Unauthenticated PHP object injection in the Give Tributes WordPress plugin, affecting all versions up to and including 2.3.1, allows an attacker to place a crafted serialized object into donation data that the plugin later deserializes. The flaw is not exploitable in isolation: Give Tributes ships no POP/gadget chain, so it only produces impact when a separate plugin or theme on the same site supplies one, and even then the attacker must reach a form where 'Allow Multiple Recipients' is enabled (the single-recipient path runs sanitize_textarea_field() and neutralizes the payload) while the eCard 'Custom Message' option is disabled, the plugin default. Our independent assessment keeps this at PR:N/UI:N but raises attack complexity to High for the required non-default configuration plus third-party gadget dependency, rather than the nominal CVSS 9.8/AC:L rating; no public exploit code has been identified at time of analysis.
Missing authorization checks in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allow a remote, unauthenticated attacker to view and modify sensitive transaction data and to degrade or disrupt the service. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation needs only network reachability to the FTM service with no credentials and no user interaction, which is why IBM rates it 9.8 - but real-world priority is tempered by a low EPSS score of 0.38% (32nd percentile), CISA SSVC 'Exploitation: none', and an SSVC 'partial' technical impact that suggests the achievable view/modify/DoS effect may be narrower than the full-impact CVSS rating implies. No public exploit code has been identified at time of analysis, and deployment exposure is the main gate: FTM for OpenShift is typically confined to segmented financial-institution networks rather than being internet-facing.
Unauthenticated privilege escalation to WordPress Administrator in the Meta Box AIO plugin (versions up to and including 3.11.0) - and in the standalone Meta Box Frontend Submission (≤4.5.6) and Meta Box User Profile (≤3.11.0) plugins - lets remote attackers rewrite the post_content of any page with an attacker-supplied shortcode and then create a new administrative account. The exploit chains three defects: populate_via_query_string() in mb-frontend-submission unconditionally overrides the form's target object_id from the rwmb_frontend_field_object_id GET parameter, Form::process() omits the user_can_edit() check that render() enforces, and mb-user-profile trusts the role and auto_login attributes of an injected [mb_user_profile_register] shortcode without validating the requested role. The flaw is network-reachable with PR:N/UI:N per the assessed CVSS 3.1 vector (9.8), so no authentication, user interaction, or prior privileges are required; Wordfence disclosed the issue, publicly available exploit code has not been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation. The practical exposure limiter is deployment-specific: the site must expose a Meta Box frontend-submission form and must process the mb-user-profile registration component for the escalation to complete.
Improper authentication in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9, tracked as EUVD-2026-84409) allows a remote, unauthenticated network attacker to bypass authentication and obtain privilege escalation, information disclosure, and data tampering with full confidentiality, integrity, and availability impact per the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 critical). No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV does not list this CVE); EPSS is 0.32% (25th percentile), and CISA's SSVC assessment rates exploitation as none, automatable as no, and technical impact as partial, indicating low near-term mass-exploitation likelihood. Practical exposure is further limited because the affected component is a specialized NVIDIA datacenter/GPU-infrastructure management service typically deployed on internal management networks rather than internet-facing hosts; the specific vulnerable endpoint or protocol is not disclosed in the advisory.
Unauthenticated SQL injection in MCMS 6.1.1 through 6.2.1 lets network attackers inject arbitrary SQL through the PageAction.verify endpoint at GET /ms/mdiy/page/verify.do; the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N indicates high confidentiality and integrity impact without availability impact, while the CVE record lists an overall 9.8. No public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS is 0.19% (9th percentile), meaning the realistic risk is governed by whether an MCMS instance is internet- or attacker-network-reachable rather than by any observed exploitation. In short, this is a classic high-severity signal profile with a low real-world-exploitation signal underneath it.
SQL injection in the custom model/form import feature of MCMS 6.1.1 through 6.2.1 allows an attacker who can reach that import workflow to inject SQL that is executed by a vulnerable backend query, with full confidentiality, integrity and availability impact (CWE-89, CVSS 3.1 base 9.8 under the published AV:N/AC:L/PR:N/UI:N vector). The import capability is an administrative/backend function, so the practical prerequisite is the ability to supply import data to that endpoint; the published vector claims PR:N (unauthenticated) while our assessed vector uses PR:L, and authentication requirements are not confirmed from available data and should be verified with the vendor. Exploitation risk is currently low-external: EPSS is 0.19% (9th percentile), there is no CISA KEV entry, and no public exploit code identified at time of analysis, though the affected version range is narrow and the impact if the endpoint is reachable is severe.
