Authenticated store customers can seize other shoppers' guest carts in Spree Commerce by calling PATCH /api/v3/store/carts/:id/associate with a derivable, reversible prefixed cart ID, gaining access to the cart's billing and shipping address data and disrupting the guest's in-progress checkout. The flaw affects the 5.4.x line from 5.4.0 and the 5.5.x line up to but not including the fixed releases 5.4.4 and 5.5.4, and only manifests on stores that permit guest checkout and where an eligible guest cart containing address data exists. Rated CVSS 3.1 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), this is a genuine but moderate IDOR-style authorization weakness rather than an unauthenticated takeover; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Concurrent upload-session requests in Cloudreve prior to 4.18.0 allow an authenticated user holding Files.Write permission - which the default User group provides - to bypass the per-account storage quota and reserve more space than the account is allowed, ultimately exhausting host disk and denying uploads to other users. The flaw is a time-of-check-to-time-of-use race: PrepareUpload validates capacity against a stale in-memory value while the actual storage charge is applied later and outside the same quota-enforcing transaction, so parallel requests that read the same snapshot all pass the MaxStorage check. Exploitation requires genuinely simultaneous requests and a valid low-privileged account, and impact is limited to availability (no data disclosure or code execution); no public exploit code was identified at time of analysis, and the issue is fixed in 4.18.0.
Server-side request forgery (CWE-918) in LightRAG before 1.5.5 lets an authenticated caller who can upload a Markdown or textpack document point an external image URL at an IPv6 transition-wrapper literal (NAT64 well-known prefix 64:ff9b::/96 or an IPv4-compatible ::a.b.c.d form) that embeds a loopback, RFC1918, CGNAT, or cloud-metadata IPv4 address, causing the parser's image download to fetch the internal resource and ingest its body. The guard in lightrag/parser/markdown/parser.py evaluated only the literal address with ipaddress.is_global, which classifies these wrappers as globally routable, so the embedded internal target was never checked. Exploitation is conditional (AC:H): the deployment must have compatible NAT64/DNS64 routing for the wrapper to be delivered to the embedded target, which is why the assessed vector is AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV). The issue is fixed in v1.5.5.
SQL injection in Adobe Connect lets a low-privileged authenticated user inject arbitrary SQL into a backend query, which Adobe states could lead to arbitrary code execution in the context of the current user and potentially account or session takeover. The vendor scores this 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and our independent assessment agrees on the high confidentiality, integrity, and availability impact while treating the scope change as unconfirmed (S:U) rather than vendor-asserted S:C. The key limiting factor is the PR:L prerequisite: a valid low-privileged Adobe Connect account is required, so anonymous internet attackers cannot exploit it directly, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Both the Adobe Connect web application and the Adobe Connect Android mobile app appear in the affected CPE set, indicating mobile sessions may reach the same vulnerable surface.
Improper validation of client-supplied transaction fields in the mppx fee-payer sponsorship path (src/tempo/internal/fee-payer.ts) allows an unauthenticated client to inflate the gas fees paid by a server's fee_payer wallet before version 0.8.2. Any deployment operating a hosted fee-payer/cosigning endpoint that accepts 0x78 FeePayerEnvelope submissions is affected; the attacker simply appends fabricated address-only EIP-2930 access-list entries whose intrinsic gas cost is charged to the sponsor, with a demonstrated 180-entry list raising the fee roughly 9.4x while remaining under the 500,000-gas policy cap, the 16 KB header limit, and the RPC simulation budget. Impact is limited to a bounded financial/availability drain on the sponsor wallet (no confidentiality, integrity, or code-execution impact), no public exploit code has been identified at time of analysis, and the issue is fixed in mppx 0.8.2.
Fee-sponsoring servers built on mppx before 0.8.2 can be induced by any client with access to the sponsorship endpoint to pay roughly five times the intended gas fee on otherwise-valid transactions. The FeePayerPolicy validator in src/tempo/internal/fee-payer.ts decoded client-supplied calldata with viem's decodeFunctionData but never rejected trailing bytes, so an attacker could append nonzero padding to a legitimate tip20/stablecoinDex call (transfer, approve, transferWithMemo, swapExactAmountOut) and inflate intrinsic calldata gas while gas_limit and max_fee_per_gas stayed inside the policy caps the server checks. Exploitation is unauthenticated and requires no user interaction, but impact is inherently bounded economic griefing: the demonstrated overpayment was limited to about 5x by the 16KB header ceiling (~5,500 padding bytes), and only operators who actually offer fee sponsorship are exposed. No public exploit code was identified at time of analysis and the issue is fixed in 0.8.2.
