Unauthenticated privilege escalation to WordPress Administrator in the Meta Box AIO plugin (versions up to and including 3.11.0) - and in the standalone Meta Box Frontend Submission (≤4.5.6) and Meta Box User Profile (≤3.11.0) plugins - lets remote attackers rewrite the post_content of any page with an attacker-supplied shortcode and then create a new administrative account. The exploit chains three defects: populate_via_query_string() in mb-frontend-submission unconditionally overrides the form's target object_id from the rwmb_frontend_field_object_id GET parameter, Form::process() omits the user_can_edit() check that render() enforces, and mb-user-profile trusts the role and auto_login attributes of an injected [mb_user_profile_register] shortcode without validating the requested role. The flaw is network-reachable with PR:N/UI:N per the assessed CVSS 3.1 vector (9.8), so no authentication, user interaction, or prior privileges are required; Wordfence disclosed the issue, publicly available exploit code has not been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation. The practical exposure limiter is deployment-specific: the site must expose a Meta Box frontend-submission form and must process the mb-user-profile registration component for the escalation to complete.
Improper authentication in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9, tracked as EUVD-2026-84409) allows a remote, unauthenticated network attacker to bypass authentication and obtain privilege escalation, information disclosure, and data tampering with full confidentiality, integrity, and availability impact per the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 critical). No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV does not list this CVE); EPSS is 0.32% (25th percentile), and CISA's SSVC assessment rates exploitation as none, automatable as no, and technical impact as partial, indicating low near-term mass-exploitation likelihood. Practical exposure is further limited because the affected component is a specialized NVIDIA datacenter/GPU-infrastructure management service typically deployed on internal management networks rather than internet-facing hosts; the specific vulnerable endpoint or protocol is not disclosed in the advisory.
SQL injection in the custom model/form import feature of MCMS 6.1.1 through 6.2.1 allows an attacker who can reach that import workflow to inject SQL that is executed by a vulnerable backend query, with full confidentiality, integrity and availability impact (CWE-89, CVSS 3.1 base 9.8 under the published AV:N/AC:L/PR:N/UI:N vector). The import capability is an administrative/backend function, so the practical prerequisite is the ability to supply import data to that endpoint; the published vector claims PR:N (unauthenticated) while our assessed vector uses PR:L, and authentication requirements are not confirmed from available data and should be verified with the vendor. Exploitation risk is currently low-external: EPSS is 0.19% (9th percentile), there is no CISA KEV entry, and no public exploit code identified at time of analysis, though the affected version range is narrow and the impact if the endpoint is reachable is severe.
Unauthenticated SQL injection in MCMS 6.1.1 through 6.2.1 lets network attackers inject arbitrary SQL through the PageAction.verify endpoint at GET /ms/mdiy/page/verify.do; the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N indicates high confidentiality and integrity impact without availability impact, while the CVE record lists an overall 9.8. No public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS is 0.19% (9th percentile), meaning the realistic risk is governed by whether an MCMS instance is internet- or attacker-network-reachable rather than by any observed exploitation. In short, this is a classic high-severity signal profile with a low real-world-exploitation signal underneath it.
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an attacker who occupies an on-path / man-in-the-middle position on the controller's network path to present a forged, mismatched, or otherwise invalid certificate that the product wrongly accepts, enabling information disclosure, data tampering, and denial of service. NVIDIA's advisory assigns a 9.8 CVSS 3.1 base score (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but independent assessment lowers the real-world severity to AV:N/AC:H because the attacker must first intercept or redirect the controller's TLS traffic, and CISA's SSVC decision framework records Exploitation: none, Automatable: no, and Technical Impact: partial. No public exploit has been identified at time of analysis, EPSS is 0.13% (3rd percentile), and there is no CISA KEV listing, so the practical risk is confined to environments where an adversary can influence the network path between the controller and its TLS peers.
Unauthenticated path traversal in Adobe Connect (and its Android mobile app component) lets a remote attacker read files outside the intended access scope on a network-reachable deployment. Per Adobe's CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6), the attack needs no credentials and no user interaction, so an internet-exposed default installation is directly targetable; our independent assessment keeps the same network/low-complexity/no-auth/no-interaction profile but treats scope as Unchanged and stresses that impact is limited to reading files accessible to the Connect service account, with no write, no code execution, and no availability impact. On paper this is a high-priority signal; however, there is no public exploit code identified at time of analysis and no CISA KEV listing, so the unauthenticated reachability claim rests on Adobe's self-reported advisory and is not independently corroborated.