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an attacker who occupies an on-path / man-in-the-middle position on the controller's network path to present a forged, mismatched, or otherwise invalid certificate that the product wrongly accepts, enabling information disclosure, data tampering, and denial of service. NVIDIA's advisory assigns a 9.8 CVSS 3.1 base score (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but independent assessment lowers the real-world severity to AV:N/AC:H because the attacker must first intercept or redirect the controller's TLS traffic, and CISA's SSVC decision framework records Exploitation: none, Automatable: no, and Technical Impact: partial. No public exploit has been identified at time of analysis, EPSS is 0.13% (3rd percentile), and there is no CISA KEV listing, so the practical risk is confined to environments where an adversary can influence the network path between the controller and its TLS peers.
Unauthenticated remote code execution in SGLang 0.5.11 through 0.5.14 occurs when the multimodal generation runtime is launched in disaggregated-diffusion mode, where the DiffusionServer orchestrator binds a ZeroMQ ROUTER socket to a network-reachable interface with no authentication and passes the final frame of every received multipart message directly into pickle.loads() before any validation is performed. Rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw lets any remote party that can deliver a multipart ZMQ message to that socket execute arbitrary Python code in the serving process, yielding full compromise of confidentiality, integrity and availability on the host. No public exploit identified at time of analysis; exploitation requires the exposed orchestrator socket to be reachable beyond localhost, so loopback-bound or single-node deployments are not remotely exploitable.
Blind SQL injection in KarelIPS, the IP/PBX-adjacent product from Karel Electronic Industry and Trade Inc., allows unauthenticated remote attackers who can reach the product's network-exposed input to inject SQL and infer database contents through boolean- or time-based responses. All versions through 22092026 are affected, and the vendor-contacted via TR-CERT-has stated the product is no longer supported, so no vendor fix is expected; no public exploit code has been identified at time of analysis, and the blind nature of the injection makes data extraction slow and inference-driven rather than immediate. The advisory claims CVSS 9.8 (C:H/I:H/A:H), but the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, High) reflects the more likely case: certain high-impact confidentiality loss, with integrity and availability effects contingent on the privileges of the underlying database account and therefore deployment-dependent.
Remote code execution affects Zohocorp ManageEngine ADSelfService Plus deployments running builds prior to 7001, where an OS command injection flaw (CWE-78) in the product's GINA / credential-provider client can be triggered with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning unauthenticated remote attackers with no user interaction could achieve full confidentiality, integrity, and availability impact on the endpoint. The vulnerable component is the optional Windows endpoint agent that enables lock-screen self-service password reset, and because it executes in a pre-logon SYSTEM context, successful injection yields the highest possible privileges on the host. Our independent assessment lowers the exploitability sub-score to AC:H: realistic attack requires the agent to be deployed on Windows endpoints and an attacker to occupy a machine-in-the-middle or rogue-server position on the client-to-server channel rather than being a trivial internet-wide unauthenticated shot against a default server. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the vendor advisory is available at https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-74849.html.
Session replay in web.py 0.76 allows anyone who already holds a valid session cookie to keep reaching protected resources after the configured idle timeout has elapsed, because expired session records are only removed by a periodic cleanup job instead of being rejected at load time via a last-access-time check. No public exploit code and no confirmed active exploitation have been identified (CISA SSVC records Exploitation = none), although the flaw is classed as fully automatable with total technical impact once a token is obtained. The published CVSS of 9.8 materially overstates practical risk relative to the independent assessment (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), which stresses that the attacker must first steal, capture, or leak a session token and that the exposure window closes as soon as the cleanup job purges the expired record.
Improperly scoped role-based access control in IBM Concert 1.0.0 through 3.0.0 lets any authenticated user holding even a low-privileged account read and modify resources outside their granted permissions, because the product's RBAC permission definitions rely on wildcards instead of explicit resource scoping. IBM scores this 9.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), while our independent assessment rates it 8.8 with Scope:Unchanged, meaning the practical severity is high but below the vendor's critical rating; exploitation still requires a valid account and a reachable Concert instance. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation (not in CISA KEV), but IBM has published a vendor patch at support node 7288830.
