Denial of service in the Moquette lightweight Java MQTT broker prior to 0.18.1: a single remote, unauthenticated MQTT client can terminate a shared SessionEventLoop with a command that raises an uncaught exception, and because SessionEventLoopGroup never restarts a dead loop, every other client session pinned to that loop stops processing PUBLISH, SUBSCRIBE, PUBACK and related commands. Because Moquette accepts anonymous MQTT clients by default and the CVSS vector (PR:N) confirms no authentication is required, an attacker who chooses client IDs that distribute across the broker's available loops can progressively disable session processing broker-wide; impact is availability-only (C:N/I:N/A:H, no code execution or data exposure), and the upstream advisory documents concrete trigger inputs such as a malformed $share/grp SUBSCRIBE, a deeply nested topic, and an ACL NPE. No public exploit tooling was identified at time of analysis, and the issue is fixed in 0.18.1.
Arbitrary code execution as root is achievable on affected Plesk servers by any authenticated panel user who can influence a directory on the untrusted search path used by the Plesk RESTful API extension. Exploitation requires Plesk core 18.0.34 through 18.0.80.7 or 18.0.81 (i.e., below 18.0.80.8 / 18.0.81.1 respectively) together with the 'Plesk RESTful API' extension at versions 2.4.2 through 2.4.6; the vector is network-reachable, needs only low-privilege credentials (PR:L per the CVSS 4.0 vector) and no user interaction, making a full root compromise of the hosting panel feasible from an ordinary subscription account. Independent assessment rates this a genuinely high-priority flaw despite thin external signal, since successful exploitation yields complete loss of confidentiality, integrity and availability on the panel host (CVSS 4.0 base 8.7; assessed CVSS 3.1 8.7 with S:U/C:H/I:H/A:H). No public exploit code identified at time of analysis, and no EPSS or CISA KEV data corroborates active exploitation; vendor fixes are available in Plesk 18.0.80.8 / 18.0.81.1 and extension 2.4.7.
Unbounded per-session message queuing in Moquette MQTT Broker before 0.18.1 permits remote unauthenticated clients to exhaust broker memory or persistent storage by sustaining a fast publisher against a slow subscriber, causing denial of service. The CVSS 4.0 base score is 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N), consistent with a high-availability-only impact under CWE-770; the independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms no confidentiality or integrity impact. Default Moquette configurations permit anonymous clients, broadening exposure, and no public exploit identified at time of analysis; no CISA KEV entry, EPSS score, or public exploit specific to this queue-exhaustion issue is provided in the input.
Remote unauthenticated clients can crash a Moquette MQTT broker running 0.18.0 or earlier by publishing or subscribing with a topic name or filter that is nested to an extreme depth, triggering uncontrolled recursion in the broker's CTrie subscription structure and an uncaught StackOverflowError. Because Moquette accepts anonymous MQTT clients by default, network reachability is the only precondition, and the resulting crash lands on a SessionEventLoop that catches only InterruptedException and is never restarted, so the failure wedges every session co-located on that loop rather than just the attacker's connection - a broker-wide denial of service with high availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor-published CVSS 4.0 base 8.7). The issue is not in CISA KEV and no public exploit identified at time of analysis; it is fixed in Moquette 0.18.1, which introduces a MAX_TOPIC_DEPTH of 1024 enforced on both PUBLISH and SUBSCRIBE paths.
Unauthorized message injection in the Moquette lightweight Java MQTT broker affects all releases prior to 0.18.1: PostOffice.publishWill publishes a client's Last-Will Testament without running the canWrite authorization and reserved-topic checks that gate a normal PUBLISH, so remote unauthenticated attackers (CVSS vector PR:N) can register a Will on a topic they are not allowed to write and have the broker deliver that message to subscribers when the connection is abruptly dropped. This is an integrity-only flaw (C:N/I:H/A:N) whose real-world severity depends on how sensitive the restricted topic is - for example device command-and-control channels - and exploitation requires that an ACL or IAuthorizatorPolicy actually restricts writes to the targeted topic; vendors score it 8.7 (CVSS 4.0). Publicly available exploit code exists (the upstream advisory ships source-level PoCs, including a wildcard-ACL injection proof), but there is no indication in the supplied data of confirmed active exploitation (CISA KEV), and no patch is available other than upgrading to vendor-released version 0.18.1.
