Deserialization of untrusted data in the NVIDIA NeMo Speech 'Speech Data Explorer' component (affected versions 0.0 through 2.9, all platforms) lets an attacker who supplies crafted malicious data achieve code execution in the context of the user running the tool, with follow-on privilege escalation, information disclosure, and data tampering. The flaw requires no authentication on the target (PR:N) but is local in reach (AV:L) and depends on user interaction (UI:R) - a user must actively open or load the attacker-crafted dataset, manifest, or serialized artifact inside the Explorer, which confines exposure to developers and researchers running NeMo rather than production network services. No public exploit code was identified at time of analysis, there is no confirmed active exploitation (the CVE is not in CISA KEV), and the CVSS 3.1 base score is 7.8 (CWE-502).
Code execution, data tampering, denial of service, and information disclosure in NVIDIA NeMo Speech (versions 0.0 through 2.9) stem from unsafe deserialization of parameters injected through a maliciously crafted model_config.yaml handled by the dataset-loading workflow. The issue is locally scoped: the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:R with a base score of 7.8, meaning an attacker with low privileges must place the crafted config where the victim or an automated pipeline will parse it - for example inside a shared or downloaded model bundle or dataset - and exploitation depends on that untrusted NeMo config being loaded. There is no remote network-service exposure, and no public exploit identified at time of analysis; the CVE is not listed in CISA KEV.
Opening a maliciously crafted file in Adobe Substance 3D Modeler can trigger a stack-based buffer overflow that lets an attacker execute arbitrary code in the context of the current user. The flaw is client-side and local in nature - there is no network-facing exposure - so exploitation depends on social engineering to convince a victim to open a poisoned file, and any code that runs inherits only that user's privileges (no privilege escalation). The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) matches that assessment: high confidentiality and integrity impact, but gated behind the requirement that the user opens the file; no public exploit code or confirmed active exploitation was identified at time of analysis.
Opening a crafted file in Adobe Bridge can trigger a heap-based buffer overflow that results in arbitrary code execution with the privileges of the user running Bridge (CVE-2026-75649, CVSS 7.8). The attack is local-host only and depends on user interaction - a victim must open an attacker-supplied malicious file - so it cannot be triggered remotely or automatically, and code executes in the current user's context with no privilege escalation (AV:L/PR:N/UI:R/S:U). At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, but because the advisory is vendor-published and the flaw is a memory-corruption RCE class, it should be treated as a genuine but conditional risk requiring social engineering to deliver.
Stack-based buffer overflow in Adobe Bridge lets a crafted file achieve arbitrary code execution with the privileges of the user who opens it (CVSS 7.8, CWE-121). The attack is local and requires user interaction - an attacker must deliver a malicious file and convince the victim to open it in Bridge (AV:L/AC:L/PR:N/UI:R/S:U), after which code runs in the current user's context without privilege escalation. Impact is limited by the strong social-engineering and delivery prerequisites, and no public exploit identified at time of analysis; risk is concentrated in users who routinely open files from untrusted or external sources.
Heap-based buffer overflow in Adobe Bridge lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted file. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning the attacker needs no prior privileges but must rely on social engineering to get the target to open a malicious file locally; successful exploitation yields full confidentiality, integrity, and availability impact within the user's own security context, with no privilege escalation to system level. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this is a genuine but non-urgent priority that should be handled through routine vendor patching; Adobe has published an advisory (APSB26-148) with fixed builds.
Arbitrary code execution in Adobe Bridge occurs when a victim opens a specially crafted file, allowing attacker-controlled code to run with the privileges of the current user. The issue is scored 7.8 (HIGH) and is a client-side, file-format-triggered flaw with a local attack vector and mandatory user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); the attacker does not authenticate to the product, but delivery depends entirely on social engineering the victim into opening the malicious file. Only unpatched Adobe Bridge versions addressed by vendor advisory APSB26-148 are affected, and no public exploit identified at time of analysis.