Unauthenticated remote code execution in SGLang 0.5.11 through 0.5.14 occurs when the multimodal generation runtime is launched in disaggregated-diffusion mode, where the DiffusionServer orchestrator binds a ZeroMQ ROUTER socket to a network-reachable interface with no authentication and passes the final frame of every received multipart message directly into pickle.loads() before any validation is performed. Rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw lets any remote party that can deliver a multipart ZMQ message to that socket execute arbitrary Python code in the serving process, yielding full compromise of confidentiality, integrity and availability on the host. No public exploit identified at time of analysis; exploitation requires the exposed orchestrator socket to be reachable beyond localhost, so loopback-bound or single-node deployments are not remotely exploitable.
Blind SQL injection in KarelIPS, the IP/PBX-adjacent product from Karel Electronic Industry and Trade Inc., allows unauthenticated remote attackers who can reach the product's network-exposed input to inject SQL and infer database contents through boolean- or time-based responses. All versions through 22092026 are affected, and the vendor-contacted via TR-CERT-has stated the product is no longer supported, so no vendor fix is expected; no public exploit code has been identified at time of analysis, and the blind nature of the injection makes data extraction slow and inference-driven rather than immediate. The advisory claims CVSS 9.8 (C:H/I:H/A:H), but the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, High) reflects the more likely case: certain high-impact confidentiality loss, with integrity and availability effects contingent on the privileges of the underlying database account and therefore deployment-dependent.
Remote code execution affects Zohocorp ManageEngine ADSelfService Plus deployments running builds prior to 7001, where an OS command injection flaw (CWE-78) in the product's GINA / credential-provider client can be triggered with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning unauthenticated remote attackers with no user interaction could achieve full confidentiality, integrity, and availability impact on the endpoint. The vulnerable component is the optional Windows endpoint agent that enables lock-screen self-service password reset, and because it executes in a pre-logon SYSTEM context, successful injection yields the highest possible privileges on the host. Our independent assessment lowers the exploitability sub-score to AC:H: realistic attack requires the agent to be deployed on Windows endpoints and an attacker to occupy a machine-in-the-middle or rogue-server position on the client-to-server channel rather than being a trivial internet-wide unauthenticated shot against a default server. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the vendor advisory is available at https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-74849.html.
Session replay in web.py 0.76 allows anyone who already holds a valid session cookie to keep reaching protected resources after the configured idle timeout has elapsed, because expired session records are only removed by a periodic cleanup job instead of being rejected at load time via a last-access-time check. No public exploit code and no confirmed active exploitation have been identified (CISA SSVC records Exploitation = none), although the flaw is classed as fully automatable with total technical impact once a token is obtained. The published CVSS of 9.8 materially overstates practical risk relative to the independent assessment (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), which stresses that the attacker must first steal, capture, or leak a session token and that the exposure window closes as soon as the cleanup job purges the expired record.
Improperly scoped role-based access control in IBM Concert 1.0.0 through 3.0.0 lets any authenticated user holding even a low-privileged account read and modify resources outside their granted permissions, because the product's RBAC permission definitions rely on wildcards instead of explicit resource scoping. IBM scores this 9.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), while our independent assessment rates it 8.8 with Scope:Unchanged, meaning the practical severity is high but below the vendor's critical rating; exploitation still requires a valid account and a reachable Concert instance. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation (not in CISA KEV), but IBM has published a vendor patch at support node 7288830.
UI redress (clickjacking) in the Fortinet FortiPAM Chrome Extension allows an attacker-controlled web page to frame or overlay the extension's rendered interface so that a victim's clicks are redirected into unintended, privileged extension actions, resulting in information disclosure with limited integrity impact. The affected code is the 7.4 branch and the 8.0 builds through 8.0.0 as scoped by Fortinet advisory FG-IR-26-168 (the vendor description covers all 8.0 and 7.4 versions, while ENISA EUVD specifically lists 8.0.1). Exploitation is remote and unauthenticated from the attacker's side (PR:N, CVSS:3.1/AV:N/AC:L/S:C) but is gated by required victim interaction (UI:R) - the user must have the vulnerable extension installed and be lured into clicking within an attacker-planted frame, which materially limits real-world exploitability despite Fortinet's 9.6 score; no public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and the assessed impact (C:H/I:L/A:N) is lower than the vendor rating.