Stored cross-site scripting in the Text Styler WordPress plugin (all versions through 1.1.1) allows an authenticated user with contributor-level capabilities or above to save JavaScript inside a styling value that the plugin renders unescaped in a front-end style block, so the payload executes in the browser of anyone who views the affected post - including administrators. A secondary defect compounds the issue: the plugin does not verify that the user is permitted to edit the target post, so a low-privileged contributor can plant the payload on content they do not own. Exploitation requires only a valid contributor+ account and a victim viewing the crafted post (UI:R) on a site with this niche plugin installed; publicly available exploit code exists, and no public exploit is confirmed as actively exploited and the flaw is not listed in CISA KEV. Our independent assessment rates this moderate risk at CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Double-free memory corruption in the lwIP (Lightweight IP) stack's API layer lets an unauthenticated attacker on an adjacent network segment crash or corrupt memory on embedded devices and firmware that link lwIP, with confidentiality, integrity, and availability all assessed as high impact (CVSS 4.0 base 8.7; independent assessment CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack requires the attacker to already sit on the same or an adjacent L2 segment rather than the open internet, but needs no credentials or user interaction; successful exploitation can cause a denial of service and, depending on the target's heap hardening and allocator behavior, may extend to code execution, though reliable RCE on embedded targets is constrained by the difficulty of exploiting double-free conditions. No public exploit is identified at time of analysis, this CVE is not in CISA KEV, and no fixed version is published in the referenced sources, so mitigation currently rests on network segmentation rather than patching.
Notepad++ releases prior to 8.9.8 enforce their shortcuts.xml HMAC integrity check on the Macro menu and keyboard-shortcut paths but omit it on the WM_MACRODLGRUNMACRO handler that powers the 'Run a Macro Multiple Times' dialog, so a tampered macro that is correctly blocked elsewhere still executes when invoked from that dialog. An attacker who can write to the current user's shortcuts.xml (for example later-stage malware, a tampered installer, or a low-integrity shared profile location) can plant a macro that calls internal Notepad++ commands, including commands that launch external programs, running entirely in that user's context with no privilege elevation. Exploitation is gated by local write access and by the victim opening the multi-run dialog; CVSS 3.1 rates it 6.7 (AV:L/AC:H/PR:L/UI:R), authentication requirements are authenticated for a local user per the provided vector (PR:L), and no public exploit identified at time of analysis. This is a genuine but low-urgency defense-bypass rather than a high-impact remote flaw.
Denial of service in Plone's Dexterity content system lets an authenticated user with content-creation rights submit items carrying excessively long titles, descriptions, or uploaded-file names, rendering the site unresponsive and leaving the resulting content hard to edit or delete. The flaw affects plone.app.dexterity through 3.2.2, 4.0.0-4.1.2 and 5.0.0, and plone.app.contenttypes through 3.0.11, 4.0.0-4.0.9 and 5.0.0, and carries a CVSS v3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the AV:N vector still requires a valid low-privileged account. At the time of analysis there is no public exploit code and no confirmed active exploitation (not in CISA KEV); the practical risk is highest on sites that permit open self-registration or grant content-editing permissions broadly to untrusted users, while the patched releases strictly cap field lengths.
Arbitrary code execution in Adobe Connect - covering both the web application and the Adobe Connect Android mobile app - arises from improper input validation that an unauthenticated, network-positioned attacker can trigger by inducing a victim to open a crafted URL or interact with a compromised web page. Exploitation runs attacker-supplied code in the context of the current user, so the practical blast radius is bounded to that user's session and privileges rather than the underlying server host, even though the published CVSS 3.1 base score is 9.3 (Critical) on account of the scope change (S:C) and the high confidentiality/integrity ratings; our independent assessment scores confidentiality and integrity impact as Low because the mandatory victim click and user-context execution materially restrict reach. There is no public exploit identified at time of analysis, and exploitation requires user interaction (UI:R) with no drive-by or fully automated path.
