Unauthenticated remote attackers can manipulate WordPress core's get_page_template() page-template resolution so that it includes a chosen, readable local .php file residing outside the active theme directories; where the required server and active-theme preconditions are both satisfied, that include escalates to remote code execution. The issue carries a CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the high attack complexity reflecting the need for a suitable readable PHP file and matching environment conditions rather than any authentication or user-interaction barrier. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; on hardened or non-matching configurations the impact degrades to local file inclusion and information disclosure.
Server-side request forgery in MCP Atlassian (the Model Context Protocol server for Confluence and Jira) prior to 0.22.0 allows remote, unauthenticated attackers to make the server issue HTTP requests to internal or otherwise protected network resources. The flaw lives in validate_url_for_ssrf, which parses a URL's authority differently from the Requests connection layer when the server runs the header-based Jira/Confluence URL authentication flow, so a crafted backslash-containing URL can pass validation as an external hostname while the HTTP client actually connects to an internal host. Exploitation is limited to deployments that accept client-supplied Atlassian base URLs, requires the attacker to win the parser-versus-connection-layer discrepancy reliably, and no public exploit code or confirmed active exploitation was identified at time of analysis.
MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 applies its ENABLED_TOOLS and TOOLSETS least-privilege filters only when tools are enumerated via tools/list, and never re-checks them when a request is dispatched through tools/call. An authenticated, low-privileged MCP client that knows or guesses the exact name of an excluded tool can therefore invoke read, write, and delete operations against Confluence and Jira that the operator deliberately hid, yielding full confidentiality, integrity, and availability impact against Atlassian data (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-862 Missing Authorization). The flaw is meaningful only where the toolset configuration is the trust boundary - the highest risk is in shared-credential or multi-tenant deployments - and no public exploit code was identified at time of analysis. A vendor-released patch is available in version 0.22.0.
Stored cross-site scripting in the Ninja Forms WordPress plugin 3.15.3 lets an unauthenticated visitor plant a script payload inside any publicly accessible form field, which the plugin then renders unescaped on the admin submission-edit screen so it executes in the browser of the high-privileged user who opens that submission. Execution is not automatic: an administrator must review the malicious submission (UI:R), but reviewing submissions is the normal operational workflow, so that interaction gate is weak in practice, and an unauthenticated attacker can plant the payload at will (PR:N). Publicly available exploit code exists and the issue was reported by WPScan; the provided data contains no CISA KEV listing or EPSS score, so there is no confirmation of active exploitation, and our independent assessment rates the impact as changed-scope XSS with low confidentiality and integrity loss and no availability loss, rather than the higher 8.8 score carried alongside the CVE record.
Denial of service in the Vector observability pipeline's `logstash` source (versions 0.15.0 through 0.56.x) allows a remote, unauthenticated attacker to abort the Vector process by sending a stream of deeply nested compressed frames over the Lumberjack/Beats protocol. Because the decoder recursively decompresses `C` frames without a depth limit, each nested layer drives the decoding thread toward stack exhaustion, and the same construction can amplify decompressed data; per the independent assessment the impact is availability only (process termination and lost log ingestion for all tenants sharing the pipeline), with no confidentiality or integrity effect, and it requires an operator to have explicitly enabled the `logstash` source on its default 0.0.0.0:5044 listener. There is no indication of active exploitation (no CISA KEV entry) and no public exploit code identified at time of analysis; the issue is remediated in Vector 0.57.0.
Path traversal in MCP Atlassian releases prior to 0.22.0 lets a caller of the confluence_upload_attachment MCP tool read arbitrary files readable by the server's OS user and exfiltrate them by pushing them to Confluence as attachments. The upload code path converts a caller-supplied file_path to an absolute path without the workspace confinement that had already been added to the download path (CVE-2026-27825), so relative or absolute traversal sequences escape the intended workspace. The independent assessment scores the flaw CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (confidentiality only, no integrity or availability impact), requiring an authenticated caller with access to the MCP tool; the vendor's advisory scored it 8.6 with PR:N and S:C. No public exploit identified at time of analysis, and instances at 0.22.0 or later are not affected.