Stored cross-site scripting in the automation-controller component of Red Hat Ansible Automation Platform 2 lets an authenticated low-privileged user embed a javascript: hyperlink into job, ad hoc command, project update, or inventory update standard output, which is then rendered as a text/html link in the controller's stdout view. Because the HTML conversion escapes HTML metacharacters but never strips ANSI terminal escape sequences, an OSC 8 hyperlink becomes an unfiltered HTML anchor, and the response carries no Content-Security-Policy; a higher-privileged user (for example an administrator) who views that output page and clicks the link executes attacker-controlled JavaScript in their authenticated session, allowing actions up to full platform takeover. The vector is network-reachable with low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7), but exploitation hinges on a privileged victim actively clicking the crafted link; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Brocade SANnav deployments running versions before 3.0.1a expose backend management service ports without adequate access controls, so a local, non-administrative user on the SANnav host can talk directly to those services and relay commands to interconnected Fabric OS switches under the SANnav management user's identity. Exploitation is access-gated: it requires an authenticated low-privileged account on the host (PR:L, consistent across both the vendor CVSS 4.0 vector and our assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) plus a SANnav instance that is actively managing switches, but where those conditions hold, impact is high across confidentiality, integrity and availability with a changed scope because the attacker's authority crosses from the host user into the managed switch fabric. No public exploit code or confirmed active exploitation was identified at time of analysis.
An authenticated automation-controller administrator in Red Hat Ansible Automation Platform 2 can turn the administrator-controlled format template for API 4XX log messages into a secret-reading primitive, using Python string-format traversal to walk from the interpolated user object into Django settings and pull out the SECRET_KEY and the database password. Because the log destination (external aggregator) is also administrator-controlled, the formatted message - and therefore the secrets - can be shipped off the host, giving the administrator the master key protecting all stored credentials, the ability to forge signed user sessions, and direct database access; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N (8.7) with high confidentiality and integrity impact and scope change, since secrets leave the controller's security boundary. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so this is a high-priority hardening issue rather than an actively exploited one: the practical risk is driven by the very high value of the assets reachable once a privileged administrator account or the log pipeline is compromised.
Command injection in the Brocade SANnav CLI scripting component lets an authenticated user who already holds command-execution/scripting permissions break out of the restricted allow-list execution context and run unauthorized shell commands across managed fabric switches, escalating to full administrative switch access. Exploitation requires a valid SANnav account with scripting rights and adjacency to the SAN management plane (AV:A, PR:L) - the product is not internet-reachable by default - and no user interaction is needed once that foothold exists. Every SANnav release before 3.0.1a is in scope per the CPE (cpe:2.3:a:brocade:sannav:*:*:*:*:*:*:*:*), and no public exploit code has been identified at time of analysis; this is a genuine mid-to-high priority for SANnav operators, not an emergency-tier internet-facing issue.
Cross-tenant account takeover in InvoiceShelf before 2.4.1 allows an authenticated Owner of one company to read and overwrite any user account in another company on the same multi-company installation by abusing the /api/v1/users/{user} endpoints. The flaw is an authorization bypass through user-controlled key (CWE-639): the API resolves the target by global primary key while UserPolicy validates only the requester's own header-company, enabling cross-tenant disclosure and full account takeover via email/password overwrite plus company re-assignment. No public exploit identified at time of analysis; exploitation requires Owner-level privileges (PR:H) and a multi-company deployment, but is remote, low-complexity, and high-impact when those conditions are met.
