined to the vulnerable component. The affected version range and fixed build are not enumerated in the available intelligence, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, so risk is currently driven by structural severity rather than observed attacks. Because ACC is an internet-reachable marketing automation platform that typically stores customer data and holds credentials for downstream systems, this should be treated as a top-priority patch item even though corroborating sources are limited to Adobe's own advisory.
Remote, unauthenticated attackers can execute arbitrary code in the context of the current application user on systems running Adobe Campaign Classic, tracked as CVE-2026-73369, per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C with a base score of 10.0 (CWE-94 code injection). Exploitation requires no authentication, no user interaction, and no confirmed special configuration; the vector's changed scope (S:C) means the compromise can affect resources beyond the vulnerable component's security authority, though the code itself runs as the current application user rather than as a privileged system account. No public exploit code has been identified at time of analysis and CISA KEV does not list this issue, but the impact, the low attack complexity, and the two practical limiting factors - network reachability of the ACC instance and the currently unspecified affected version range (CPE is a wildcard) - make this a genuine top-tier priority for any deployment confirmed affected by Adobe advisory APSB26-142.
Code injection in Adobe Campaign Classic allows remote attackers to execute arbitrary code in the context of the current user, carrying a maximum-severity CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with no user interaction required under the vendor vector. The CPE data flags the product with a wildcard version, so the specific affected release range is not enumerated in the supplied intelligence, and Adobe's advisory (APSB26-142) is the only reference. Exploitation status: no public exploit identified at time of analysis; independent analysis cautions that the advisory is sparse and that the description's 'current user' wording may imply an existing session context, so the PR:N unauthenticated rating should be confirmed with Adobe.
Incorrect authorization in Adobe Experience Manager Forms JEE (the 6.5 and 6.5 LTS branches) allows a remote, unauthenticated attacker to bypass intended access controls and execute arbitrary code in the context of the running AEM service account, with no user interaction required. The scope-change (S:C) rating and the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H produce a maximum 10.0 base score, reflecting that successful exploitation can affect resources beyond the vulnerable component itself. Exposure is limited to deployments where the Forms JEE component is installed and network-reachable - typically internet- or intranet-facing AEM Forms servers - and at time of analysis no public exploit code or confirmed active exploitation (CISA KEV) was identified, though the pre-authorization nature of the flaw makes it an attractive target for rapid weaponization.
Remote code execution in Adobe Campaign Classic allows an unauthenticated network attacker to invoke functionality that should have been access-controlled, achieving arbitrary code execution in the context of the current application user without any user interaction. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, score 10.0) reflects a scope-changing flaw, meaning the vulnerable component can affect resources beyond its own security boundary - a combination that makes this a genuine top-priority vulnerability for any internet- or partner-reachable ACC deployment. As of analysis there is no CISA KEV listing and no public exploit identified at time of analysis; Adobe's advisory APSB26-142 is the authoritative source for affected and fixed builds.
MCP Atlassian server versions prior to 0.22.0 allow an authenticated MCP caller to read arbitrary files from the server host by supplying an absolute or traversal path to the file_path argument of the jira_upload_attachment or confluence_upload_attachment tools, whose bytes are then uploaded into Atlassian and can be read back by the same caller. Exploitation is conditional: it requires the server to be deployed in HTTP or multi-user mode (not single-user stdio), a permitted caller able to invoke the upload tools (CVSS PR:L), and shared operator credentials so the exfiltrated content lands where the attacker can retrieve it; impact is confidentiality-focused (C:H) with limited integrity effect (I:L) and no availability impact. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though EPSS context was not provided; the vendor-released fix is version 0.22.0.