Unauthenticated arbitrary file read in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 lets a remote network caller abuse the streamable HTTP transport, which accepts requests carrying no user identity and silently falls back to the operator's global Atlassian credentials, to force the upload_attachment tool to read any file readable by the MCP process and push its contents into an attacker-chosen Jira issue or Confluence page, where the attacker can retrieve them. Exploitation requires the server to be running the streamable HTTP transport, reachable by the attacker, and configured with shared operator credentials - stdio-only deployments and deployments that enforce per-user identity/tokens are not exposed - and impact is confidentiality-only (file exfiltration), with no integrity or availability effect. There is no evidence of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the underlying issue is a path-traversal flaw (CWE-22) fixed in version 0.22.0, and the practical risk is bounded more by who actually deploys this MCP server over the network than by exploit maturity.
Arbitrary local file read leading to data exfiltration affects sooperset's MCP Atlassian server (mcp-atlassian) prior to 0.22.0, where the Jira update_issue tool converts a caller-supplied attachments argument into local filesystem paths and passes them to the attachment upload implementation without any workspace confinement. A caller able to invoke the update_issue tool can therefore use the server as a confused deputy, reading arbitrary files (e.g. credentials, config, SSH keys) readable by the server process and attaching their contents to a Jira issue the caller controls, with confidentiality impact only - no write or code execution through this flaw. Exploitation is access-gated: the vendor rates it AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N (8.6), while our independent assessment scores it PR:L/S:U, since a permitted MCP caller and a shared-credential deployment are realistic prerequisites; no public exploit code has been identified at time of analysis.
Unauthenticated attackers can rewrite any tenant's account balance in Softaculous Virtualizor before 3.2.9 (Patch 9) and in 3.0.0 by POSTing crafted 'act' and 'from_billing_module' parameters together with a 'billing_data' body containing arbitrary uid and balance values to the admin panel dispatcher, which executes a parameterized UPDATE against the users table without performing any authorization check. Publicly available exploit code exists, and vendor patches are available (3.2.9 Patch 9 and 3.3.0). Because no credentials, privileges, or user interaction are required (CVSS:3.1 PR:N/UI:N), any internet-reachable Virtualizor admin panel is directly exposed; the assessed impact is integrity-only - account balance manipulation that can drive automated service suspension for targeted accounts - not code execution or data disclosure.
Unauthenticated server-local file exfiltration in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows a remote caller to read any file accessible to the MCP process and have it uploaded to an attacker-controlled endpoint. The issue affects only deployments running the HTTP transports (streamable-http or sse) with READ_ONLY_MODE=false, where a request that carries X-Atlassian-Confluence-Url and X-Atlassian-Confluence-Personal-Token but no Authorization header is accepted as a 'pat' identity, so the attacker-chosen Atlassian URL is used to build the attachment client and the confluence_upload_attachment (or Jira attachment) tool accepts an arbitrary server-side file_path. CVSS 3.1 rates it 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) with confidentiality-only impact, a public Docker-based proof of concept was confirmed by the reporter so publicly available exploit code exists, and EPSS is low at 0.30% (23rd percentile) with no confirmed actively exploited (CISA KEV) status; version 0.22.0 fixes the flaw.
Loading a crafted Notepad++ plugin that reports more than 30 external lexers can overflow a 30-element stack array inside PluginsManager::loadPluginFromPath(), corrupting adjacent control data and potentially yielding arbitrary code execution in the Notepad++ process; the flaw affects all releases prior to 8.9.8. The attack is local and requires user interaction (the victim must install and load the malicious native plugin DLL), and because any loaded native plugin already runs in-process with full editor privileges, the incremental risk over simply distributing malicious plugin code is minimal - no public exploit identified at time of analysis, and the issue is not reachable remotely or through opened documents. Vendor-released patch: 8.9.8 (CVSS 8.6 base score; our assessment keeps the same 8.6 but treats scope as Unchanged rather than Changed).
Server-side request forgery in MCP Atlassian prior to 0.22.0 lets an attacker who controls or has already compromised the configured Atlassian backend return a 3xx redirect pointing at an internal address (for example the 169.254.169.254 cloud metadata service), which the MCP server's HTTP session then follows - potentially returning cloud IAM credentials or other internal service data to the attacker. Only deployments configured through the basic-auth or oauth_pat branches are exposed, because those fetcher sessions fail to attach the _make_ssrf_safe_hook redirect validator that the header-PAT branch sets via attach_ssrf_hook=True; header-PAT deployments are not affected. Publicly available exploit code exists (no CISA KEV listing, so no confirmed active exploitation), the vendor fix ships in 0.22.0, and EPSS remains low at 0.32% (26th percentile) with the assessed vector requiring high attack complexity and a malicious upstream prerequisite.
MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 lets a low-privileged authenticated MCP caller write attacker-chosen files into the server's working directory, because validate_safe_path defaults its base directory to os.getcwd() and the Confluence attachment call sites omit base_dir. Overwriting an importable Python module in that location can escalate to code execution once the application imports the modified module, and the vector intentionally bypasses the earlier remediation tracked as CVE-2026-27825. Exploitation requires permitted MCP tool access (CVSS vector shows PR:L, i.e. authenticated with low privileges) and a subsequent import or re-import of the overwritten module, so code execution is not immediate; no public exploit code has been identified at time of analysis and there is no CISA KEV entry. The vendor rates this 8.3, while an independent assessment confirms it is a genuine remote-exploitable code-execution path whose real-world priority is moderated by those preconditions.
Server-side request forgery in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows a low-privileged authenticated caller to force the MCP server to send requests to an arbitrary destination of the attacker's choosing by supplying the X-Atlassian-Jira-Url or X-Atlassian-Confluence-Url headers, which are consumed by _process_authentication_headers without passing through validate_url_for_ssrf. A successful attack redirects the server's Atlassian fetchers at internal services or cloud metadata endpoints, leaking response data back to the caller (scope-changing, high confidentiality impact, no integrity or availability impact per the assessed vector); no public exploit code was identified at time of analysis and EPSS data was not supplied. The defect is an incomplete remediation of the earlier SSRF CVE-2026-27826, and the project shipped a fix in version 0.22.0.
Arbitrary local file read in MCP Atlassian (mcp-atlassian) prior to 0.22.0 allows an authenticated MCP caller who can reach the Jira or Confluence upload_attachment tool over the HTTP-exposed 'streamable-http' transport to supply a traversal or absolute file_path that is not confined to the workspace, causing the server process to read sensitive local files and exfiltrate them as Atlassian attachments. The vendor rates this 8.3 (CVSS 4.0) with PR:L, high confidentiality impact and no integrity or availability impact, consistent with our independent assessment of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. Exploitation is limited by prerequisites: working Atlassian upload credentials and tool access must already be held, the HTTP transport must be exposed rather than stdio-only, and reachable data is bounded to files readable by the server process user; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
Arbitrary server-local file read and exfiltration in MCP Atlassian (sooperset/mcp-atlassian) prior to 0.22.0 lets an authenticated, low-privileged MCP caller abuse the upload_attachment tool for Confluence or Jira to read files on the server host via a caller-supplied file_path, then retrieve the pages' contents as a normal attachment. The vulnerability is CWE-22 (path traversal): the pre-0.22.0 code only normalized the path with os.path.abspath and performed no workspace confinement, so absolute paths and traversal sequences that escape the working directory are accepted. Impact is confidentiality-only (no write or code execution) and exploitation is conditionally gated - it matters primarily in shared-credential or multi-tenant deployments where a caller's legitimate upload capability exceeds its intended file-read scope; single-user, locally trusted deployments face negligible additional exposure. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the vendor fix is available in version 0.22.0.
Path traversal in the MCP Atlassian server (mcp-atlassian) prior to 0.22.0 allows an authenticated MCP client to read files from the host running the server and exfiltrate them as Jira or Confluence attachments, because the upload tools open caller-supplied file_path / file_paths arguments without confining them to the workspace. The privilege boundary only exists in remote or multi-user deployments (HTTP/streamable-http transport with operator Atlassian credentials shared across clients), since in a single-user stdio install the caller already owns the host; exploitation requires a permitted client authorized to invoke upload_attachment/upload_attachments (including via jira update_issue), and the read is bounded to files the server process can access. No public exploit code identified at time of analysis and no confirmed active exploitation; vendor-released patch: 0.22.0.