Authenticated path traversal in MCP Atlassian (mcp-atlassian) prior to 0.22.0 lets a permitted MCP caller supply an absolute or traversal-laden file_path to the Confluence attachment-upload flow and cause the server to read and upload an arbitrary local file using the operator's credentials, exposing file contents to the linked Confluence instance. The flaw is a direct gap left by the CVE-2026-27825 fix, which hardened download destinations but never constrained upload source paths; only confidentiality is affected (no write or availability impact), and exploitation is bounded to files readable by the server process. No public exploit identified at time of analysis, and the issue is fully resolved by upgrading to 0.22.0.
Path traversal in MCP Atlassian (mcp-atlassian) before 0.22.0 allows an MCP caller that already holds attachment-upload authorization to supply an absolute path or ../ sequence to upload_attachment, causing the server to read an arbitrary server-local file and exfiltrate it through a Jira or Confluence attachment upload. The flaw is authenticated (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and confidentiality-only: the resolved path is never confined to the server workspace, but there is no write, code-execution, or availability impact through this specific issue. No KEV listing and no public exploit code were identified at time of analysis, and the practical risk is bounded by the requirement that the caller is already trusted to invoke attachment tooling - highest in shared-credential or multi-tenant MCP deployments where the caller should not have host filesystem visibility. The vendor-released fix is version 0.22.0.
Path traversal in the MCP Atlassian MCP server (all versions prior to 0.22.0) allows an authenticated MCP caller that is authorized to invoke the Jira or Confluence attachment-upload tools to read arbitrary files as the server process. The upload tools accept a caller-supplied file_path and, before the fix, only normalised it with os.path.abspath without confining it to a workspace, so any path readable by the server account - tokens, keys, configuration - can be packaged and exfiltrated to an Atlassian issue or page; CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects high confidentiality loss but no integrity or availability impact, and no public exploit code has been identified at time of analysis. The issue matters most in shared-credential or multi-tenant deployments, where a low-privilege caller gains read access far beyond its intended Atlassian scope.
Stored cross-site scripting in Adobe Connect and the Adobe Connect Android mobile app lets an attacker who can place a persistent JavaScript payload into a vulnerable form field execute script in the browser of any victim who later browses to the page rendering that field. Adobe rates the flaw Critical (CVSS 9.3, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), but the independent assessment tempers this to AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N because exploitation requires a mandatory victim page visit and the impact is confined to the victim's browser session/account context rather than server compromise. Authentication to reach and submit into the storable form field is contested - the vendor vector indicates PR:N while the assessment finds the form-submission step is typically an authenticated operation (PR:L) - and no CISA KEV listing, public exploit code, or EPSS signal appears in the supplied intelligence, so there is no public exploit identified at time of analysis.
Reflected cross-site scripting (XSS) in Adobe Connect and its Android mobile app allows unauthenticated remote attackers to inject malicious scripts into a victim's browser session via a crafted URL. Exploitation requires user interaction (UI:R), and impact is limited to the victim's browser context, potentially enabling session hijacking or data theft within the victim's privileges; no server-side code execution is possible. No public exploit identified at time of analysis, and Adobe rates this as 9.3 Critical, though the assessed CVSS vector indicates partial confidentiality and integrity impact (C:L/I:L).
Stored cross-site scripting (XSS) in Adobe Connect and the Adobe Connect Android mobile app lets an attacker plant malicious JavaScript inside a vulnerable form field, which then executes in the browser of any user who later browses to the page rendering that field - enabling session or account takeover inside the victim's browser context. Adobe rates the flaw 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), while independent analysis assesses it more conservatively as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, because the injection step realistically requires prior authenticated content-submission or authoring access and a victim must still be drawn to the affected page; impact is bounded by the victim's browser session rather than direct server compromise. There is no public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting in Adobe Connect allows an attacker to inject malicious scripts into vulnerable form fields, which then execute in a victim's browser when the victim browses to the page rendering that field (CVE-2026-75697). The vendor-assigned CVSS 3.1 score is 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), indicating remote, unauthenticated injection with required victim interaction and a scope change that reflects script execution in the victim's browser context, potentially leading to session or account takeover. Both the Adobe Connect web application and the Adobe Connect Android Mobile App are listed as affected; no public exploit code or confirmed active exploitation was identified at the time of analysis.