UI redress (clickjacking) in the Fortinet FortiPAM Chrome Extension allows an attacker-controlled web page to frame or overlay the extension's rendered interface so that a victim's clicks are redirected into unintended, privileged extension actions, resulting in information disclosure with limited integrity impact. The affected code is the 7.4 branch and the 8.0 builds through 8.0.0 as scoped by Fortinet advisory FG-IR-26-168 (the vendor description covers all 8.0 and 7.4 versions, while ENISA EUVD specifically lists 8.0.1). Exploitation is remote and unauthenticated from the attacker's side (PR:N, CVSS:3.1/AV:N/AC:L/S:C) but is gated by required victim interaction (UI:R) - the user must have the vulnerable extension installed and be lured into clicking within an attacker-planted frame, which materially limits real-world exploitability despite Fortinet's 9.6 score; no public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and the assessed impact (C:H/I:L/A:N) is lower than the vendor rating.
Authenticated file-write path traversal in the Lantronix web management portal lets a logged-in attacker upload a crafted filename that escapes the intended upload directory and writes arbitrary files to any writable location on the device, a primitive that can be leveraged for remote code execution and results in complete loss of confidentiality, integrity, and availability on the console server. Affected are SLC8000 units below firmware v9.7.0.5, EMG8500/EMG7500 below firmware v9.7.0.1, and all firmware versions of SLB882, SLCx-03, and SLCx-02 (no vendor fix published for those three models). Exploitation requires a valid authenticated session on the network-reachable management portal (CVSS v4.0 PR:H, AV:N), so exposure is highest where the portal is internet-facing or reachable from untrusted segments; there is no public exploit identified at time of analysis and the issue is not listed on CISA KEV, but the assessed impact and the embedded out-of-band role of these devices justify treating it as high priority.
Server-side request forgery in Adobe Experience Manager (AEM) 6.5 Forms JEE and AEM 6.5 LTS Forms JEE lets an authenticated low-privilege user coerce the Forms server into making HTTP requests to internal-only resources, which can cross a security boundary (CVSS scope change) and yield elevated access. The flaw is rated 9.6 by the vendor and assessed at 9.6/9.6-class severity with the confidentiality impact confirmed as high, while integrity impact is bounded by what the reachable internal endpoints actually allow. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS signal was not notable in the supplied data.
Dokploy instances running versions prior to 0.29.13 disclose stored Git provider secrets - GitHub App private keys, OAuth tokens and client secrets, webhook secrets, and Gitea/Bitbucket access tokens, refresh tokens, and app passwords - to authenticated organization members who were never granted access to those providers. The protected tRPC procedures github.one, gitlab.one, gitea.one, and bitbucket.one return full provider rows without applying getAccessibleGitProviderIds or an organization check, and application.one returns the same secrets as nested relations from findApplicationById even when hasGitProviderAccess is false. Exploitation requires an authenticated Dokploy account (PR:L) holding application read access or knowledge of a provider identifier, and the practical impact is confidentiality: a restricted member can use the leaked credentials to read private repositories or manipulate external CI/CD and webhook workflows. No public exploit code has been identified at time of analysis.
An authenticated stack-based buffer overflow in Lantronix SLC8000, EMG8500/EMG7500, SLB882 and SLCx-02/SLCx-03 console management devices lets a user who can reach the terminal or CLI interface invoke an undocumented 'mfc eeprom write' command and supply oversized input that overflows a fixed stack buffer before the data is handed to a system() call, potentially yielding arbitrary code execution with full loss of confidentiality, integrity and availability on the device and on serial-attached downstream equipment. The flaw is scored 9.4 (CVSS 4.0, PR:L, scope-changed downstream impact) and requires authentication as any user, including low-privilege accounts, so exposure depends on whether the management interface is network-reachable and on credential strength. Vendor firmware fixes are available for SLC8000 (9.7.0.2), EMG8500 (9.7.0.1) and EMG7500 (9.7.0.1); no public exploit code was identified at time of analysis, though the undocumented command has now been publicly documented by VulnCheck and revrb.net, and SLB882/SLCx-03/SLCx-02 have no vendor patch.
Authenticated remote code execution in Lantronix SLC8000, EMG8500/EMG7500, SLB882, SLCx-03, and SLCx-02 console servers allows an attacker who can reach the terminal/CLI management interface and authenticate with any low-privilege account to trigger a stack-based buffer overflow by invoking the undocumented mfc eeprom read command with oversized input; successful exploitation can potentially achieve arbitrary code execution and complete loss of confidentiality, integrity, and availability, with potential impact to downstream serial-attached devices. Vendor-released patches exist for SLC8000 before v9.7.0.2 and EMG8500/EMG7500 before v9.7.0.1, but no patch was identified for SLB882, SLCx-03, or SLCx-02; no public exploit identified at time of analysis, and real-world urgency is tempered by the authentication requirement and niche console-server deployment. This is consistent with the independent CVSS:3.1 assessment AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H and the CVSS 4.0 score of 9.4.