Information disclosure in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows an authenticated caller of the MCP server to read Jira issues, agile boards, and Confluence pages that the operator intended to exclude via JIRA_PROJECTS_FILTER or CONFLUENCE_SPACES_FILTER, because the Jira search path only checks whether a project clause is present rather than whether it is permitted, the Confluence search path applies an incomplete case-sensitive space check (and lets a caller-supplied spaces_filter replace rather than narrow the configured allowlist), and the Jira board APIs (get_board_issues, get_agile_boards) omit project-filter enforcement entirely. The flaw requires low privileges (an accepted MCP client) and no user interaction, but it only yields data beyond the intended scope when the server's shared operator credentials hold broader Atlassian access than the configured filter - the typical shared-credential, delegated, or multi-tenant MCP deployment. There is no confirmed active exploitation and no public exploit identified at time of analysis; the issue is fixed in 0.22.0, and an independent assessment rates it a moderate-priority filter-bypass/authorization control failure rather than a top-tier emergency.
Notepad++ installations prior to 8.9.8 crash when a local attacker can control the -settingsDir= command-line argument and points it at an abnormally long directory path. When Notepad++ subsequently saves its session, NppParameters::writeSession copies the derived session path into a fixed MAX_PATH stack buffer with unbounded wcscpy/wcscat calls and appends the session-backup suffix, overflowing the buffer; on protected release builds the stack canary halts the process, producing a denial of service rather than exploitable code execution. Exploitation requires local influence over launch arguments (for example a malicious shortcut or portable install) plus the victim actually launching Notepad++ and reaching a session-save, so default installations using normal-length settings directories are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor's CVSS of 7.8 overstates impact given the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).
Arbitrary code execution in Notepad++ prior to 8.9.8 on Windows 10 and Windows 11 occurs when the editor's 'Folder as Workspace' → 'Run by system' action resolves a sibling file instead of the path the user actually selected. If an attacker can place a script named after the selected text file with a .cmd extension appended (for example notes.txt.cmd next to notes.txt), invoking 'Run by system' on the text file causes that script to execute as the current user instead of opening the file. The flaw is local with a required, non-default user workflow (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8), and no public exploit identified at time of analysis; the vendor-released patch is Notepad++ 8.9.8.
MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows an accepted MCP caller to read arbitrary files from the host on which the server runs: the confluence_upload_attachment tool opens a caller-supplied file_path after only converting it with os.path.abspath, with no check that the resolved path stays inside the workspace, and then uploads the contents as a Confluence attachment the caller can download back. The vulnerability is an access-gated, confused-deputy arbitrary-file-read (CWE-22, assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, high confidentiality impact, no integrity or availability impact); exploitation requires an authenticated MCP caller (PR:L), a server older than 0.22.0 configured with Confluence credentials that can write attachments, and a space the attacker can read back - single-user local stdio deployments where the caller already owns the host gain nothing. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in version 0.22.0.
Arbitrary server-local file disclosure in MCP Atlassian (sooperset/mcp-atlassian) prior to 0.22.0 lets an authenticated, permitted Confluence MCP caller read any file accessible to the server process by passing a traversal or absolute path to the upload_attachment tool and receiving the contents back as a published attachment. Exploitation requires only a valid MCP caller session (no user interaction, low privileges per PR:L), and the scope change in the CVSS vector reflects the server process acting as a confused deputy on behalf of the caller, yielding high confidentiality impact with no integrity or availability effect. There is no public exploit identified at time of analysis and no CISA KEV listing; the practical risk is highest in shared-credential or multi-tenant MCP deployments where the caller is less privileged than the server process, and is low in single-user deployments where the caller already owns the underlying filesystem. Vendor-released patch: 0.22.0.
Denial of service in the request-filtering-agent npm package (all versions prior to 3.2.1) lets remote attackers terminate a Node.js process by causing the application to request a literal private or reserved IP address such as 127.0.0.1 or the cloud-metadata address 169.254.169.254. RequestFilteringHttpAgent and RequestFilteringHttpsAgent threw synchronously from createConnection when rejecting such a literal IP; because Node's http.request/http.get expect connection failures to arrive asynchronously, the throw escaped req.on('error') and surfaced as an uncaught exception that crashes the process (CWE-248). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), so exploitation is unauthenticated but strictly an availability impact - the private-IP filter itself still rejects the request, and no confidentiality or integrity loss is assessed. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing; successful exploitation additionally requires the consuming application to let attacker input reach the agent as a bare IP literal rather than a hostname.