Approval workflow gating in Nautobot 3.0.0 through 3.1.7 can be bypassed by an authenticated user who holds only the extras.add_approvalworkflowstageresponse permission. The generic REST API create endpoint for ApprovalWorkflowStageResponse omits the approver-group membership check, the change permission on the object under review, and the one-response-per-user restriction that the intended approve/deny actions enforce, and it exposes writable user and state fields so a response can be attributed to an arbitrary user. An attacker can therefore post forged "approved" responses, satisfy min_approvers, approve the workflow, and activate its gated ScheduledJob without any legitimate approver - a moderate-severity authorization flaw (CVSS 6.4, CWE-285) whose real-world risk is bounded by the requirement for an insider or compromised account that has been granted that specific add permission on an instance that actually uses approval workflows; no public exploit code was identified at time of analysis, and the vendor released a patch in version 3.1.8.
Concurrent HTTP requests to Traefik's BasicAuth middleware can reveal whether a username is configured, because absent usernames are collapsed into a single deduplicated (singleflight) computation while real usernames each trigger a separate password hash - a measurable timing discrepancy that unauthenticated, remote attackers can exploit. Only Traefik 3.6.11 through 3.7.12 are affected, and only when BasicAuth middleware is enabled; Traefik v2 and Digest authentication are explicitly unaffected. The issue discloses username existence only - no credentials are exposed and authentication is not bypassed - and no public exploit code or confirmed active exploitation was identified at time of analysis, with exploitation further gated on the attacker issuing timed concurrent requests and statistically distinguishing the two code paths (CVSS 4.0 AT:P). Patched in 3.7.13.
Unauthenticated remote attackers can completely compromise the web management portal of Lantronix console servers, reading sensitive configuration files, writing files to arbitrary filesystem locations, and ultimately achieving remote code execution. Affected are SLC8000 units below firmware 9.7.0.5, EMG8500/EMG7500 units below firmware 9.7.0.1, and SLB882/SLCx-03/SLCx-02 devices, which are vulnerable in every firmware version released to date. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; vendor CVSS 4.0 score 10.0) requires nothing more than HTTP reachability to the portal upload endpoint - no credentials, user interaction or non-default settings - and exploitation yields total loss of confidentiality, integrity and availability on the device plus potential impact on serial-connected downstream equipment; no public exploit code has been identified at time of analysis, though a third-party technical writeup accompanies the disclosure.
Unauthenticated OS command injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a network-reachable attacker execute arbitrary operating system commands on the host, enabling code execution, data tampering, denial of service, and information disclosure. Per the NVIDIA-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), no credentials or user interaction are required, so an exposed controller interface is directly attackable; CISA's SSVC assessment rates technical impact as total, though exploitation has not been observed and the decision framework does not classify the issue as automatable. No public exploit code has been identified at time of analysis, and EPSS places the short-term exploitation likelihood at 2.10% (81st percentile) - elevated relative to the broader corpus but not indicative of active campaigns.
Reflected cross-site scripting in MCP Atlassian versions prior to 0.22.0 lets unauthenticated remote attackers inject markup or script through the OAuth error query parameter, which the CallbackHandler._send_response method in oauth_setup.py interpolates into an HTML page without escaping (CWE-79). Exploitation requires a deployment that uses the interactive OAuth setup flow and a targeted user who is actively completing that flow and opens the attacker's crafted authorization callback, which is why the assessed impact is confined to the victim's browser context (CVSS 5.4, C:L/I:L, UI:R) with no server-side code execution or Atlassian data-plane access. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the issue is fixed in version 0.22.0.
Server-side request forgery in Adobe Campaign Classic (versions up to and including 7.4.4 build 9401) lets remote unauthenticated attackers induce the ACC server to issue arbitrary requests to other systems, which the vendor rates as a privilege-escalation risk with a changed scope and a maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No authentication or user interaction is required per the vendor vector, so the practical limiting factor is whether the ACC endpoint is reachable by the attacker and whether exploitable internal services sit behind it; Adobe does not document a non-default configuration prerequisite, so default deployments in the affected range appear exposed. Exploitation status at time of analysis is that no public exploit has been identified, and EPSS is a modest 0.69% (51st percentile), though the vendor's high impact rating and the absence of preconditions justify prompt patching. An independent recalibration prefers C:H/I:L/A:N over the vendor's triple-high impact, so the 10.0 figure should be read as Adobe's upper-bound claim rather than a confirmed blast radius.