Authenticated file-write path traversal in the Lantronix web management portal lets a logged-in attacker upload a crafted filename that escapes the intended upload directory and writes arbitrary files to any writable location on the device, a primitive that can be leveraged for remote code execution and results in complete loss of confidentiality, integrity, and availability on the console server. Affected are SLC8000 units below firmware v9.7.0.5, EMG8500/EMG7500 below firmware v9.7.0.1, and all firmware versions of SLB882, SLCx-03, and SLCx-02 (no vendor fix published for those three models). Exploitation requires a valid authenticated session on the network-reachable management portal (CVSS v4.0 PR:H, AV:N), so exposure is highest where the portal is internet-facing or reachable from untrusted segments; there is no public exploit identified at time of analysis and the issue is not listed on CISA KEV, but the assessed impact and the embedded out-of-band role of these devices justify treating it as high priority.
Server-side request forgery in Adobe Experience Manager (AEM) 6.5 Forms JEE and AEM 6.5 LTS Forms JEE lets an authenticated low-privilege user coerce the Forms server into making HTTP requests to internal-only resources, which can cross a security boundary (CVSS scope change) and yield elevated access. The flaw is rated 9.6 by the vendor and assessed at 9.6/9.6-class severity with the confidentiality impact confirmed as high, while integrity impact is bounded by what the reachable internal endpoints actually allow. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS signal was not notable in the supplied data.
Dokploy instances running versions prior to 0.29.13 disclose stored Git provider secrets - GitHub App private keys, OAuth tokens and client secrets, webhook secrets, and Gitea/Bitbucket access tokens, refresh tokens, and app passwords - to authenticated organization members who were never granted access to those providers. The protected tRPC procedures github.one, gitlab.one, gitea.one, and bitbucket.one return full provider rows without applying getAccessibleGitProviderIds or an organization check, and application.one returns the same secrets as nested relations from findApplicationById even when hasGitProviderAccess is false. Exploitation requires an authenticated Dokploy account (PR:L) holding application read access or knowledge of a provider identifier, and the practical impact is confidentiality: a restricted member can use the leaked credentials to read private repositories or manipulate external CI/CD and webhook workflows. No public exploit code has been identified at time of analysis.
Authenticated project administrators in Gardener can escalate their own project privileges by adding Group or ServiceAccount subjects to Project.spec.members, because the customverbauthorizer admission plugin's manage-members check only diffs User subjects and ignores Group and ServiceAccount entries. An actor holding the project-admin role but deliberately denied the manage-members permission can add the system:authenticated Group or an arbitrary ServiceAccount and thereby grant broad project access, including to Shoots, Secrets, and cloud provider credentials. All Gardener releases prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0 are affected; there is no public exploit code identified at time of analysis, and the issue is fixed in the versions listed above.
An authenticated stack-based buffer overflow in Lantronix SLC8000, EMG8500/EMG7500, SLB882 and SLCx-02/SLCx-03 console management devices lets a user who can reach the terminal or CLI interface invoke an undocumented 'mfc eeprom write' command and supply oversized input that overflows a fixed stack buffer before the data is handed to a system() call, potentially yielding arbitrary code execution with full loss of confidentiality, integrity and availability on the device and on serial-attached downstream equipment. The flaw is scored 9.4 (CVSS 4.0, PR:L, scope-changed downstream impact) and requires authentication as any user, including low-privilege accounts, so exposure depends on whether the management interface is network-reachable and on credential strength. Vendor firmware fixes are available for SLC8000 (9.7.0.2), EMG8500 (9.7.0.1) and EMG7500 (9.7.0.1); no public exploit code was identified at time of analysis, though the undocumented command has now been publicly documented by VulnCheck and revrb.net, and SLB882/SLCx-03/SLCx-02 have no vendor patch.