Unauthenticated denial of service in the sipgo SIP library (versions up to and including 1.4.2) lets any remote attacker who can reach a SIP-over-WebSocket (WS or WSS) listener crash or memory-exhaust the server process. WSConnection.Read allocates a buffer directly from the client-declared WebSocket frame length - a value the attacker controls up to 2^63-1 - before MaxFrameSize or the downstream ParseMaxMessageLength check is ever applied, so a single header-only frame with a huge declared length triggers a makeslice panic that terminates the whole process (sipgo does not recover it), or forces an oversized allocation. No authentication, credentials, or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CVSS 7.5, CWE-789), a working proof-of-concept frame is documented in the vendor advisory, and the flaw is fixed in 1.4.3; impact is confined to availability, with no confidentiality or integrity effect, and only services that actually enable the WS/WSS transport are exposed.
Memory-exhaustion denial of service in the SIPGO Go library (versions up to and including 1.4.0) lets an unauthenticated remote peer crash or destabilize any SIP service built on it that exposes a stream listener. A single SIP message sent over TCP, TLS, WebSocket, or WebSocket-Secure with an oversized, attacker-declared Content-Length header (up to 2^32-1) causes the stream parser to allocate a body buffer of that size before the library's 65535-byte max-message-length guard is evaluated, exhausting process memory. The flaw is fixed in version 1.4.1, the vendor advisory (GHSA-pg59-5vwg-4jxq) includes a working proof-of-concept, so publicly available exploit code exists; impact is availability-only with no code execution or data disclosure, consistent with the CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Denial of service in psd-tools before 1.17.4: PSDImage.composite() and PSDImage.numpy() size their output buffers directly from the geometry declared in an untrusted PSD header (width, height, channels, depth, and per-layer rectangles) before validating those values against the bytes actually present in the file, so a 49-byte crafted PSD can force a roughly 3.35 GB allocation. Any service that composites or rasterizes attacker-supplied PSD files - an upload-and-thumbnail pipeline, for example - can be driven out of memory and terminated, and no authentication, privileges, or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Impact is confined to availability, no public exploit has been identified at time of analysis, and the issue is fixed in 1.17.4.
Server-side request forgery in MCP Atlassian (sooperset) versions before 0.22.0 lets unauthenticated callers drive the server into issuing HTTP requests to internal or cloud-metadata addresses by exploiting a DNS-rebinding race in the header-based authentication flow. Only deployments on the header_pat branch, which trust caller-supplied X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers, are exposed; the URL is validated for SSRF once and then re-resolved by the HTTP client at connection time, so a low-TTL attacker-controlled hostname can return a public IP during validation and 127.0.0.1 or 169.254.169.254 during the actual request, with roughly 50 percent success per attempt. Publicly available exploit code exists (a DNS-rebinding proof of concept using rbndr.us), EPSS is low at 0.42 percent (36th percentile), there is no KEV listing indicating confirmed actively exploited (CISA KEV) status, and the vendor-released patch is version 0.22.0.
PHP Object Injection in the Ninja Forms WordPress plugin 3.15.3 allows unauthenticated attackers to plant serialized payloads in user-submitted form field values that are later deserialized when an administrator exports submissions to CSV. Publicly available exploit code exists, but full impact - arbitrary file operations or remote code execution - is conditional on a suitable POP gadget chain being present in another installed plugin or theme; without such a chain, the object injection has limited practical impact. The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (7.5) reflects the admin-initiated export action and POP-chain prerequisites rather than guaranteed code execution.
Authentication bypass in 9Router (npm package '9router') before 0.5.6 lets a remote, unauthenticated attacker reach the public LLM API under /api/v1/* by simply adding the header X-9r-Real-Ip: 127.0.0.1, which the application's isLocalRequest() logic in src/dashboardGuard.js trusts when deciding whether canAccessPublicLlmApi() may skip API-key validation. Successful abuse grants unauthorized use of the instance owner's configured LLM providers, consumption of paid credits, and enumeration of configured providers and models; the verified affected route is GET /api/v1/models. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, 7.3), no authentication or user interaction is required, but exploitation is only possible on deployments where requests reach Next.js directly without the bundled custom-server.js wrapper and where the LLM API is network-reachable (the default bind is 0.0.0.0); instances correctly served through custom-server.js are not exploitable. The vendor advisory includes a proof-of-concept showing a 401 baseline request succeeding with 200 OK after the sole header is added.