Arbitrary code execution in Adobe Campaign Classic allows a low-privileged authenticated attacker to run code in the context of the current user without any victim interaction, because the platform fails to properly validate input reaching an exposed processing component. The flaw scores 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and its scope change means a successful exploit can affect resources beyond the vulnerable component, raising the blast radius for confidentiality, integrity, and availability. The decisive prerequisite is authentication: per the assessed vector (PR:L), any valid low-privilege ACC account that can reach the component over the network is enough, but a fully anonymous remote attacker cannot trigger it; there is no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation, so the exploitation signals remain thin even though the severity math is high.
Plaintext storage of Atlassian OAuth credentials in MCP Atlassian before 0.22.0 lets any local user or process that can read the persisted token file recover live access and refresh tokens and reuse them against Confluence and Jira. The vulnerable code path is OAuthConfig._save_tokens, which writes ~/.mcp-atlassian/oauth-<client_id>.json using process-default permissions; on a host with a permissive umask, same-group or other local accounts can read it. Exploitation requires a pre-existing local foothold, a permissive umask, and that the OAuth plaintext-fallback file was actually created - it is not remotely exploitable and is not exposed on single-user hosts with a restrictive umask; no public exploit code was identified at time of analysis and this CVE is not in CISA KEV.
Unauthenticated network clients that can reach an mcp-atlassian server running in HTTP (streamable-http) transport mode can invoke Atlassian tools using the operator's globally configured Jira or Confluence credentials, inheriting that account's read and write access to both products. The flaw is an authentication deficiency (CWE-287) in which the request path through UserTokenMiddleware, AtlassianOpaqueTokenVerifier, and _get_fetcher accepts a request without a verified user identity and falls back to the shared, operator-scoped credential set; exploitation requires no authentication (PR:N), user interaction, or special privilege once the endpoint is reachable, which is why the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N (10.0). Exposure is limited to the shared-credential/multi-tenant deployment pattern - stdio-transport installs and per-user token deployments that never fall back to global credentials are not affected - and at the time of analysis no public exploit code had been identified and the issue was not confirmed actively exploited (CISA KEV).
Code injection in Adobe Campaign Classic allows an authenticated attacker holding only a low-privileged account to execute arbitrary code on the server in the context of the current user, with no user interaction required (CVSS 9.9, Critical). The flaw is network-reachable and low-complexity, but the required low-privilege account is the primary limiting factor - this is not exploitable by fully unauthenticated remote attackers, unlike some sibling Adobe Campaign issues. No public exploit code and no confirmed active exploitation were identified at time of analysis; Adobe has published a security advisory (APSB26-142) for the issue.
SQL injection in Adobe Campaign Classic allows an authenticated low-privileged user to execute arbitrary code in the context of the current user, with no victim interaction required, carrying a CVSS base score of 9.9. The vulnerability is exploitable over the network with low attack complexity (AV:N/AC:L/PR:L/UI:N) and is rated Scope Changed, meaning a successful attack can escape the ACC application boundary and affect the underlying database or host rather than remaining confined to the web tier. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the credential-only precondition and the low privilege bar make this a priority fix for any broadly provisioned or externally reachable Campaign Classic instance.
Server-side request forgery in Adobe Campaign Classic lets an authenticated, low-privileged user force the ACC application server to issue requests to internal or otherwise unreachable resources, turning the account into a foothold for reading confidential internal services (CWE-918; CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N). Adobe scores the issue 9.9 Critical, while our assessment keeps the scope change and high confidentiality impact but rates integrity as Low - the dominant effect is unauthorized reach into internal resources rather than direct tampering with protected data - which places effective risk in High territory (≈8.5) rather than Critical. Exploitation requires valid low-privileged ACC credentials and network reachability to the application, needs no user interaction, and no public exploit code or CISA KEV listing was identified at time of analysis.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift fails to properly validate symbolic links, allowing an authenticated remote user to read files outside the intended path and disclose sensitive information held by the financial platform. The affected code path is reachable across the network (AV:N) but requires a valid FTM session (PR:L), and no public exploit code or confirmed active exploitation has been identified at time of analysis. IBM has published a vendor patch via its support portal; while the vendor-assigned CVSS of 9.9 implies a scope-changing, high-integrity and high-availability impact, independent analysis of the described weakness assesses it as an information-disclosure issue (file read) rather than full system compromise.