Authenticated remote code execution in Lantronix SLC8000, EMG8500/EMG7500, SLB882, SLCx-03, and SLCx-02 console servers allows an attacker who can reach the terminal/CLI management interface and authenticate with any low-privilege account to trigger a stack-based buffer overflow by invoking the undocumented mfc eeprom read command with oversized input; successful exploitation can potentially achieve arbitrary code execution and complete loss of confidentiality, integrity, and availability, with potential impact to downstream serial-attached devices. Vendor-released patches exist for SLC8000 before v9.7.0.2 and EMG8500/EMG7500 before v9.7.0.1, but no patch was identified for SLB882, SLCx-03, or SLCx-02; no public exploit identified at time of analysis, and real-world urgency is tempered by the authentication requirement and niche console-server deployment. This is consistent with the independent CVSS:3.1 assessment AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H and the CVSS 4.0 score of 9.4.
Denial of service and loss of unsaved work in Notepad++ versions prior to 8.9.8: a local process running at the same or a higher Windows integrity level on the same interactive desktop can send the NPPM_SAVESESSION window message with a null lParam, causing an immediate null-pointer dereference and termination of the editor. The flaw is rated CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning it requires a local low-privileged attacker process already present on the desktop, with no network vector, no user interaction, and impact limited to availability - no confidentiality or integrity compromise. Proof-of-concept level exploitation is indicated by SSVC (Exploitation: poc), and publicly available exploit code exists, but the issue is not confirmed as actively exploited in CISA KEV; the vendor-released patch is version 8.9.8.
Local credential disclosure in MCP Atlassian (sooperset/mcp-atlassian) prior to 0.22.0 allows a co-resident local user or process to read stored Atlassian OAuth access and refresh tokens and reuse the associated Atlassian session. The server creates its ~/.mcp-atlassian directory and the oauth-<client_id>.json token file without explicit owner-only permission modes (CWE-732), so the resulting group- or world-readable bits - an artifact of a permissive process umask - expose the tokens to anyone with read access on the host; the CVSS vector (AV:L/PR:L) confirms this requires an existing local account and no network reachability. Only multi-user or multi-process hosts that rely on the OAuth token-file fallback are exposed; single-user hosts with a restrictive umask are not. No public exploit identified at time of analysis, and the vendor CVSS of 5.5 understates impact only marginally - the independent assessment adds a low integrity component (I:L) because a stolen refresh token can also be used to act within the victim's Atlassian tenant. The issue is fixed in version 0.22.0.
Unconfined template path resolution in the Vector observability pipeline's file sink allows attacker-influenced event data to create or overwrite files anywhere the Vector process has write access, affecting versions 0.10.0 up to but not including 0.57.0. Because the rendered path is opened without confinement to an intended directory, a crafted event field can supply an absolute path or '../' traversal, and Vector will even create the missing parent directories before writing. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but impact is severe (CVSS 4.0 base 9.3 / assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) and escalates to code execution when the overwritten target is a scheduled task, authorization file, or subsequently executed script. Real-world risk is configuration-gated: it requires a file sink whose path template interpolates an untrusted event field, and the damage ceiling tracks the privileges Vector runs with.
Server-side request forgery in changedetection.io's Add Watch preview endpoint (/add_watch_ui/snapshot) allows remote attackers to force the server's browser fetcher to request attacker-chosen http(s) URLs, including loopback services, RFC1918 hosts, and the 169.254.169.254 cloud metadata address, because the url argument is validated only for an http:// or https:// prefix. The route is wrapped in login_optionally_required, so it can be reached unauthenticated on default installs that have no password set and requires credentials only where an operator has configured one; publicly available exploit code exists, and it is not confirmed as actively exploited (no CISA KEV entry). This is a moderate, credible risk rather than a critical one, with impact bounded to what the returned screenshot and rendered page data expose about internal targets; the vendor-released fix is version 0.60.1 (commit 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e).
changedetection.io through 0.60.7 contains a timing side-channel in the check_authentication function of its Flask authentication hook, allowing unauthenticated remote attackers to potentially recover the application password by analyzing response-time differences. Exploitation is practically limited: it requires sending many requests and performing statistical analysis, and success is degraded by network latency, making it a low-to-moderate priority; a public proof-of-concept exploit exists, and the vendor did not respond to the disclosure.