Improper signature verification in the Notepad++ updater path allows a locally planted or modified GUP.exe updater binary to be accepted and launched even though its Authenticode digest is invalid, affecting versions 8.9.7 up to (but not including) 8.9.8 on Windows and fixed in 8.9.8. Exploitation is not remote and does not by itself yield remote code execution: it requires an attacker who already has the ability to replace or plant the updater-related file in the installation path (typically requiring elevated/admin rights for a default Program Files install, or a user-writable install directory), plus a victim who actively triggers the updater path (user interaction). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); this is a code-signing verification defect rather than a directly reachable remote vulnerability.
MCP Atlassian server versions prior to 0.22.0 allow an authenticated MCP caller to read arbitrary files from the server host by supplying an absolute or traversal path to the file_path argument of the jira_upload_attachment or confluence_upload_attachment tools, whose bytes are then uploaded into Atlassian and can be read back by the same caller. Exploitation is conditional: it requires the server to be deployed in HTTP or multi-user mode (not single-user stdio), a permitted caller able to invoke the upload tools (CVSS PR:L), and shared operator credentials so the exfiltrated content lands where the attacker can retrieve it; impact is confidentiality-focused (C:H) with limited integrity effect (I:L) and no availability impact. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though EPSS context was not provided; the vendor-released fix is version 0.22.0.
Authenticated store customers can seize other shoppers' guest carts in Spree Commerce by calling PATCH /api/v3/store/carts/:id/associate with a derivable, reversible prefixed cart ID, gaining access to the cart's billing and shipping address data and disrupting the guest's in-progress checkout. The flaw affects the 5.4.x line from 5.4.0 and the 5.5.x line up to but not including the fixed releases 5.4.4 and 5.5.4, and only manifests on stores that permit guest checkout and where an eligible guest cart containing address data exists. Rated CVSS 3.1 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), this is a genuine but moderate IDOR-style authorization weakness rather than an unauthenticated takeover; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Concurrent upload-session requests in Cloudreve prior to 4.18.0 allow an authenticated user holding Files.Write permission - which the default User group provides - to bypass the per-account storage quota and reserve more space than the account is allowed, ultimately exhausting host disk and denying uploads to other users. The flaw is a time-of-check-to-time-of-use race: PrepareUpload validates capacity against a stale in-memory value while the actual storage charge is applied later and outside the same quota-enforcing transaction, so parallel requests that read the same snapshot all pass the MaxStorage check. Exploitation requires genuinely simultaneous requests and a valid low-privileged account, and impact is limited to availability (no data disclosure or code execution); no public exploit code was identified at time of analysis, and the issue is fixed in 4.18.0.
Server-side request forgery (CWE-918) in LightRAG before 1.5.5 lets an authenticated caller who can upload a Markdown or textpack document point an external image URL at an IPv6 transition-wrapper literal (NAT64 well-known prefix 64:ff9b::/96 or an IPv4-compatible ::a.b.c.d form) that embeds a loopback, RFC1918, CGNAT, or cloud-metadata IPv4 address, causing the parser's image download to fetch the internal resource and ingest its body. The guard in lightrag/parser/markdown/parser.py evaluated only the literal address with ipaddress.is_global, which classifies these wrappers as globally routable, so the embedded internal target was never checked. Exploitation is conditional (AC:H): the deployment must have compatible NAT64/DNS64 routing for the wrapper to be delivered to the embedded target, which is why the assessed vector is AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV). The issue is fixed in v1.5.5.