Out-of-bounds write in Adobe Substance3D Modeler allows arbitrary code execution in the context of the current user when a victim opens a malicious file. This local attack (CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) requires user interaction and is not known to be actively exploited; no public exploit code has been identified at time of analysis. The flaw affects the application's file parsing logic and could lead to full compromise of confidentiality, integrity, and availability for the current user.
An out-of-bounds write in Adobe Substance3D Modeler lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted file in the application. The flaw is triggered during parsing of a malicious asset, so exploitation is local and requires user interaction: there is no network-reachable or drive-by path, and no public exploit code has been identified at time of analysis. With a CVSS base of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and no CISA KEV listing, this is a genuine but lower-priority-than-the-headline-number memory-corruption bug whose real-world impact is bounded by the privileges of the user who opens the file.
Opening a maliciously crafted 3D model or project asset in Adobe Substance 3D Modeler can trigger an out-of-bounds write during file parsing, allowing an attacker to corrupt memory and execute arbitrary code under the privileges of the user running the application. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no privileges are required (PR:N), but exploitation is gated by mandatory user interaction - the victim must open the hostile file - and the impact is confined to the current user's session rather than escalating to SYSTEM or root. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, so risk is limited to environments where users routinely open untrusted 3D asset files; Adobe has published vendor guidance in advisory APSB26-155.
Out-of-bounds write (CWE-787) in Adobe Bridge allows an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file. Adobe rates the flaw 7.8 (HIGH) under CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - a local, client-side vector that requires user interaction rather than any network-facing or service exposure, with PR:N simply meaning no application authentication is needed while social engineering remains a prerequisite. No public exploit code or confirmed active exploitation was identified from the available intelligence at time of analysis, and the affected version range is unspecified in the source data, so any deployed Adobe Bridge build should be assumed potentially vulnerable until the vendor advisory is reconciled against the installed release.
Out-of-bounds write in Adobe Bridge can be triggered when a user opens or previews a maliciously crafted file, allowing memory corruption that may lead to arbitrary code execution in the context of the current user. Only systems with Bridge installed where users routinely open untrusted asset files are exposed; the vector is local (AV:L) with mandatory user interaction (UI:R), so there is no unattended or remotely reachable attack path and no privilege escalation beyond the logged-in user (S:U). Adobe self-reported the flaw in advisory APSB26-148 and rates it CVSS 3.1 7.8 HIGH; no public exploit code was identified at time of analysis and there is no KEV status confirming active exploitation.
Code injection in NVIDIA NeMo Speech versions 0.0 through 2.9 allows local attackers with low privileges to execute arbitrary code, disclose sensitive information, and tamper with data by supplying crafted input to the toolkit. The vulnerability requires local access (AV:L) and low privileges (PR:L) but no user interaction; it has a CVSS 3.1 base score of 7.8 (High) and is classified as CWE-77 (command injection). No public exploit code has been identified at time of analysis, and the vendor advisory at GitHub NVIDIA product-security 2026/5885 should be consulted for patch details.
Local cross-user code execution with privilege-escalation potential affects the Windows builds of GNU wget distributed by eternallybored.org (releases 0 through 1.21.4 inclusive). The flaw is a hardcoded configuration location, C:\msys64, that unprivileged users can write to: a low-privileged local attacker who plants a wgetrc there can abuse the use_askpass directive so that arbitrary code is executed in the security context of a higher-privileged user who later runs the affected wget build. The attack is not remotely reachable and does not trigger on its own, which is captured by the UI:R component of the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8), and no public exploit code was identified at time of analysis.
Local privilege escalation in the Netdata Windows Agent (versions 2.0.0 through 2.10.3) allows an authenticated low-privileged user to execute arbitrary commands with SYSTEM privileges by placing malicious commands in their PowerShell profile and then triggering an MSI repair, which runs powershell.exe as SYSTEM without the -NoProfile flag. The vulnerability (CWE-269) is fixed in Netdata Agent 2.10.4; no public exploit code has been identified at time of analysis.