Server-side request forgery in Adobe Campaign Classic (Classic v7), affecting builds up to and including 7.4.4 build 9401, lets an authenticated low-privileged user coerce the ACC server into making requests to internal systems the user cannot reach directly, with the trust-boundary crossing reflected as a scope change (S:C) that can escalate that user's effective access. No user interaction is required, and Adobe rates the issue 9.9, while our independent assessment retains high confidentiality impact but lowers integrity and availability to Low (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) and stresses that a valid low-privileged account is a prerequisite, so this is not remote-unauthenticated. No public exploit code and no CISA KEV entry have been identified at time of analysis, EPSS is low at 0.73% (53rd percentile), and SSVC marks the issue non-automatable with total technical impact - making the realistic risk targeted insider or post-foothold abuse rather than opportunistic internet-wide scanning.
Arbitrary server-side code execution in the Plone process is possible through the Classic portlet shipped in plone.app.portlets 5.0.0 through 7.0.1, where user-supplied template and macro fields are assembled into a TALES path expression and then evaluated by the TAL path() helper, allowing a crafted value to be interpreted as a full expression rather than a constrained path. Any authenticated user who can add or edit a Classic portlet can execute code, and under Plone's default role map that includes ordinary registered users on their personal dashboard, so the issue amounts to a post-authentication privilege escalation across the trust boundary between a web user and the server-side Plone process (CVSS 3.1 9.9, scope changed: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). There is no confirmed active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis, but vendor patches are available in 5.0.8, 6.0.4, and 7.0.2.
Authenticated OS command execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote attacker with a valid account plant special elements in a DataStage input path that are passed unsanitized into an operating-system command, resulting in arbitrary command execution with the privileges of the DataStage service. The prerequisite is a legitimate authenticated session (CVSS PR:L) on a network-reachable instance (AV:N/AC:L, UI:N), which limits realistic exposure to authorized users, compromised credentials, or malicious insiders on unpatched 5.4.0.0 deployments. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), but the vendor rates impact at 9.9 and a vendor patch is already available, so urgency is driven mainly by patch adoption rather than observed exploitation.
A stack-based buffer overflow in the RTI Connext Professional Core Libraries lets a remote, unauthenticated attacker corrupt memory by sending a crafted message to a reachable Connext/DDS endpoint, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) rates the result as high impact across confidentiality, integrity, and availability with scope change. Affected builds are Connext Professional 7.4.0 before 7.7.0.1, 7.0.0 before 7.3.1.6, and the legacy 6.1.0, 6.0.0, 5.3.0, 5.2.0, and 4.3x branches before their respective fixed releases; systems already on 7.7.0.1 or 7.3.1.6 (or later fixed builds) are not exploitable. The CVE carries a CVSS 4.0 base score of 10.0, and there is no public exploit identified at time of analysis, although the real-world exposure is bounded by the fact that DDS deployments are commonly placed on segmented or isolated real-time data-bus networks rather than the public internet.
Password recovery via a timing oracle in LightRAG's /login endpoint lets remote, unauthenticated attackers (CVSS PR:N/UI:N) reconstruct plaintext AUTH_ACCOUNTS passwords one character at a time by measuring microsecond-scale response-time differences in Python's short-circuiting '==' comparison, but only in deployments that store credentials as plaintext rather than bcrypt-prefixed values. The attack requires high attack complexity (AC:H) - low-latency network positioning, many samples to overcome jitter, and credentials short or simple enough to recover before noise or rate limiting defeats the oracle. It is fixed in v1.5.5, which also introduces uniform bcrypt timing and login rate limiting; no public exploit code was identified at time of analysis.
Remote code execution in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated network attacker run arbitrary code on affected deployments. The flaw is CWE-94 (improper control of code generation): user-controlled input is passed into a JavaScript `new Function()` constructor without neutralization, so injected input is compiled and executed as code. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) no credentials, privileges, or victim interaction are required - only network reach to the vulnerable code path. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the practical limiting factor is exposure, since the specific input-handling routine must be reachable and FTM's narrow financial-services enterprise footprint constrains the target population.
Unauthenticated remote code execution is possible in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift because the product improperly deserializes untrusted data (CWE-502), allowing a remote attacker who can reach a vulnerable endpoint to execute arbitrary code with the privileges of the affected service. IBM rates the flaw CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication, no user interaction and only network reachability are required, so any default-exposed FTM instance is at risk; the practical limiting factor is exposure, since FTM is specialized financial middleware normally deployed inside enterprise OpenShift clusters rather than on the public internet. Patch available per vendor advisory; no public exploit identified at time of analysis (no CISA KEV listing and no POC reporting in the available intelligence), though deserialization RCE is a well-understood and reliably weaponizable bug class once reachability exists.