Double-free memory corruption in the lwIP (Lightweight IP) stack's API layer lets an unauthenticated attacker on an adjacent network segment crash or corrupt memory on embedded devices and firmware that link lwIP, with confidentiality, integrity, and availability all assessed as high impact (CVSS 4.0 base 8.7; independent assessment CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack requires the attacker to already sit on the same or an adjacent L2 segment rather than the open internet, but needs no credentials or user interaction; successful exploitation can cause a denial of service and, depending on the target's heap hardening and allocator behavior, may extend to code execution, though reliable RCE on embedded targets is constrained by the difficulty of exploiting double-free conditions. No public exploit is identified at time of analysis, this CVE is not in CISA KEV, and no fixed version is published in the referenced sources, so mitigation currently rests on network segmentation rather than patching.
Unauthenticated path traversal in Adobe Connect (and its Android mobile app component) lets a remote attacker read files outside the intended access scope on a network-reachable deployment. Per Adobe's CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6), the attack needs no credentials and no user interaction, so an internet-exposed default installation is directly targetable; our independent assessment keeps the same network/low-complexity/no-auth/no-interaction profile but treats scope as Unchanged and stresses that impact is limited to reading files accessible to the Connect service account, with no write, no code execution, and no availability impact. On paper this is a high-priority signal; however, there is no public exploit code identified at time of analysis and no CISA KEV listing, so the unauthenticated reachability claim rests on Adobe's self-reported advisory and is not independently corroborated.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker with a low-privileged Cloud Pak for Data account execute arbitrary operating system commands on the affected node, resulting in full loss of confidentiality, integrity, and availability (C:H/I:H/A:H) with a CVSS 3.1 base score of 8.8. Exploitation is network-reachable and low-complexity with no user interaction (AV:N/AC:L/PR:L/UI:N), but it is gated behind a valid authenticated account that can reach the DataStage service, so exposure is limited to authenticated users of the 5.4.0.0 build. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation; a vendor patch is available, so patched deployments are not exposed.
Unauthenticated remote code execution in SolarWinds Observability Self-Hosted (CVSS 8.8) allows attackers on an adjacent network to execute arbitrary code via deserialization of untrusted data, but only when the deployment is configured to use a specific non-default communication mode. Default-configured instances are not exploitable, and the adjacent-network attack vector (AV:A) further narrows the exposed population. No public exploit code has been identified at time of analysis, and no credentials or user interaction are required once the mode is enabled and reachable.
Denial of service in AWS s2n-quic 1.88.0 and earlier allows an unauthenticated remote attacker to shut down a QUIC server endpoint by sending a single crafted UDP datagram that carries a Destination Connection ID of invalid length, which the library fails to validate properly. The impact is limited to server endpoints specifically configured to send QUIC Retry packets (servers that never emit Retry packets are not affected), and the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a full availability loss with no confidentiality or integrity impact and no authentication or user interaction required. There is no indication of confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, but the low attack complexity and single-packet nature of the trigger make the configuration prerequisite the key scoping factor. Vendor-released patch: v1.89.0.
Predictable session-token generation in the web management portal of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03 and SLCx-02 console servers allows unauthenticated attackers to derive a valid token belonging to a logged-in user and replay it from a different source address, achieving elevated privileges on the device and potentially on downstream serial-attached equipment. Session tokens are produced deterministically from the device model plus the current time at one-second resolution, leaving only a small enumerable keyspace, and a crafted URI that abuses file-extension handling in the web server's path routing defeats the per-session source-IP and User-Agent validation. Rated CVSS 4.0 base 8.9 (AV:N/AC:L/AT:P/PR:N/UI:A, all impacts High) with our independent assessment at CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H; exploitation requires network reachability to the portal and a legitimate user session to be live, no public exploit has been identified at time of analysis, and all firmware versions are affected so version-based mitigation is unavailable from the provided data.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only low-level privileges to execute arbitrary operating-system commands on the affected deployment, giving full compromise of host confidentiality, integrity and availability (CVSS 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a valid account and network reachability to the DataStage service, plus the ability to reach a parameter or job-input path whose value is passed into a shell command without neutralization; no user interaction is needed and complexity is rated low. At time of analysis no public exploit code and no confirmed active exploitation were identified, and IBM has published a vendor patch via its support advisory.
OS command injection in the px-runtime component of IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated, low-privilege remote attacker to execute arbitrary operating system commands on the affected host, with full loss of confidentiality, integrity, and availability. Exploitation requires only valid credentials on the Cloud Pak for Data instance and network reachability to the vulnerable component (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8); it is not exploitable by unauthenticated users. No public exploit code has been identified at time of analysis, but IBM has published a vendor patch, and the low complexity of the flaw combined with high impact makes prompt upgrading advisable.