Local privilege escalation in Qualcomm Snapdragon firmware allows an attacker with low privileges to gain high-impact code execution and control over the device. The flaw resides in an exposed dangerous function within a gRPC server (CWE-749) and affects specific QPM (v3.0.127.2, v3.0.126.7, v3.0.125.4) and QSC (v1.21.0, v1.19.1, v1.17.1) builds. Exploitation requires local access and a pre-existing low-privileged foothold; no public exploit or active exploitation has been identified, and EPSS is only 0.15%.
Crypt::SelfCertificate versions 1.01 through 1.05 for Perl ship embedded malware: the module's generate_certificate routine launches a Python dropper disguised as a certificate sample file, which decodes a base64-obfuscated URL, fetches the response body over HTTP, and executes it in memory under the privileges of the invoking user. Any host that installs one of these CPAN releases and then calls the function is exposed to arbitrary code execution with high confidentiality, integrity, and availability impact (assessed CVSS 3.1 base 7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); exploitation is unauthenticated per the vector but requires the victim to install the package and trigger the function, and there is no public exploit identified at time of analysis. Because the payload is fetched and run without writing a script to disk, it behaves as a fileless stage and leaves minimal on-host artifact beyond the installed module itself - a genuine, high-priority supply-chain compromise rather than an inflated score.
Authenticated code execution in Sentry's relocation import worker lets a user with a valid account on an affected instance run arbitrary code in the worker process by uploading a crafted relocation archive. Only instances that have explicitly enabled the relocation (backup import/export) feature are exposed, since that feature is disabled by default in self-hosted installations; affected versions run from 23.11.0 up to but not including 26.7.0, which contains the fix. Severity is high (7.7 under CVSS 4.0), requires authenticated access and a non-default feature flag, and no public exploit has been identified at time of analysis.
Server-side request forgery in the WebSSH/WebTelnet listener of Lantronix SLC8000 (before firmware 9.7.0.3), EMG8500/EMG7500 (before firmware 9.7.0.1), and all firmware versions of SLB882 allows unauthenticated remote attackers to make the device open outbound Telnet connections to attacker-chosen hosts by tampering with the rooturl parameter, turning the out-of-band management appliance into a pivot for enumerating or reaching internal network endpoints that are otherwise unreachable from the attacker's position. The flaw sits in the custom shellinaboxd component, which trusts the client-supplied rooturl value to determine its own IP address, and it is remotely exploitable without authentication or user interaction (CVSS:4.0 7.7; independent assessment CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N). Impact is bounded to reconnaissance and lateral communication rather than code execution or data corruption; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk depends on whether the management interface is exposed to an attacker-controlled network segment. This is a genuine but bounded risk.
Unauthenticated server-side request forgery in the Lantronix SLC8000, EMG8500/EMG7500 and SLB882 console servers lets any remote party that can reach the WebSSH/WebTelnet listener coerce the device into opening an SSH session to an arbitrary, attacker-chosen host or IP. The flaw lives in the custom shellinaboxd daemon, which derives its own address from the client-supplied rooturl parameter, so tampering with that parameter redirects the terminal connection elsewhere, allowing attackers to enumerate or talk to internal endpoints that are otherwise unreachable. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, though a detailed technical writeup and a VulnCheck advisory describe the mechanism; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N, reflecting low confidentiality impact on the device itself and high confidentiality impact on systems behind it.
Unauthenticated server-side request forgery in the WebSSH/WebTelnet web terminal listener of Lantronix SLC8000 console servers (before firmware v9.7.0.3), EMG8500/EMG7500 out-of-band gateways (before firmware v9.7.0.1), and all firmware versions of the SLB882 lets remote attackers make the device open SSH connections of their choosing, including to hosts on internal networks the device can route to but the attacker cannot. The trigger is an overlong username that overflows a fixed-size buffer in a custom shellinaboxd snprintf call, truncating the device-derived IP suffix of the connection target and redirecting it to an attacker-specified endpoint. The independent assessment rates this High (CVSS 4.0 base 7.7, AV:N/AC:L/AT:N/PR:N/UI:N, VC:L/SC:H), remote, unauthenticated and low-complexity, with blind SSRF impact - connection establishment and internal enumeration rather than direct extraction of device data; no public exploit code or confirmed active exploitation was identified at time of analysis.