Unconfined template path resolution in the Vector observability pipeline's file sink allows attacker-influenced event data to create or overwrite files anywhere the Vector process has write access, affecting versions 0.10.0 up to but not including 0.57.0. Because the rendered path is opened without confinement to an intended directory, a crafted event field can supply an absolute path or '../' traversal, and Vector will even create the missing parent directories before writing. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but impact is severe (CVSS 4.0 base 9.3 / assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) and escalates to code execution when the overwritten target is a scheduled task, authorization file, or subsequently executed script. Real-world risk is configuration-gated: it requires a file sink whose path template interpolates an untrusted event field, and the damage ceiling tracks the privileges Vector runs with.
Server-side request forgery in the GitHub Enterprise Server notebook viewer allows a remote attacker to direct requests to internal services listening on non-standard ports of the same appliance, because the viewer validated a user-supplied URL's scheme and host but not its port. Response bodies are not returned, but response timing acts as an oracle that can be used to extract instance secrets character by character; an extracted secret can then be used in a separate interaction with an internal service to obtain remote code execution on the appliance. All GitHub Enterprise Server versions 3.17 through 3.22 are affected; exploitation requires network access to the instance and is unauthenticated only when private mode is disabled, otherwise any authenticated user suffices, and no public exploit has been identified at time of analysis. Note that the independent assessment rates this as high difficulty (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), since full impact depends on a multi-step timing-oracle extraction succeeding and a usable internal service being reachable for the follow-on RCE.
Erlang/OTP's ssl application in affected releases (OTP 22.2 through the fixed 27.3.4.18, 28.5.0.7 and 29.1.1) will complete a TLS 1.3 client handshake against any peer that answers with an unsolicited pre_shared_key extension, allowing that peer to impersonate the intended server while holding no certificate, no private key and no prior session. Because the bogus resumption flag short-circuits certificate handling, ssl:connect returns {ok, Socket} even though certificate path validation, verify_fun, hostname verification, partial_chain, CRL checking and OCSP stapling are all skipped; an unauthenticated network-positioned attacker (man-in-the-middle, hijacked route/DNS, or a server the client is lured into contacting) can exploit this, and clients restricted to TLS 1.2 are not affected. A vendor patch is available and no public exploit code has been identified at time of analysis.
Unauthenticated attackers can reset the password of any Tankuam Places Kompini account, including administrative accounts, by tampering with the 'usuariId' parameter on the '/password/guardarClau/recover' endpoint. The recovery JWT is issued for the password-recovery workflow but is never checked against the account identifier it is used with, so any valid recovery token can be replayed against an arbitrary user ID - a classic insecure direct object reference (CWE-639) that yields full account takeover. Both the NVD-assigned CVSS 4.0 base score of 9.3 and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rate this critical, and exploitation needs no authentication, no privileged role and no victim interaction; no public exploit code has been identified at time of analysis, and the practical constraint is simply that the affected deployment must be network-reachable at the recovery endpoint.
Unauthenticated remote code execution in Adobe Campaign Classic allows attackers to execute arbitrary code in the context of the current user due to an incorrect authorization flaw (CWE-863). The flaw is network-reachable with low complexity and no user interaction (CVSS 9.1), though code execution is limited to the application user context rather than system privileges. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Timing-based leakage of the single recovery token in OpenBao lets a remote, unauthenticated attacker who can reach the instance while it is running in highly privileged recovery mode recover that token and then read or modify data on the OpenBao instance. The exposure is constrained to the transient recovery-mode break-glass state rather than the normal serving configuration, and exploitation requires collecting a large volume of low-noise timing samples against the recovery endpoint (reflected in the CVSS 4.0 rating of 9.2 with AC:H and AT:P, and in the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The vendor addressed the flaw in OpenBao v2.6.0; no public exploit identified at time of analysis.