Server-side request forgery in the GitHub Enterprise Server notebook viewer allows a remote attacker to direct requests to internal services listening on non-standard ports of the same appliance, because the viewer validated a user-supplied URL's scheme and host but not its port. Response bodies are not returned, but response timing acts as an oracle that can be used to extract instance secrets character by character; an extracted secret can then be used in a separate interaction with an internal service to obtain remote code execution on the appliance. All GitHub Enterprise Server versions 3.17 through 3.22 are affected; exploitation requires network access to the instance and is unauthenticated only when private mode is disabled, otherwise any authenticated user suffices, and no public exploit has been identified at time of analysis. Note that the independent assessment rates this as high difficulty (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), since full impact depends on a multi-step timing-oracle extraction succeeding and a usable internal service being reachable for the follow-on RCE.
Stored cross-site scripting in Nautobot (all versions prior to 2.4.37 on the 2.x branch and prior to 3.1.8 on the 3.x branch) lets an authenticated user with extras.add_relationship or extras.change_relationship permission inject HTML or JavaScript into a Relationship description, or with dcim.add_modulefamily or dcim.change_modulefamily permission inject it into a Module Family name, which then executes in the browser session of any user - including administrators and superusers - who opens an affected create or edit form. Because the payload runs in the victim's authenticated context with same-site access to the Nautobot UI, an attacker can perform actions as the victim and potentially steal session cookies or API tokens, enabling lateral movement and privilege escalation toward a full administrative compromise of the platform. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so risk is assessed as moderate rather than critical: exploitation requires a pre-existing authorized account with specific object-level write permissions, and a higher-privileged victim must interact with the poisoned form.
Server-side request forgery in the Home Assistant IPP integration allows an attacker on the same local network to coerce the platform's shared HTTP client into issuing requests to loopback or other internal services, affecting Home Assistant Core versions prior to 2026.2.3. The attacker needs only to broadcast a crafted unauthenticated _ipp._tcp.local mDNS announcement whose host, port, and base_path values are consumed by async_step_zeroconf in homeassistant/components/ipp/config_flow.py, which then hands them to validate_input for printer metadata retrieval; the shared aiohttp client followed cross-origin redirects without blocking loopback targets, so no prior IPP configuration, no authentication (PR:N), and no user interaction (UI:N) are required. Impact is bounded by the adjacent-network vector (AV:A) and by the constrained confidentiality and integrity effects of the coerced internal request - no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); exploitation conditions are local-network only, not internet-reachable. Fixed in 2026.2.3.
Server-side request forgery in MCP Atlassian (sooperset/mcp-atlassian) prior to 0.22.0 lets an MCP caller who controls the public Jira base URL have a Jira user-lookup request redirected to an internal address, bypassing the SSRF redirect protections previously added for CVE-2026-27826. The vulnerable path is JiraUserMixin._lookup_user_by_permissions, which calls the module-level requests.get instead of the fetcher's protected session, so the response hook that enforces redirect validation is never applied. Impact is limited and blind (confidentiality-only, no integrity or availability effect) and, per the independent assessment, requires the attacker to control the Jira endpoint plus a server that issues a redirect to an internal target, making it most realistic in HTTP/multi-user or shared-credential deployments rather than single-user stdio setups with a fixed trusted Jira URL. No public exploit code was identified at time of analysis and there is no KEV listing; v0.22.0 resolves the issue.
Authenticated users of Unleash (npm unleash-server) prior to 8.0.3 who hold create or clone rights in any single project can abuse the clone-feature endpoint to copy a feature toggle out of a different project they cannot read, then inspect the copied strategy parameters, constraints, variants, and variant payloads. The flaw is a broken object-level authorization (CWE-639) in cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone: the destination project is authorized but the source project is never checked, and because feature names are globally unique an attacker only needs the target feature's name (which may leak through SDKs shared across projects). Impact is limited to information disclosure (CVSS 4.0 5.3, PR:L, no integrity or availability effect); the vendor fixed it in 8.0.3 and no public exploit or CISA KEV entry was identified at time of analysis.
Erlang/OTP's ssl application in affected releases (OTP 22.2 through the fixed 27.3.4.18, 28.5.0.7 and 29.1.1) will complete a TLS 1.3 client handshake against any peer that answers with an unsolicited pre_shared_key extension, allowing that peer to impersonate the intended server while holding no certificate, no private key and no prior session. Because the bogus resumption flag short-circuits certificate handling, ssl:connect returns {ok, Socket} even though certificate path validation, verify_fun, hostname verification, partial_chain, CRL checking and OCSP stapling are all skipped; an unauthenticated network-positioned attacker (man-in-the-middle, hijacked route/DNS, or a server the client is lured into contacting) can exploit this, and clients restricted to TLS 1.2 are not affected. A vendor patch is available and no public exploit code has been identified at time of analysis.