PII harvesting in JoomShaper EasyStore 1.0.0-3.0.0 allows unauthenticated attackers to enumerate guest checkout records via the checkout.searchGuestUser endpoint, which returns full shipping details (name, phone, address) for any supplied email address. Despite vendor labeling as an authenticated SQL injection, the endpoint requires no authentication or session validation and enables bulk collection of customer PII. No public exploit code has been identified at time of analysis; the vendor has resolved the issue by removing the server-side endpoint and migrating autofill to client-side localStorage.
Authenticated SQL injection in the Easy Store extension for Joomla (versions 1.0.0 through 3.0.0) allows a Joomla administrator to inject arbitrary SQL through the coupon bulk update task at administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate. The flaw is a genuine injection (reported as CWE-74, functionally classic CWE-89 SQLi) where coupon IDs are concatenated straight into raw SQL IN (...) clauses instead of being cast to integers or parameterized. Exploitation is confirmed to require high privilege (PR:H in the assessed CVSS:3.1 vector), and there is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.25% (14th percentile), so despite the 8.6 headline score the practical priority is moderate-to-low because Joomla administrators already hold broad database-level trust.
Server-side template injection in web.py 0.76 allows an attacker who can write to the application's template source directory to achieve arbitrary Python code and OS command execution on the server, but only when the application precompiles those templates and later renders them through the precompiled template loader; that specific deployment pattern is what defeats the template engine's built-in sandbox. The flaw is a genuine RCE-class issue (CWE-94) at CVSS 8.5, yet it is gated by real prerequisites: the CVSS vector indicates authenticated access (PR:L) and high attack complexity (AC:H), because the attacker must first obtain write access to the template directory and the application must use the precompiled code path rather than direct sandboxed rendering. It is not a remote-unauthenticated exploit against stock configurations, and no public exploit identified at time of analysis; exploitation is not confirmed actively exploited (CISA KEV) and no KEV entry is present in the source data.
Unauthenticated remote attackers can connect to the /log WebSocket endpoint in Klever-Go and either read live node logs or apply an arbitrary logger profile process-wide, for example setting *:NONE to mute normal slot logs or *:TRACE to flood them. The flaw is a management-plane information exposure (CWE-200) with additional integrity and availability effects, and publicly available exploit code exists because the advisory includes a proof-of-concept reproduction; no CISA KEV active exploitation is indicated. Exploitation requires the REST API to be network-reachable, so nodes that keep the API bound to localhost or an admin-only interface are not remotely exposed, and the vendor-released fix is version 1.7.20.
Authenticated Joomla backend users of any privilege level can bypass EasyStore's ACL checks and edit arbitrary records in versions 1.0.0 through 3.0.0. The allowEdit() method in ApiController.php is hardcoded to return true, defeating Joomla's component- and asset-level permission model (CWE-284). The vendor rates this high severity (CVSS 8.6), though our independent assessment confirms the attack requires an existing backend account and is not exploitable by unauthenticated visitors; no public exploit identified at time of analysis.
Missing authorization in Formie's IntegrationsController::actionFormSettings control panel action lets any authenticated user (no integration permission required) override outbound host properties such as apiUrl on an already-configured integration, causing the server to send stored API keys or OAuth tokens to an attacker-controlled or internal host and return the remote response in the JSON body. This is a non-blind SSRF combined with credential exfiltration affecting verbb/formie versions before 2.2.23 (Craft 4) and 3.0.0 through 3.1.30 (Craft 5); patched releases are 2.2.23 and 3.1.31. Authentication with any level of access is required, so exposure is greatest on sites permitting low-privileged or front-end/member authentication (including public self-registration), and a CRM, email-marketing, or webhook integration must already be configured with stored credentials for exfiltration to be meaningful; no public exploit code was identified at time of analysis, and the flaw is an incomplete remediation of GHSA-cvpc-hccg-wmw4, whose 3.1.28 permission gate omitted this action.