SQL injection in Adobe Campaign Classic allows an attacker who already holds a high-privileged operator account to execute arbitrary SQL against the platform's database and, per Adobe, achieve arbitrary code execution in the context of the current user, with the scope change indicating impact that reaches beyond the vulnerable component. The flaw is remotely reachable, low-complexity, and requires no user interaction, but it is gated behind the PR:H prerequisite in the assessed vector, meaning the attacker must first hold or compromise a privileged ACC session and be able to reach the instance over the network. No public exploit code and no confirmed active exploitation were identified at time of analysis; the 9.1 base score with a scope change reflects a serious post-compromise escalation path rather than a pre-authentication remote takeover.
Unauthenticated network callers can drive Jira and Confluence tool handlers using an operator's globally configured credentials in sooperset/mcp-atlassian prior to 0.22.0, when the server is run over the HTTP streamable-http transport without an independent authentication boundary. The root cause is a missing-authentication flaw (CWE-306) scored CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), giving remote, unauthenticated, low-complexity read and write access with the permissions of the configured service account and no availability impact. Exploitation is configuration-dependent - stdio deployments and instances fronted by an authenticating proxy or enforcing per-user OAuth identities are not exposed - and no public exploit or CISA KEV listing was identified at time of analysis. The issue is fixed in version 0.22.0.
SQL injection in Adobe Campaign Classic lets an authenticated, low-privileged operator inject SQL through an application input path to read the full contents of backend database queries and perform limited writes, with the flaw rated CVSS 9.1 because the injection crosses out of the web tier into the database security context (Scope: Changed). Exploitation requires only a valid low-privilege ACC account, needs no user interaction, and is low complexity; the provided intelligence contains no CISA KEV listing and no public exploit code identified at time of analysis. Real-world urgency therefore hinges on how broadly low-privilege accounts are provisioned and how exposed the ACC application is to untrusted networks.
Account takeover in Databasement before 1.7.14 allows an unauthenticated remote attacker who possesses a pending invitation link to load the acceptance page, wait until the legitimate invitee accepts, and then submit acceptance using the cached authorization to overwrite the account password and gain access to managed database credentials and secrets. The vendor-published CVSS 4.0 score is 9.1 (AV:N/AC:L/AT:P/PR:N/UI:N), while the independent assessment rates it CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N because exploitation requires a leaked or forwarded invitation link and a timing race rather than a default-open path. Exploitation status is no public exploit identified at time of analysis, and no CISA KEV status was provided.
Format-string injection in RTI Connext Professional Core Libraries (versions 7.5.0 before 7.7.0.1 and 7.3.0.10 before 7.3.1.6) allows unauthenticated remote attackers with access to a DDS domain to corrupt memory, potentially leading to code execution or denial of service. Exploitation is gated by high attack complexity-the attacker must precisely control data that reaches a vulnerable format-string sink-and by the need for network reachability to a DDS domain, which is typically segmented in robotics, industrial, and defense deployments. No public exploit code has been identified at time of analysis.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can be driven into performing unauthorized actions by remote, unauthenticated attackers because its HTTP method-based security constraints do not cover every verb, allowing requests that fall outside the configured constraint set to reach protected functions. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) and CWE-306 assignment confirm a low-complexity, network-reachable missing-authentication defect with high confidentiality and integrity impact and no availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and IBM has published a patch advisory for the affected product line.
Cross-audience Google ID token reuse in the toolbox-core module of mcp-toolbox-sdk-python causes a credential intended for one service to be silently handed to a different service within the same process. Because the module-level token cache is not keyed by audience, an application that fetches ID tokens for two or more audiences in one process can send a Service A token to Service B; an attacker who operates, compromises, or passively monitors Service B can capture that token and replay it against Service A to impersonate the victim application. Exploitation is unauthenticated against the vulnerable app (PR:N) but conditional: it requires a multi-audience deployment plus attacker visibility into Service B traffic, and the leaked token is time-bounded by its expiry. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing).
Local privilege escalation affects the third-party Apache Lounge Windows distribution of Apache HTTP Server installed to its default directory at the root of C:\, where the folder inherits write access granted to the 'Authenticated Users' group. Any user with an existing local account on the host can plant or overwrite binaries and DLLs in the install tree, and because the Apache service normally runs as SYSTEM, that plant executes with high privileges. This is a local, authenticated-only escalation - not a remotely reachable defect - and the published CVSS 9.1 network vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) is internally inconsistent with the described flaw, which our assessment scores as CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Currently there is no public exploit identified at time of analysis and no confirmed CISA KEV listing, and the issue does not affect the official ASF httpd build, only the Apache Lounge repackaging prior to 2.4.68-260920 Win64.