Reflected cross-site scripting (CWE-79) in ClipBucket v5 before 5.5.3-#182 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser under the application origin by crafting URLs whose cat, sort, or time query parameters are processed by the unsanitized sort_link() helper. Exploitation requires the victim to click a crafted link (user interaction), public exploit code is available, and there is no indication of confirmed active exploitation (no CISA KEV listing); impact is confined to the victim's browser session rather than server-side code execution.
Unauthenticated attackers can reset the password of any Tankuam Places Kompini account, including administrative accounts, by tampering with the 'usuariId' parameter on the '/password/guardarClau/recover' endpoint. The recovery JWT is issued for the password-recovery workflow but is never checked against the account identifier it is used with, so any valid recovery token can be replayed against an arbitrary user ID - a classic insecure direct object reference (CWE-639) that yields full account takeover. Both the NVD-assigned CVSS 4.0 base score of 9.3 and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rate this critical, and exploitation needs no authentication, no privileged role and no victim interaction; no public exploit code has been identified at time of analysis, and the practical constraint is simply that the affected deployment must be network-reachable at the recovery endpoint.
Unauthenticated remote code execution in Adobe Campaign Classic allows attackers to execute arbitrary code in the context of the current user due to an incorrect authorization flaw (CWE-863). The flaw is network-reachable with low complexity and no user interaction (CVSS 9.1), though code execution is limited to the application user context rather than system privileges. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Improper restriction of excessive authentication attempts (CWE-307) in the 9Router AI router package (decolua/9router) before version 0.5.6 allows remote unauthenticated attackers to defeat the dashboard login lockout by rotating the client-controlled X-9r-Real-Ip header on every password guess, so each request lands in a fresh failed-attempt bucket and the five-attempt progressive 429 lockout never fires. The flaw is exploitable only in deployments where HTTP requests reach Next.js directly without the bundled custom-server.js wrapper that normally overwrites X-9r-Real-Ip from the unspoofable TCP socket address; the login endpoint binds to 0.0.0.0 by default, so exposure is network-reachable. Impact is limited to confidentiality (unauthorized administrative session only if the dashboard password is separately weak or guessable) and the throttle removal itself does not yield credentials; no public exploit identified at time of analysis, and the weakness is not listed in CISA KEV.
Timing-based leakage of the single recovery token in OpenBao lets a remote, unauthenticated attacker who can reach the instance while it is running in highly privileged recovery mode recover that token and then read or modify data on the OpenBao instance. The exposure is constrained to the transient recovery-mode break-glass state rather than the normal serving configuration, and exploitation requires collecting a large volume of low-noise timing samples against the recovery endpoint (reflected in the CVSS 4.0 rating of 9.2 with AC:H and AT:P, and in the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The vendor addressed the flaw in OpenBao v2.6.0; no public exploit identified at time of analysis.
SQL injection in Adobe Campaign Classic allows an attacker who already holds a high-privileged operator account to execute arbitrary SQL against the platform's database and, per Adobe, achieve arbitrary code execution in the context of the current user, with the scope change indicating impact that reaches beyond the vulnerable component. The flaw is remotely reachable, low-complexity, and requires no user interaction, but it is gated behind the PR:H prerequisite in the assessed vector, meaning the attacker must first hold or compromise a privileged ACC session and be able to reach the instance over the network. No public exploit code and no confirmed active exploitation were identified at time of analysis; the 9.1 base score with a scope change reflects a serious post-compromise escalation path rather than a pre-authentication remote takeover.
Unauthenticated network callers can drive Jira and Confluence tool handlers using an operator's globally configured credentials in sooperset/mcp-atlassian prior to 0.22.0, when the server is run over the HTTP streamable-http transport without an independent authentication boundary. The root cause is a missing-authentication flaw (CWE-306) scored CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), giving remote, unauthenticated, low-complexity read and write access with the permissions of the configured service account and no availability impact. Exploitation is configuration-dependent - stdio deployments and instances fronted by an authenticating proxy or enforcing per-user OAuth identities are not exposed - and no public exploit or CISA KEV listing was identified at time of analysis. The issue is fixed in version 0.22.0.