Missing object-level authorization in the JobTemplate copy endpoint (CopyAPIView) of AWX and Red Hat Ansible Automation Platform 2 lets an authenticated user duplicate a JobTemplate they are not permitted to read, disclosing the template's configuration - playbook reference, associated credentials, inventory and extra variables - that RBAC was intended to protect. The root cause is CWE-862 (Missing Authorization): the copy view's GET path enforces a read check on the source object, but the POST path that performs the copy only validates add and copy-related permissions, none of which imply read access on the source template. Per the independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N; vendor score 8.5), exploitation requires an authenticated account already holding inventory.use_role, project.use_role, execution_environment.read_role and credentials.use_role, so this is an insider/multi-tenant privilege-boundary flaw rather than unauthenticated remote compromise; no public exploit code was identified at time of analysis.
SQL injection in the WP EasyCart plugin for WordPress (versions up to and including 5.9.4) allows authenticated attackers with Contributor-level access or higher to execute arbitrary SQL queries, potentially leading to the disclosure of sensitive data from the WordPress database. Exploitation is remote, requires low-privilege authentication (PR:L), and no user interaction; the confidentiality impact is high, with low integrity and availability impacts. No public exploit code has been identified at the time of analysis, and the vulnerability is not known to be actively exploited.
SQL injection in the Mollie Forms WordPress plugin (versions up to and including 2.11.0) lets a remote attacker who holds an authenticated Contributor-level account on the target site inject arbitrary SQL through plugin-supplied input, potentially exposing sensitive data stored in the WordPress database. The issue is network-reachable with low attack complexity and requires no user interaction, but exploitation is gated by the need to first obtain Contributor credentials, so sites that disable open registration or tightly control Contributor accounts are substantially less exposed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no vendor-released fixed version is stated in the available data. Reported by Patchstack and tracked as EUVD-2026-85467; the independent assessment rates the impact as high confidentiality with limited integrity and availability effects under an unchanged-scope vector.
SQL injection in the Live Copy Paste for Elementor WordPress plugin (bdthemes, versions up to and including 1.5.10) allows an authenticated attacker holding at least Contributor-level credentials to inject arbitrary SQL through a network-reachable plugin endpoint, resulting in high-impact confidentiality exposure (database contents, including user and configuration data) and a limited availability effect. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided. The vendor-published vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, 8.5) is treated in our independent assessment as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, with the same base 8.5 and the same Contributor-authentication prerequisite, so real-world exposure is concentrated on multi-author sites that permit Contributor registration or low-privileged content workflows.
Arbitrary file upload in Microweber Administration Panel allows an authenticated high-privileged administrator to upload unrestricted files, including executable server-side scripts, resulting in remote code execution and complete system compromise. The vulnerable upload forms are administrative features and require prior administrator-level access, so exploitation is not unauthenticated. There is no public exploit identified at time of analysis; the reported EICAR test-file demonstration underscores the missing validation but is not equivalent to active exploitation.
Incomplete cleanup of sensitive resources in Google Chrome prior to 154.0.8037.57 (CWE-459) can expose data that should have been discarded, giving an attacker with local access to the affected system a way to read information they should not be able to reach. The vendor-tracked base score is 8.4, but our independent assessment re-scores the impact as confidentiality-only (C:H/I:N/A:N) and emphasizes the local attack vector (AV:L) - despite the PR:N/UI:N components in the vector, this is not a remote drive-by against a default browser install, and realistic exploitation requires local presence or the ability to execute within the browser/host context. EPSS is low at 0.25% (15th percentile), no public exploit code has been identified at time of analysis, and a vendor patch shipped in Chrome 154.0.8037.57, so real-world urgency is lower than the 8.4 base score implies.
A missing-authorization flaw (CWE-862) in Google Chrome desktop builds prior to 154.0.8037.57 can be triggered by an unauthenticated local attacker with no user interaction, and the assessed CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) rates confidentiality, integrity and availability impact as high, consistent with the 'Authentication Bypass' tagging applied by the reporting vendor. The local attack vector and absence of a user-interaction requirement mean the attacker must already have some form of local execution context on the target host, which sharply constrains mass remote exploitation; no public exploit code has been identified at time of analysis and EPSS is low at 0.24% (13th percentile). Exploitation is limited to unpatched builds and is fully mitigated by the vendor-released fix in Chrome 154.0.8037.57, so this should be handled as a moderate-priority patch rather than an emergency, though the 8.4 score and high CIA impact still warrant prompt update cycles.