Arbitrary recursive directory deletion is possible in openCode v1.18.26 because the Worktree.remove routine performs no validation on the path it is given, allowing traversal sequences to redirect deletion outside the intended git worktree. The independently assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) indicates the attack is network-reachable and needs no credentials but requires the victim to trigger the crafted path - realistically via openCode's local server/API surface or via untrusted content the AI coding agent processes - and the impact is limited to integrity and availability, with no data disclosure. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, SSVC records Exploitation: none, and EPSS is low at 0.19% (9th percentile), so real-world urgency is currently driven by the severity of the deletion primitive rather than by observed attacks. Note the discrepancy between the vendor/NVD CVSS of 9.1 (UI:N) and the assessed 9.1-equivalent vector (UI:R), which the assessment treats as authoritative.
Repeatedly feeding malformed labels to the XS backend of Net::IDN::Punycode (Net::IDN::Encode, versions 2.302 up to but not including 2.590) leaks an unfreed output buffer on every rejected call, allowing an unauthenticated remote sender to grow a host process's memory by roughly twice the label length per rejection and eventually cause a denial of service. Because the to-Unicode direction enforces no 63-byte DNS label limit (that check exists only on the ASCII side), the leak is unbounded per call and requires no successful decode at all - only a host application that passes attacker-controlled data into decode_punycode (or encode_punycode) while using the compiled XS backend, not the pure-Perl fallback. The vendor rated this 9.1 with high confidentiality impact, but independent assessment classifies it as availability-only (CWE-401): the leaked object is an unshared output buffer, so no data is disclosed to the attacker, and no public exploit code or confirmed active exploitation was identified at time of analysis.
The pure-Perl punycode decoder in Net::IDN::Punycode::PP, shipped in Perl Net-IDN-Encode distributions before 2.590, silently decodes a truncated label into a name that contains a code point the label never encoded, while the compiled XS backend rejects that same label - a parser differential an unauthenticated remote sender can trigger by supplying a malformed punycode label (for example 'NMzZNlL6SU', 'abc-td' or 'z'). Only installations where the XS backend does not build and the pure-Perl path is used are exposed, and the discrepancy only becomes a security problem when the decoded name feeds a security-relevant decision (allowlisting, host matching, deduplication) that is expected to agree with a system running the XS backend. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is only 0.15% (4th percentile), and the vendor's 9.1 severity rating materially overstates the realistic risk given the constrained backend dependency and the lack of any demonstrated downstream impact.
Arbitrary code execution is possible in Adobe Experience Manager 6.5 Forms JEE and AEM 6.5 LTS Forms JEE via an improper input validation weakness (CWE-20) that is reachable over the network with low attack complexity and no user interaction. Exploitation is gated by a mandatory prerequisite: the attacker must already hold a high-privilege account on the affected AEM Forms JEE instance (CVSS vector PR:H), so only administrative-level users, or an attacker who has first compromised such an account, can reach the vulnerable code path - the assessed risk is genuine but access-gated. Code runs in the context of the current user, and the changed scope (S:C) means impact can extend beyond the vulnerable component; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV).
Unthrottled password guessing against the LightRAG POST /login endpoint allows an unauthenticated remote attacker to submit credential attempts at full request speed until a valid account password is recovered, after which the attacker gains authenticated access to documents, the knowledge graph, and administrative operations. Versions prior to 1.5.5 shipped no rate limit, lockout, delay, or failure counter for authentication attempts (CWE-307). Real-world exploitability is bounded by password strength - the independent assessment rates the vector AC:H for exactly this reason - and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor added an in-process sliding-window limiter in 1.5.5.
Predictable, non-cryptographic credential generation in Postiz (gitroomhq/postiz-app, all versions prior to v2.24.0) allows unauthenticated remote attackers to reconstruct the V8 xorshift128+ PRNG state and derive OAuth access tokens, authorization codes, client secrets, organization API keys and PKCE verifiers issued to other users and organizations. Practical exploitation is limited by the requirement that the unauthenticated OAuth dynamic client registration endpoint be enabled and network-reachable, since that endpoint is what returns freshly generated client credentials supplying the consecutive PRNG output needed to solve for internal state; concurrent credential generation by other users interleaves draws and degrades recoverability, which is why the assessed vector carries high attack complexity. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but successful exploitation yields high confidentiality and integrity impact across tenants, and a vendor patch is available in v2.24.0 (advisory PSA-2026-TD98KY).