Frigate NVR deployments prior to 0.18.0 ship an nginx configuration that routes the prefix-matched location /api/go2rtc/api to the internal go2rtc API behind authentication but without an administrator role check, so any authenticated user holding only a low-privilege 'viewer' account can issue GET requests to that path and read proxied go2rtc data. Reachable subpaths (streams, config, log, stack) disclose internal network addresses, configuration file paths, application logs, goroutine stack traces, and RTSP stream URLs that may embed camera credentials; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) reflects remote, authenticated, read-only disclosure with changed scope, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. This is a genuine but bounded confidentiality issue: non-GET methods are rejected by limit_except GET, so no modification or lateral write is possible, the impact is contingent on RTSP URLs actually containing embedded camera credentials, and instances already upgraded to 0.18.0 are not affected. Authentication requirements are confirmed as authenticated by the CVSS vector (PR:L); unauthenticated attackers and administrators are outside the stated prerequisite set.
Integer overflow in libstdc++ within Red Hat Hardened Images can cause undersized memory allocations, leading to memory corruption or application instability when a consuming application passes an attacker-controllable large size to the C++ new or new[] operator. Exploitation requires a specific application input path that triggers CWE-190 and an exploitable heap layout, as reflected in the High severity (CVSS 7.7, AC:H) assigned by Red Hat; the flaw is not exploitable against libstdc++ in isolation. No public exploit code, proof-of-concept, or CISA KEV listing is identified in the available data.
A use-after-free in the Security Plugins component of RTI Connext Professional 7.6.0 through 7.7.0.0 lets an admitted, low-privilege participant in a DDS domain corrupt memory and manipulate files, producing high impact to confidentiality, integrity and availability. Exploitation is network-reachable but gated by two prerequisites: the deployment must have Security Plugins enabled (not just the base DDS libraries), and the attacker must already hold authenticated low-privilege access as an accepted DDS participant (CVSS 3.1 PR:L, CVSS 4.0 AT:P indicates an additional timing/precondition gate), so it is not exploitable against a default unauthenticated posture. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor-supplied CVSS 4.0 base score is 7.7 (High).
Deserialization-based code execution is possible in MISP because PHP's phar stream wrapper is left registered in both the web entry point (app/webroot/index.php) and the console entry point (app/Console/cake.php), so any filesystem call on a caller-influenced path that resolves to a phar archive silently triggers an unserialize() of attacker-controlled metadata, or can reach executable code inside an uploaded phar under a relocated application root. The vendor's fix (commit 08fa755b6) simply unregisters the wrapper at startup, confirming that nothing in MISP, vendored CakePHP, or runtime libraries legitimately uses phar archives. Real-world risk is lower than the 7.7 CVSS 4.0 score suggests: the vector requires authentication (PR:L - a valid MISP account) and High attack complexity (AC:H), because no MISP/CakePHP/library code natively feeds a caller-influenced path into a phar-resolving operation, so a separate path-influence bug must be chained and no public exploit code has been identified at time of analysis.
Denial of service in Adobe Content Credentials - the Content Authenticity Initiative (CAI) Rust SDK (c2pa-rs) and its associated command-line tool - allows attackers to exhaust system resources when the library is used to parse or validate an attacker-supplied C2PA asset or manifest. The flaw is classified as uncontrolled resource consumption (CWE-400) with CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): authentication and user interaction are not required, and impact is availability-only with no confidentiality or integrity effect. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so real-world risk is driven mainly by exposure - a network-reachable exploit path exists only where the SDK is embedded in a service that ingests untrusted content credential files, while standalone command-line usage limits the vector to locally or pipeline-supplied assets.