Authentication bypass in Google Chrome prior to 154.0.8037.57 allows an attacker with local access to the machine to slip past an authorization check in a browser component, yielding high confidentiality, integrity, and availability impact. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N) means no privileges and no user interaction are needed once local access exists, so the realistic prerequisite is the ability to execute or otherwise interact with the vulnerable Chrome component on the host rather than reaching it over the network; a purely remote, unauthenticated web-based attack is not supported by the available data. Exploitation signals are currently weak and non-urgent: EPSS is only 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis, while the vendor has shipped a fixed build. Note that the affected feature or component is not named in the available data because no vendor description was published, so the exact local precondition should be confirmed against the Chrome release advisory.
Google Chrome desktop builds earlier than 154.0.8037.57 are affected by an improper input validation flaw (CWE-20) rated CVSS 8.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), in which an unauthenticated remote attacker who persuades a user to load attacker-controlled web content can potentially achieve high confidentiality, integrity and availability impact that crosses a browser security boundary. Although the public tagging labels this issue as information disclosure, the assessed vector indicates broader high impact across all three CIA dimensions combined with a scope change (S:C), consistent with escaping the Chrome renderer sandbox. Exploitation is constrained by mandatory user interaction and high attack complexity, no public exploit has been identified at time of analysis, and Google has already shipped the fix in the stable channel, so auto-updating installations are remediated on restart.
Use-after-free in Google Chrome desktop versions prior to the September 2026 stable channel update allows remote attackers to cause information disclosure and memory corruption when a victim loads attacker-controlled web content. Exploitation requires user interaction (UI:R) and a high-complexity timing or heap-state precondition (AC:H), but no authentication (PR:N); the assessed CVSS vector is AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, yielding a base score of 8.3. A vendor patch is available in the September 2026 stable channel update, and no public exploit code or active exploitation has been identified in the provided intelligence.
Use-after-free in Google Chrome before 154.0.8037.57 can be triggered when a victim visits attacker-controlled web content, potentially allowing a remote unauthenticated attacker to corrupt memory and escape the renderer sandbox to execute code or disclose information. The vendor-assigned CVSS 3.1 score is 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting mandatory user interaction and high attack complexity. Vendor-released patch: 154.0.8037.57; no public exploit was identified at time of analysis.
Improper output encoding in Google Chrome before the 154.0.8037.57 stable release allows a remote attacker to break out of the intended data context when a victim opens or interacts with an attacker-controlled web page, resulting in cross-boundary confidentiality and integrity impact according to the assessed CVSS vector (S:C/C:H/I:H/A:H). No authentication or pre-existing privileges are required (PR:N), but exploitation demands user interaction (UI:R) and non-trivial attacker-controlled preconditions (AC:H), which materially limits reliable, high-volume exploitation; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. Google has shipped a vendor patch, so upgrading the browser is a direct and effective fix rather than a mitigation-only situation.
Use-after-free memory corruption in Google Chrome desktop builds prior to 154.0.8037.57 allows remote attackers to achieve high-integrity and high-confidentiality impact against a victim who loads attacker-controlled web content and performs some interaction with it, but exploitation is not trivially repeatable: with AC:H it depends on winning a race or reliably grooming heap layout rather than a single deterministic trigger. The flaw is reachable without authentication (PR:N) and the vector's scope change (S:C) indicates the assessed impact crosses a component boundary, yet no public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this should be treated as a high-priority patching item rather than a confirmed in-the-wild threat. A vendor patch is available.
Ubuntu Linux is the only product attributable to CVE-2026-95319, and the sole intelligence signal available is a vendor:ubuntu report with no accompanying advisory text, version range, or affected component. No description, CVSS score, CVSS vector, CWE classification, CPE string, EPSS score, KEV status, or reference link was supplied, so the vulnerability class, attack vector, privilege requirements, and impact cannot be characterized. No public exploit code has been identified at time of analysis, but this reflects absent data rather than a confirmed absence of exploitation, and the entry must be treated as unassessable until the upstream NVD or Ubuntu security advisory is retrieved.