Remote code execution in IBM FTM for Red Hat OpenShift is possible when an authenticated attacker submits a manipulated quantity value to a vulnerable feature, causing an out-of-bounds write (CWE-787) that can lead to arbitrary code execution. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity flaw requiring low privileges and no user interaction, with full confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis; a vendor patch is available via IBM support node 7288641.
Authenticated remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an attacker who holds a valid, low-privileged account to inject and execute arbitrary operating system commands through the product's command-handling logic, giving full compromise of confidentiality, integrity, and availability on the affected deployment. The flaw is rated CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it is network-reachable and requires no user interaction, but it is gated behind authentication - making stolen credentials or a malicious insider the realistic threat model rather than anonymous internet-wide exploitation. A vendor patch is available from IBM, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Deserialization of untrusted data in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated attacker who already has network reachability to the affected component from an adjacent network segment execute arbitrary code with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). The exposure prerequisite is meaningful: the flaw is reachable from a neighboring position such as a compromised pod, sidecar or host inside the same OpenShift cluster or VLAN, not directly from the public internet, and no authentication or user interaction is required once that path is reachable. At the time of analysis there is no public exploit code identified and no evidence of confirmed active exploitation (no CISA KEV listing); IBM has published a vendor fix via its support advisory, so the primary risk window is the interval between advisory release and patch deployment.
Code execution, data tampering, denial of service, and information disclosure are all reachable in NVIDIA NeMo Speech 0.0 through 2.9 because its TabularTokenizer class deserializes attacker-supplied .pkl artifacts through pickle.load() with no validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) marks this as unauthenticated but user-interaction-gated: nothing executes until a NeMo user obtains and loads the malicious tokenizer or model file, so the attack depends on a social-engineering or supply-chain delivery step rather than a directly triggerable remote request. Impact is rated high across all three security properties, but no public exploit code was identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status; realistic exposure is further narrowed by the research and development orientation of the affected toolkit.
NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) can be induced to operate on a file name or path that an attacker can influence, which the vendor states may lead to code execution, privilege escalation, data tampering, and denial of service. Rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), this is a low-complexity but not fully unauthenticated issue: the attacker must be able to reach the controller over the network and already hold a low-privileged authenticated account, at which point no user interaction is required. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS score is a low 0.61% (48th percentile), so near-term mass exploitation is unlikely even though technical impact is total (C:H/I:H/A:H).
SQL injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows a remote attacker who holds valid low-privilege credentials to inject arbitrary SQL through the management interface, with CVSS 3.1 base score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation could lead to code execution on the underlying database or controller services, tampering with stored data, denial of service, and disclosure of sensitive configuration or credential material held by the controller. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the vulnerability is remotely reachable without user interaction and any authenticated, network-exposed instance in the affected range should be treated as priority-worthy rather than emergency-level, given the authentication prerequisite and the niche datacenter/DPU deployment footprint.
Arbitrary file deletion in the BM Content Builder plugin for WordPress (all versions below 3.17.1) allows any authenticated user holding Subscriber-level access or above to delete files of the attacker's choosing from the web server through the plugin's AJAX handlers, with no user interaction required. Because the deletion is unbounded, removing a critical file such as wp-config.php can knock a site into a reconfiguration state and open a practical path to remote code execution, per the reporting vendor. At the time of analysis the issue is not listed in CISA KEV and no public exploit code has been identified; exploitation is gated by the Subscriber-or-above authentication requirement, a low bar on sites that permit self-registration.
Authenticated remote code execution affects IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, where a buffer overflow (out-of-bounds write) in an FTM component lets an attacker with valid low-privilege credentials submit crafted input and gain code execution in the containerized transaction platform. The vendor rates this 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), and our independent assessment concurs on high confidentiality and integrity impact while treating the scope change as unproven (S:U). Exploitation requires authentication (PR:L) and is not considered reliably repeatable on the first attempt (AC:H), and no public exploit identified at time of analysis. A vendor patch is available per IBM advisory node/7288641, so organizations running FTM on OpenShift should treat this as a priority patch action for their FTM estate.