Improper input validation in Adobe's Content Credentials Rust SDK and its companion command-line tool lets unauthenticated remote attackers supply a crafted asset or Content Credentials manifest that slips past the SDK's validation logic, bypassing the intended security control and allowing unauthorized write/forgery of Content Credentials provenance data. The defect is network-reachable with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), but the impact is integrity-only - confidentiality and availability are unaffected (C:N/I:H/A:N) - so exposure is bounded to applications and workflows that actually invoke the SDK or CLI to validate attacker-supplied content, particularly those relying on these credentials for media authenticity or trust decisions. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS or KEV data was supplied; Adobe's advisory (APSB26-147) is the authoritative source.
Memory exhaustion in Netdata versions prior to 2.11.0 allows a remote, unauthenticated attacker to inflate small, highly compressed WebSocket frames into large server-side allocations and, by repeating this across concurrent connections, drive the monitoring process to memory exhaustion and termination. The weakness sits in the unauthenticated WebSocket server's permessage-deflate handling, which is negotiated before authentication, so exploitation requires only network reachability to the default web listener (0.0.0.0:19999) - instances bound to localhost or shielded by firewalls are not reachable. Vendor-released patch: 2.11.0, which introduces a compressed-to-decompressed ratio cap; no public exploit code identified at time of analysis and no CISA KEV entry, but the independent assessment rates this a legitimate availability risk given the trivial trigger and the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Denial of service in YARA 4.5.8 occurs when libyara deserializes a crafted compiled rule file (.yrc): malformed external-variable pointers or an out-of-range type field are not validated in the yr_rules_load/yr_rules_from_arena path, resulting in an invalid free in yr_rules_destroy() or a wild pointer dereference in yr_object_create(). Only deployments that load compiled rules from untrusted or third-party sources are exposed, since the assessed vector requires a user or process to actively load the file (UI:R) and no authentication (PR:N); the realistic outcome is a process crash rather than code execution (C:N/I:N/A:H). No public exploit code has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and the issue is not confirmed actively exploited (CISA KEV).
Unbounded memory growth in rpcbind allows remote, unauthenticated attackers to degrade or exhaust service availability by flooding the daemon with unique RPC requests that it records in statistics lists which are never pruned. The flaw is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), an availability-only impact, and affects rpcbind as shipped in Red Hat Enterprise Linux 6, 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4. No public exploit code was identified at time of analysis, and exposure is limited to hosts on which the rpcbind service (typically TCP/UDP port 111) is network-reachable, because the attack requires no authentication, no user interaction and no non-default configuration.
Remote, unauthenticated attackers who can reach the application endpoints of IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can perform unauthorized actions because the software fails to properly authenticate requests and subsequently omits authorization checks. Affected deployments are those running versions 4.0.6.0 through 4.0.10.0 Interim Fix 064, including Operator 4.4.6+20260807.081800 and the 4.0.6.0 Refresh build, per the EUVD version list. Impact is confined to integrity - attackers can trigger unauthorized operations or modify data, but there is no confidentiality or availability consequence per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), and there is no public exploit identified at time of analysis, with EPSS at only 0.60% (47th percentile) and CISA SSVC recording no observed exploitation.
Denial of service in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift: unsafe reflection handling of externally controlled input lets an unauthenticated remote attacker (CVSS 3.1 AV:N/AC:L/PR:N/UI:N) drive the service into an availability failure, scored A:H with no confidentiality or integrity impact for a base score of 7.5. Deployments affected are the 4.0.6.x through 4.0.10.0 releases listed by IBM prior to the Interim Fix 064 level. Exploitation pressure currently looks low - EPSS is 0.60% (47th percentile), CISA's SSVC decision framework rates exploitation 'none' and automatable 'no', and no public exploit code has been identified at time of analysis - but the practical limiter is exposure rather than exploit difficulty, since this financial middleware is normally run inside controlled OpenShift clusters instead of the open internet.