Google Chrome versions prior to 154.0.8037.57 contain an incorrectly-resolved name or reference flaw (CWE-706) that remote, unauthenticated attackers can trigger by convincing a user to load attacker-controlled web content; the issue is rated CVSS 3.1 8.3 High with scope change (S:C) and high confidentiality, integrity and availability impact. Exploitation is gated by mandatory user interaction (UI:R) and high attack complexity (AC:H), requiring non-trivial prerequisites such as specific timing, memory grooming or a race condition, and no public exploit code has been identified at time of analysis. Google has already shipped a stable-channel fix in Chrome 154.0.8037.57, so patched or auto-updated browsers are not exposed.
Out-of-bounds write (CWE-787) in Google Chrome permits a remote, unauthenticated attacker to corrupt memory in the browser when a victim opens or is redirected to attacker-controlled web content (UI:R), with high confidentiality and integrity impact and a scope change (S:C) that the independent assessment reads as the corruption crossing the renderer sandbox boundary. Exploitation is not turnkey: the high attack complexity (AC:H) reflects a precondition the attacker must satisfy - typically heap grooming, a race, or a specific object/memory state - before the write is reachable, which constrains reliability and mass exploitation. No public exploit identified at time of analysis, and the fixed build 154.0.8037.57 is already shipping, so exposure is limited to un-updated Chrome clients, making this a genuine high-priority browser issue rather than a top-tier emergency.
Improper input validation in Google Chrome before 154.0.8037.57 allows unauthenticated remote attackers to achieve high confidentiality, integrity, and availability impact with a scope change, though exploitation requires the victim to visit attacker-controlled web content and overcome high attack complexity. The flaw, tracked as CVE-2026-95341 with a CVSS 8.3 base score, affects default installations of Chrome on all platforms and could permit renderer-level code execution or sandbox escape; no public exploit identified at time of analysis. Vendor-released patch 154.0.8037.57 addresses the issue.
Use-after-free memory corruption in Google Chrome desktop (Stable channel below 154.0.8037.57) allows remote attackers to corrupt browser memory and reach code-execution-class impact when a victim browses an attacker-controlled page. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) and carries high attack complexity (AC:H) because reliable reuse of the freed object depends on heap grooming or an allocation/timing race; the S:C scope change with C:H/I:H/A:H indicates the compromise can extend beyond the browser's original security context toward a sandbox escape. CVSS 3.1 base score is 8.3 (HIGH); no public exploit code was identified at time of analysis, and a vendor fix is available as Chrome 154.0.8037.57.
An authorization-bypass flaw in Google Chrome desktop builds prior to 154.0.8037.57 lets remote attackers escape a security boundary by having the victim load crafted web content in the browser. Successful exploitation crosses a sandbox boundary (S:C) and can compromise confidentiality, integrity and availability of the affected system, but the CVSS vector (AC:H, UI:R) means the attacker must satisfy specific timing or memory-state conditions and the user must actively visit or interact with the malicious page. No confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and a vendor patch is available, so prioritization should reflect a high-severity but hard-to-trigger client-side issue rather than an imminent mass-exploitation event.
Use-after-free memory corruption in Google Chrome before 154.0.8037.57 allows a remote, unauthenticated attacker to potentially escape the browser's renderer sandbox by persuading a victim to visit attacker-controlled web content. Exploitation requires mandatory user interaction (UI:R) and a high-complexity precondition such as precise heap grooming or a timing race (AC:H), and no public exploit has been identified at time of analysis. Google has issued a vendor-released patch in version 154.0.8037.57 that removes the vulnerable code path.