Authenticated command injection in Lantronix out-of-band console managers (SLC8000, EMG8500/EMG7500, SLB882, SLCx-03, SLCx-02) allows any logged-in user - no administrative rights required - to execute arbitrary shell commands as root by abusing an undocumented 'mfc eeprom write' CLI command whose parameter is passed unsanitized into a system() call. Successful exploitation yields complete loss of confidentiality, integrity, and availability on the device itself, and, because these are serial/console aggregation appliances, can extend to downstream serial-attached equipment (CVSS v4.0 base 9.4; independent assessment scores this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exposure is gated by prerequisites: a valid account of any privilege level plus network reachability to the terminal or CLI/console interface are required, and there is no public exploit identified at time of analysis - though the technical barrier is low for anyone who already holds credentials. Remediation is available for SLC8000 (9.7.0.2R1) and EMG8500/EMG7500 (9.7.0.1R2), but SLB882, SLCx-03, and SLCx-02 have no fix in any firmware version and require compensating controls.
Authenticated OS command injection in Lantronix out-of-band management appliances (SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, SLCx-02) allows any user holding valid CLI or terminal credentials - not necessarily administrative - to execute arbitrary shell commands as root through the undocumented 'mfc eeprom read' command, which passes an unsanitized parameter directly to a system() call. CVSS 9.4 with scope-changed impact (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflects total loss of confidentiality, integrity and availability on the appliance itself and plausible follow-on compromise of serial-attached downstream devices reachable through its console ports. Exploitability is gated by network reachability of the management interface plus valid low-privilege credentials; no public exploit code has been observed at time of analysis, but a public technical write-up lowers the discovery barrier, and the SLB882/SLCx-03/SLCx-02 model lines have no vendor fix.
Remote code execution in Qualcomm Snapdragon-based products allows unauthenticated network attackers to bypass authorization through the SocketIO interface and execute arbitrary code. The vulnerability carries a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability impact, and no public exploit was identified at time of analysis. Exploitation is constrained primarily by whether the SocketIO endpoint is network-reachable, because exact affected firmware versions and default exposure state are not specified in the available data.
Unauthenticated remote code execution affects SolarWinds Observability Self-Hosted installations that are running in a non-default and non-secure configuration, allowing an attacker who can reach the service to execute arbitrary code with no credentials and no user interaction. The root cause is insufficient integrity checking (CWE-345): when the insecure configuration is present, integrity validation that would otherwise block attacker-supplied content is weakened or bypassed. SolarWinds scores the issue 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but that base score does not reflect the environmental gate - default and hardened deployments are not exploitable, so real-world exposure is confined to operators who have deviated from the vendor's documented secure-configuration guidance; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote write access to the file system with elevated privileges in HPE Analytics and Location Engine (ALE) lets any attacker who can reach the product's internal administrative component overwrite files as a privileged user, with the potential for full system compromise. The flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication, no user interaction, and no special privileges are required against a vulnerable instance; the practical constraint is network reachability, since ALE admin interfaces are normally confined to internal management networks rather than exposed to the internet. No public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), but the combination of an authentication-bypass class defect, a critical severity rating, and privileged file-write impact makes this a genuinely high-priority remediation item wherever ALE is deployed.
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated remote attacker who possesses the embedded secret log in to the controller's management interface and obtain full control, resulting in privilege escalation, data tampering, denial of service, and information disclosure; the CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-798). Because the embedded credential itself is the authentication mechanism, no pre-existing account is required, but practical exploitation depends on the controller being network-reachable and on the attacker extracting or knowing the hard-coded value from the firmware/image or documented defaults. There is no public exploit identified at time of analysis and the product is not listed in CISA KEV, though the specialized datacenter/DPU infrastructure-management role of this component means exposure is typically limited to segmented management networks rather than the public internet.