Authenticated users with contributor-level access or higher on a WordPress site running the WP Travel Engine plugin 6.8.0 or earlier can force the plugin's wte_get_template helper, reachable through one of its shortcodes, to include and execute arbitrary server-side .php files, enabling sensitive data disclosure, access-control bypass, or code execution. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) rates attack complexity as high because full remote code execution is gated on the attacker being able to place an attacker-controlled .php file on the server for inclusion; without that upload primitive, impact is limited to including and executing pre-existing PHP files. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, so exploitation requires an attacker who already holds a legitimate low-privilege account.
Information disclosure in HPE ALE management interface allows unauthenticated remote attackers to retrieve sensitive site hierarchy, infrastructure details, and client device information via specially crafted requests to internal endpoints. Despite the absence of exploitation telemetry, this is a high-priority remotely-exploitable exposure because the flaw requires no authentication, no user interaction, and low attack complexity; the primary limiting factor is network reachability to the management interface. No public exploit code exists at time of analysis, and the confidentiality impact is high with no integrity or availability effect (CVSS 7.5).
Unauthenticated SQL injection in ReactPress versions prior to 3.7.0 allows remote attackers to read arbitrary data from the underlying database by supplying crafted query-string parameter names to the API list endpoints for articles, comments, files, knowledge entries, and pages. Because the application interpolates those attacker-controlled names directly as SQL column identifiers while only parameterizing the values, no authentication, user interaction, or non-default configuration is required - any network-reachable ReactPress instance running an affected version is exposed, as reflected in the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5) and CWE-89 classification. Exploitation is limited to information disclosure through the injected LIKE clause (no integrity or availability impact has been demonstrated), and no public exploit code has been identified at time of analysis, with vendor-released patch version 3.7.0 available.
Blind SQL injection in the DevItems HashBar - WordPress Notification Bar plugin, affecting all versions through 2.0.3, lets an attacker who already holds a high-privilege WordPress session inject crafted SQL through a plugin parameter and infer database contents one bit at a time. Because the CVSS vector is PR:H, exploitation requires an administrator-equivalent account (or a role able to reach the affected HashBar parameter) rather than anonymous access, and the inference-based (blind) nature of the flaw means extraction is slow and noisy rather than a single-shot dump. There is no CISA KEV listing, no EPSS score, and no public exploit code referenced, so this is a post-authentication risk that is elevated mainly on sites where over-privileged accounts are shared or where the WordPress database holds data belonging to other applications - the vector's S:C scope change only materializes in that shared-database scenario.
MPXJ's MerlinReader (versions 5.5.5 through 16.4.1) creates a default-configured DocumentBuilder when parsing XML taken from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype declarations and external entities enabled, so a crafted database can coerce the parser into reading arbitrary local files when an application imports an untrusted Merlin file. The practical impact is bounded: per the vendor, MPXJ's downstream handling of the parsed XML means the file contents are unlikely to be exfiltrated, so this is effectively blind XXE (local file access, possible SSRF or parser DoS) rather than reliable data disclosure, which is why the independent assessment rates Confidentiality as Low despite the 7.5 HIGH base score, and the CVSS vector shows network reachability with PR:N/UI:N (unauthenticated, no user interaction beyond the file being processed by the host application). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; a vendor-released patch is available in MPXJ 16.4.1.
Unauthenticated data injection in HPE's Analytics and Location Engine (ALE) lets any attacker who can reach the ALE service socket send specially crafted input during connection setup and corrupt the data the component handles. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) - remote, low complexity, no credentials and no user interaction required, with impact confined to integrity; confidentiality and availability are unaffected. There is no indication of active exploitation (CISA KEV) and no public exploit identified at time of analysis, so the practical risk is driven by exposure: ALE is an internal enterprise WLAN analytics component, and instances whose listening socket is reachable from untrusted or flat network segments carry the greatest risk.