Improper input validation in Google Chrome before 154.0.8037.57 can be triggered when a victim loads attacker-controlled web content, yielding a scope-changed impact rated high for confidentiality, integrity, and availability (CVSS 8.3). Exploitation is network-reachable without credentials (PR:N) but demands victim interaction (UI:R) plus non-trivial preconditions such as specific memory state, heap grooming, or timing windows (AC:H), and the affected component is undisclosed because chromium issue 517730821 is access-restricted. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available in the Chrome stable channel at 154.0.8037.57.
Every desktop application generated by Pake inherits two upstream template defaults that together hand native IPC functionality to untrusted web content, allowing scripts served from any HTTPS origin to invoke the application's own native commands, including download_file. The root cause is a wildcard Tauri capability ("remote": { "urls": ["https://*.*"] } in src-tauri/capabilities/default.json) paired with "withGlobalTauri": true in src-tauri/tauri.conf.json, which places window.__TAURI__.core.invoke() within reach of ordinary page JavaScript; because Tauri's access control list only validates plugin: commands and not commands registered by the application itself via generate_handler!, no permission entry is required to call them. Exploitation is unauthenticated per the assessed vector (PR:N) but requires user interaction (UI:R) - the victim must run the generated app and attacker-controlled JavaScript must execute inside it, whether directly or through third-party analytics, advertising, or a compromised CDN loaded by the wrapped site. Chained with the path traversal tracked separately as CVE-2026-82635, this escalates to arbitrary file write and persistent code execution; no public exploit identified at time of analysis, and the issue is fixed in Pake V3.17.0.
Unauthenticated remote attackers can read other customers' order records - including billing addresses, customer details, and purchased downloadable files - on Isotope eCommerce installations through 2.9.10 that accept guest orders, because order identifiers are generated from PHP's time-seeded uniqid() function and the guest order-details module performs no ownership verification. Exploitation requires guessing a valid uid value, which is why the flaw carries high attack complexity rather than being trivially scriptable, but no authentication or user interaction is needed. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the practical exposure is a bounded but genuine confidentiality risk confined to shops exposing guest checkout.
Memory-exhaustion denial of service in RabbitMQ's Web-MQTT plugin (rabbitmq_web_mqtt) lets an unauthenticated remote attacker crash a broker node by sending a single WebSocket frame that is highly compressed and inflates to gigabytes in memory. Affected are RabbitMQ server releases prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6 and 4.3.0 whenever the Web-MQTT plugin is enabled and its listener (TCP 15675/15676) is network-reachable; the attacker only needs to negotiate RFC 7692 permessage-deflate during the upgrade and then send a zlib bomb, since decompression happens in the connection process before any MQTT CONNECT credentials are evaluated. No public exploit code was identified at time of analysis, exploitation requires the non-default plugin to be enabled, and the impact is availability-only (C:N/I:N/A:H) against the affected node. Vendor-released fixes are available in 3.13.15, 4.0.20, 4.1.11, 4.2.6 and 4.3.0.
Unauthenticated remote attackers can crash any RabbitMQ node with the AMQP 1.0 listener enabled by sending a single ~19-byte frame to TCP port 5672, causing the Erlang VM to exhaust heap memory and terminate, which takes down all tenants and protocols on that node. The flaw is an unbounded-allocation bug (CWE-770) in the AMQP 1.0 framing code that is reached before authentication completes, so no credentials or user interaction are required; only network reachability to the broker's AMQP 1.0 port is needed. Affected releases are RabbitMQ prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, which contain the vendor-released fix; no public exploit code has been identified at time of analysis, and the issue is scored high severity (CVSS 8.2 v4.0 / assessed CVSS 3.1 7.5) with availability-only impact.
Unauthenticated attackers can overwrite or hijack other users' in-progress multi-page or save-for-later submissions in the Craft CMS Formie plugin by enumerating sequential submission IDs against the anonymous formie/submissions/submit endpoint, which trusted a client-supplied submissionId with no session binding, ownership check, or edit-token validation (CWE-639, CVSS 3.1 base 8.2, vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N, so no authentication or user interaction is required). Affected installations are Formie 3.0.0 through 3.1.30 on Craft 5 and all versions before 2.2.23 on Craft 4; completed submissions are unaffected because the vulnerable code path only loads records with isIncomplete=true, meaning exposure requires the site to actually use multi-page forms or save-for-later. Exploitation status: no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; vendor-released patches exist (3.1.31 for Craft 5, 2.2.23 for Craft 4).