Authenticated command injection in Lantronix SLC8000 console servers (before firmware v9.7.0.3), EMG8500/EMG7500 (before firmware v9.7.0.1), and the SLB882/SLCx-03/SLCx-02 families lets any account holding the 'services' permission run arbitrary shell commands as root via the 'set script schedule' CLI/terminal command, producing a complete loss of confidentiality, integrity and availability on the device and potentially on serial-attached downstream equipment. The vector is network-reachable and requires no user interaction, but it is gated behind a privileged role (PR:H) and reachability of the management/CLI plane, which limits practical exposure to devices whose out-of-band interface is exposed or improperly segregated. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches exist for the SLC8000 and EMG models while SLB882/SLCx-03/SLCx-02 remain unpatched in all firmware versions per available data.
Root-level command injection in Lantronix console servers - SLC8000, EMG8500, EMG7500, SLB882, SLCx-03 and SLCx-02 - lets an authenticated user who holds the 'services' permission run arbitrary shell commands as root by abusing the 'set nfs download' command, whose parameter is passed unsanitized into a system() call, resulting in complete loss of confidentiality, integrity and availability on the device and potential downstream impact on serial-attached equipment. The privilege gate (PR:H) means anonymous or low-privilege users cannot trigger it and no user interaction is required once that role is held; authentication requirements are confirmed as privileged/authenticated by both the CVSS 4.0 vector (PR:H) and our assessed CVSS 3.1 vector (PR:H). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so this is a high-severity-but-not-currently-exploited defect. Lantronix has shipped firmware v9.7.0.3R3 for SLC8000 and v9.7.0.1R2 for EMG8500/EMG7500, while no fixed build has been published for SLB882, SLCx-03 or SLCx-02.
Authenticated command injection in Lantronix console/out-of-band management appliances (SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, SLCx-02) lets an attacker who already holds the 'services' permission reach the terminal or CLI interface and run arbitrary shell commands as root via a crafted `set cifs password` argument, resulting in complete loss of confidentiality, integrity and availability on the device and possible cascading impact on serial-attached downstream equipment. CVSS 4.0 rates this 9.4 (Critical) on an AV:N/AC:L/PR:H/UI:N vector with full VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H, and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) agrees on severity. The vendor has shipped patched firmware for SLC8000 (9.7.0.2) and for EMG8500/EMG7500 (9.7.0.1), while SLB882, SLCx-03 and SLCx-02 have no fix identified in any firmware version; no public exploit code was identified at time of analysis, and CISA KEV does not list this issue.
Missing authentication for a critical function in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows remote, unauthenticated attackers to reach a privileged operation without credentials, enabling data tampering, denial of service, and information disclosure. The vendor-assigned CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), and the independent assessment concurs, meaning no authentication, no user interaction, and no special complexity are required against a network-reachable instance; the practical limiting factor is exposure, since this is a specialized AI/HPC datacenter management component usually confined to internal management networks. There is no public exploit identified at time of analysis and EPSS is low at 0.41% (35th percentile), though CISA SSVC rates technical impact as partial and automatable exploitation as 'no'; the specific critical function lacking authentication is not named in the available data.
Unauthenticated PHP object injection in the Give Tributes WordPress plugin, affecting all versions up to and including 2.3.1, allows an attacker to place a crafted serialized object into donation data that the plugin later deserializes. The flaw is not exploitable in isolation: Give Tributes ships no POP/gadget chain, so it only produces impact when a separate plugin or theme on the same site supplies one, and even then the attacker must reach a form where 'Allow Multiple Recipients' is enabled (the single-recipient path runs sanitize_textarea_field() and neutralizes the payload) while the eCard 'Custom Message' option is disabled, the plugin default. Our independent assessment keeps this at PR:N/UI:N but raises attack complexity to High for the required non-default configuration plus third-party gadget dependency, rather than the nominal CVSS 9.8/AC:L rating; no public exploit code has been identified at time of analysis.
Missing authorization checks in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allow a remote, unauthenticated attacker to view and modify sensitive transaction data and to degrade or disrupt the service. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation needs only network reachability to the FTM service with no credentials and no user interaction, which is why IBM rates it 9.8 - but real-world priority is tempered by a low EPSS score of 0.38% (32nd percentile), CISA SSVC 'Exploitation: none', and an SSVC 'partial' technical impact that suggests the achievable view/modify/DoS effect may be narrower than the full-impact CVSS rating implies. No public exploit code has been identified at time of analysis, and deployment exposure is the main gate: FTM for OpenShift is typically confined to segmented financial-institution networks rather than being internet-facing.