Path traversal in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, affecting builds from 4.0.6.0 through 4.0.10.0 Interim Fix 06 (Operator 4.4.6+20260807.081800), allows an unauthenticated remote attacker (PR:N/UI:N per the CVSS vector) to submit manipulated path input that the product fails to canonicalize and thereby read arbitrary files accessible to the FTM process. The impact is confidentiality-only - no write, code execution, or availability effect - and exploitation requires network reachability to the FTM application endpoint, so internal-only routes or network segmentation materially reduce exposure. A vendor patch is available via IBM's advisory; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.35% (28th percentile), making this a moderate rather than urgent priority.
Server-side request forgery in MCP Atlassian (sooperset/mcp-atlassian) versions prior to 0.22.0 allows unauthenticated callers to reach internal or cloud metadata endpoints by exploiting a DNS-rebinding race, because the server validates a hostname's resolved IP and then lets Requests/urllib3 resolve that same hostname again at connection time. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N (7.5): no authentication is needed, but the attacker must control authoritative DNS for a low-TTL name that answers publicly during validation and privately during connection, and the server must actually be able to reach a valuable internal target for the attack to pay off. This is a bypass of the earlier CVE-2026-27826 hardening rather than a new class of bug, no public exploit code or confirmed active exploitation was identified at time of analysis, and environments already running 0.22.0 or with no reachable internal/metadata endpoints are not exploitable.
Sensitive information disclosure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift stems from the product's use of a hard-coded or predictable cryptographic key (CWE-321). Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5), an unauthenticated remote attacker who obtains that static key can read data the product intended to protect, with no integrity or availability impact. The real gate is acquiring or deriving the embedded key rather than defeating authentication: no public exploit identified at time of analysis, EPSS is only 0.26% (17th percentile), and CISA SSVC records exploitation as none with Automatable set to no, making this a moderate, not urgent, priority.
A one-byte heap buffer over-read in flatcc (commit 4c3b999e) allows an attacker to crash the schema compiler by supplying a malicious FlatBuffers schema that is exactly the length of the input buffer and ends with an unterminated quotation mark. The flaw requires local access and user interaction to feed the crafted schema into the parser, resulting in a single-process denial of service with no code execution or data disclosure. Publicly available exploit code exists, but the issue is not known to be actively exploited (not in CISA KEV); EPSS is 0.22% (13th percentile), indicating low predicted exploitation activity.
Cleartext transmission of sensitive information in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift exposes transaction data, credentials, or other confidential payloads to anyone able to observe network traffic on the same segment. The issue affects deployments of FTM for OpenShift where the relevant transport is not wrapped in TLS; an unauthenticated attacker with an adjacent-network position (per the assessed vector PR:N, AV:A) can passively capture that traffic, though a successful capture depends on the specific unencrypted channel being in use (AC:H), which is why the independently assessed impact is limited to confidentiality only. No public exploit code has been identified at time of analysis, and there is no indication of active exploitation, so this remains a low-real-world-priority issue despite the headline 7.5 (High) CVSS score.
Supplying a FlatBuffers schema whose exact-length buffer terminates on a digit character pushes flatcc's schema lexer one byte past the end of the input, producing a single-byte heap over-read that crashes the process (denial of service). The defect lives in external/lex/luthor.c at flatcc commit 4c3b999e and requires the application to hand attacker-controlled schema text to lex(); in typical build-time and CI usage that input is local, so unauthenticated remote triggering only applies to services that compile or lex untrusted schemas at runtime (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:A:H). Impact is confined to availability - no memory write, no code execution and no data disclosure - and no public exploit identified at time of analysis.
Cleartext transmission of sensitive or security-critical data by IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a network-positioned attacker read that traffic by passively sniffing the communication channel, resulting in high confidentiality loss without any integrity or availability impact. Affected deployments span the 4.0.6.0 release line (including the 4.0.6.0.0.6.0 Refresh, Operator 4.4.6+20260807.081800) through 4.0.7.0, 4.0.8.0, 4.0.9.0 and 4.0.10.0 Interim Fix 064. Exploitation is not confirmed actively exploited (no CISA KEV listing) and no public exploit code has been identified; EPSS is low at 0.20% (10th percentile), and CISA's SSVC assessment records exploitation: none, automatable: no. The practical barrier is the attacker's required vantage point on the traffic path, which our assessment reflects by treating attack complexity as high (AV:N/AC:H/PR:N/UI:N) rather than the vendor-published AC:L, making this a moderate rather than top-tier priority; a vendor patch is available.