SQL injection in Adobe Campaign Classic lets an authenticated, low-privileged operator inject SQL through an application input path to read the full contents of backend database queries and perform limited writes, with the flaw rated CVSS 9.1 because the injection crosses out of the web tier into the database security context (Scope: Changed). Exploitation requires only a valid low-privilege ACC account, needs no user interaction, and is low complexity; the provided intelligence contains no CISA KEV listing and no public exploit code identified at time of analysis. Real-world urgency therefore hinges on how broadly low-privilege accounts are provisioned and how exposed the ACC application is to untrusted networks.
Account takeover in Databasement before 1.7.14 allows an unauthenticated remote attacker who possesses a pending invitation link to load the acceptance page, wait until the legitimate invitee accepts, and then submit acceptance using the cached authorization to overwrite the account password and gain access to managed database credentials and secrets. The vendor-published CVSS 4.0 score is 9.1 (AV:N/AC:L/AT:P/PR:N/UI:N), while the independent assessment rates it CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N because exploitation requires a leaked or forwarded invitation link and a timing race rather than a default-open path. Exploitation status is no public exploit identified at time of analysis, and no CISA KEV status was provided.
Format-string injection in RTI Connext Professional Core Libraries (versions 7.5.0 before 7.7.0.1 and 7.3.0.10 before 7.3.1.6) allows unauthenticated remote attackers with access to a DDS domain to corrupt memory, potentially leading to code execution or denial of service. Exploitation is gated by high attack complexity-the attacker must precisely control data that reaches a vulnerable format-string sink-and by the need for network reachability to a DDS domain, which is typically segmented in robotics, industrial, and defense deployments. No public exploit code has been identified at time of analysis.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can be driven into performing unauthorized actions by remote, unauthenticated attackers because its HTTP method-based security constraints do not cover every verb, allowing requests that fall outside the configured constraint set to reach protected functions. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) and CWE-306 assignment confirm a low-complexity, network-reachable missing-authentication defect with high confidentiality and integrity impact and no availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and IBM has published a patch advisory for the affected product line.
Stored cross-site scripting in Novu's in-app notification inbox (all versions prior to 3.18.0) allows an authenticated organization member or an environment API-key holder to persist a javascript:-scheme redirect URL in an in-app workflow call-to-action, which is then executed via window.open in the inbox-hosting origin when a recipient clicks the notification. Exploitation requires both the low-privilege write access described above (CVSS 4.0 PR:L, assessed CVSS 3.1 PR:L) and victim interaction in a Chromium-based browser (UI:P), limiting reliable impact to confidentiality and integrity of the embedding customer application or self-hosted Novu dashboard rather than the Novu platform itself. The issue is fixed in version 3.18.0; no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-audience Google ID token reuse in the toolbox-core module of mcp-toolbox-sdk-python causes a credential intended for one service to be silently handed to a different service within the same process. Because the module-level token cache is not keyed by audience, an application that fetches ID tokens for two or more audiences in one process can send a Service A token to Service B; an attacker who operates, compromises, or passively monitors Service B can capture that token and replay it against Service A to impersonate the victim application. Exploitation is unauthenticated against the vulnerable app (PR:N) but conditional: it requires a multi-audience deployment plus attacker visibility into Service B traffic, and the leaked token is time-bounded by its expiry. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing).
Local privilege escalation affects the third-party Apache Lounge Windows distribution of Apache HTTP Server installed to its default directory at the root of C:\, where the folder inherits write access granted to the 'Authenticated Users' group. Any user with an existing local account on the host can plant or overwrite binaries and DLLs in the install tree, and because the Apache service normally runs as SYSTEM, that plant executes with high privileges. This is a local, authenticated-only escalation - not a remotely reachable defect - and the published CVSS 9.1 network vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) is internally inconsistent with the described flaw, which our assessment scores as CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Currently there is no public exploit identified at time of analysis and no confirmed CISA KEV listing, and the issue does not affect the official ASF httpd build, only the Apache Lounge repackaging prior to 2.4.68-260920 Win64.