Message forgery in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets remote, unauthenticated attackers send messages bearing forged cryptographic signatures that the platform improperly accepts as authentic, undermining the integrity of trusted transaction messaging (CWE-347, CVSS 7.5, integrity-only impact with no confidentiality or availability loss). Affected releases are the 4.0.6.0 line, including Interim Fixes 1 through 6, plus 4.0.7.0, 4.0.8.0, 4.0.9.0 and 4.0.10.0 Interim Fix 06. Exploitation is remote and requires no authentication or user interaction (PR:N/UI:N) but demands that an attacker understand and correctly craft a message in FTM's expected format and that an FTM message interface be reachable; there is no public exploit identified at time of analysis (EPSS 0.19%, 9th percentile), CISA SSVC rates exploitation as none and automatable as no, and there is no KEV listing.
Unauthenticated path traversal in the Dancer2 Perl web framework (versions 2.1.0 up to but not including 2.2.0) lets a remote attacker read arbitrary files that the worker process can access, including configuration files such as config.yml stored above public_dir. The flaw only manifests in a non-default deployment where the application names File in its route_handlers configuration and sets static_handler to 0 - because the default static handler refuses dot segments before the File route executes; applications left at defaults are not affected. The vendor has released Dancer2 2.2.0 with a containment fix, EPSS is low (0.19%, 8th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Arbitrary code execution in GNU Emacs 28.1 through 31.1 is triggered simply by opening a crafted file: an untrusted read-symbol-shorthands value supplied by that file reaches the Lisp reader's intern and unintern functions and is honored under Emacs's default configuration, so no special user settings or opt-ins are required. Exploitation is bounded by delivery - the attacker must get a victim to open the malicious file locally (AV:L with UI:R), and any resulting code executes with the privileges of the user running Emacs; no network service, listener, or authentication is involved. The issue carries a CVSS 4.0 score of 7.5 and is assessed under CVSS 3.1 as AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, with high confidentiality, integrity, and availability impact and no public exploit identified at time of analysis.
OS command injection in OpenEye Apex Network Video Recorder firmware (2.2.3.4 through 3.2.9.376) allows an authenticated administrator to feed crafted backup-area configuration input into the recbackup routine, where it is passed unsanitized to a shell and executed with the privileges of the nvr service account. Rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), the issue is genuinely exploitable but access-gated: the attacker must already hold an administrator account and reach the management interface over the network, which confines realistic exposure to insiders, credential-theft or credential-reuse scenarios, and NVRs left on default or weak admin passwords. No public exploit code or confirmed active exploitation has been identified at time of analysis; OpenEye has released firmware 3.5.4 as the fix, with supporting detail in vendor advisory 1061 and the Securifera advisory.
Security-control bypass in the Dancer2 Perl web framework (2.0.0 through 2.1.x) lets a refused route execute anyway: when an application enforces an authorization or security check by having a 'before' hook die and also registers an on_hook_exception handler that halts the response, the post-exception cleanup still runs and destroys the request, response and session the dispatcher needs, so the route body the hook meant to refuse runs and its writes land. The flaw requires that specific non-default application design - apps that do not refuse via dying hooks, or whose exception handler does not halt the response, are not affected - and, when the pattern is present, a single unauthenticated remote request is enough to trigger it (AV:N/AC:L/PR:N/UI:N), giving a high integrity impact on denial-protected state changes. EPSS is 0.17% (7th percentile) and there is no public exploit identified at time of analysis; CISA's SSVC rates exploitation as none, automatable as yes, technical impact partial. Vendor-released patch: Dancer2 2.2.0, which adds a halt check to the cleanup guard and makes hook compilation idempotent.