Arbitrary recursive directory deletion is possible in openCode v1.18.26 because the Worktree.remove routine performs no validation on the path it is given, allowing traversal sequences to redirect deletion outside the intended git worktree. The independently assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) indicates the attack is network-reachable and needs no credentials but requires the victim to trigger the crafted path - realistically via openCode's local server/API surface or via untrusted content the AI coding agent processes - and the impact is limited to integrity and availability, with no data disclosure. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, SSVC records Exploitation: none, and EPSS is low at 0.19% (9th percentile), so real-world urgency is currently driven by the severity of the deletion primitive rather than by observed attacks. Note the discrepancy between the vendor/NVD CVSS of 9.1 (UI:N) and the assessed 9.1-equivalent vector (UI:R), which the assessment treats as authoritative.
Repeatedly feeding malformed labels to the XS backend of Net::IDN::Punycode (Net::IDN::Encode, versions 2.302 up to but not including 2.590) leaks an unfreed output buffer on every rejected call, allowing an unauthenticated remote sender to grow a host process's memory by roughly twice the label length per rejection and eventually cause a denial of service. Because the to-Unicode direction enforces no 63-byte DNS label limit (that check exists only on the ASCII side), the leak is unbounded per call and requires no successful decode at all - only a host application that passes attacker-controlled data into decode_punycode (or encode_punycode) while using the compiled XS backend, not the pure-Perl fallback. The vendor rated this 9.1 with high confidentiality impact, but independent assessment classifies it as availability-only (CWE-401): the leaked object is an unshared output buffer, so no data is disclosed to the attacker, and no public exploit code or confirmed active exploitation was identified at time of analysis.
The pure-Perl punycode decoder in Net::IDN::Punycode::PP, shipped in Perl Net-IDN-Encode distributions before 2.590, silently decodes a truncated label into a name that contains a code point the label never encoded, while the compiled XS backend rejects that same label - a parser differential an unauthenticated remote sender can trigger by supplying a malformed punycode label (for example 'NMzZNlL6SU', 'abc-td' or 'z'). Only installations where the XS backend does not build and the pure-Perl path is used are exposed, and the discrepancy only becomes a security problem when the decoded name feeds a security-relevant decision (allowlisting, host matching, deduplication) that is expected to agree with a system running the XS backend. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is only 0.15% (4th percentile), and the vendor's 9.1 severity rating materially overstates the realistic risk given the constrained backend dependency and the lack of any demonstrated downstream impact.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker with a low-privileged Cloud Pak for Data account execute arbitrary operating system commands on the affected node, resulting in full loss of confidentiality, integrity, and availability (C:H/I:H/A:H) with a CVSS 3.1 base score of 8.8. Exploitation is network-reachable and low-complexity with no user interaction (AV:N/AC:L/PR:L/UI:N), but it is gated behind a valid authenticated account that can reach the DataStage service, so exposure is limited to authenticated users of the 5.4.0.0 build. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation; a vendor patch is available, so patched deployments are not exposed.
Unauthenticated remote code execution in SolarWinds Observability Self-Hosted (CVSS 8.8) allows attackers on an adjacent network to execute arbitrary code via deserialization of untrusted data, but only when the deployment is configured to use a specific non-default communication mode. Default-configured instances are not exploitable, and the adjacent-network attack vector (AV:A) further narrows the exposed population. No public exploit code has been identified at time of analysis, and no credentials or user interaction are required once the mode is enabled and reachable.
Arbitrary code execution is possible in Adobe Experience Manager 6.5 Forms JEE and AEM 6.5 LTS Forms JEE via an improper input validation weakness (CWE-20) that is reachable over the network with low attack complexity and no user interaction. Exploitation is gated by a mandatory prerequisite: the attacker must already hold a high-privilege account on the affected AEM Forms JEE instance (CVSS vector PR:H), so only administrative-level users, or an attacker who has first compromised such an account, can reach the vulnerable code path - the assessed risk is genuine but access-gated. Code runs in the context of the current user, and the changed scope (S:C) means impact can extend beyond the vulnerable component; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV).
Unthrottled password guessing against the LightRAG POST /login endpoint allows an unauthenticated remote attacker to submit credential attempts at full request speed until a valid account password is recovered, after which the attacker gains authenticated access to documents, the knowledge graph, and administrative operations. Versions prior to 1.5.5 shipped no rate limit, lockout, delay, or failure counter for authentication attempts (CWE-307). Real-world exploitability is bounded by password strength - the independent assessment rates the vector AC:H for exactly this reason - and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor added an in-process sliding-window limiter in 1.5.5.