Unauthenticated remote attackers can manipulate SQL database queries in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, giving them a high-integrity impact with limited confidentiality and availability effects on affected payments-processing deployments. The flaw is a boolean-based blind SQL injection rooted in improper neutralization of special elements in a boolean expression (CWE-74), exploitable over the network with low complexity and no authentication or user interaction per the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (base 8.2). No public exploit code has been identified and there is no confirmation of active exploitation; IBM has published a vendor advisory containing patch guidance, but affected version ranges are expressed as a wildcard CPE, so defenders must match their specific build against IBM's advisory to determine exposure.
Unauthenticated attackers can spoof the client IP address that the divi-dash WordPress plugin (versions before 1.0.7) relies on for rate limiting and banning, allowing them to bypass throttling, ban arbitrary addresses of their choosing, and grow a stored WordPress option without bound until the site suffers denial of service. The flaw is rated CVSS 3.1 base 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), with the score driven almost entirely by the high availability impact from unbounded wp_options growth and the loss of effective rate limiting. Neither CISA KEV nor any public exploit code was identified at time of analysis (SSVC exploitation: none), and a vendor patch is available.
Unauthenticated attackers can permanently lock any user account - including an administrator's - out of WordPress sites running WP Recipe Maker versions 9.8.0 through 10.8.1. The plugin exposes a REST route that performs no authorization check and imposes no size limit on the data it writes, so an anonymous request can push unlimited content into a target user's metadata until that account can no longer load. Exploitation requires only that a vulnerable plugin version be installed on a default configuration; no credentials or user interaction are needed, and no public exploit code has been identified at time of analysis. The result is a denial-of-service lockout with possible limited integrity impact from metadata tampering, not a privilege escalation or data disclosure.
Incorrect permission assignment in the cPanel CalDAV/CardDAV service (CCS Calendar and Contacts) allows an authenticated low-privilege cPanel account on a multi-tenant or shared-hosting server to read calendar and contact data belonging to other hosting accounts. Exploitation requires an existing local foothold with a valid cPanel login on the same server (CVSS 4.0 AV:L/PR:L) and produces a confidentiality-only impact with a scope change, since the data exposed belongs to separate accounts rather than the attacker's own; integrity and availability are unaffected. There is no public exploit identified at time of analysis and the issue is a local permission-assignment defect rather than a remotely reachable flaw, so single-tenant deployments with only one account have no 'other accounts' to disclose and are effectively not exposed.
Unauthenticated PII harvesting in the JoomShaper Easy Store extension for Joomla (versions 1.0.0 through 3.0.0) allows anyone to retrieve guest checkout records by submitting an email address to the checkout.searchGuestUser endpoint, which returns full name, phone number, street address, city, postal code and country directly from the #__easystore_guests table with no authentication, session validation or ownership check. Attackers can script the endpoint against purchased or scraped email lists to enumerate guest customers and compile sensitive personal data at scale, with no user interaction required. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but the attack is trivially reachable; yield depends on email-list quality and on whether a given site has actually used guest checkout, since only matching guest emails return data.
Unauthenticated remote attackers can stall job dispatch for every tenant on Red Hat Ansible Automation Platform 2 by repeatedly calling four debug scheduler views that are routed in production builds because their URL include is not gated on the debug setting. Each call lets any network-reachable client acquire the cluster-wide scheduler advisory lock, and since the legitimate scheduler takes that same lock without waiting, genuine scheduler runs are skipped, job dispatch is delayed or halted, and controller web workers are consumed. The debug root view also discloses the list of debug endpoints to unauthenticated callers, and no public exploit code has been identified at time of analysis.
Missing authorization enforcement in Google Chrome builds earlier than 154.0.8037.57 (classified CWE-862 and tagged as an authentication bypass) lets an attacker defeat an access-control decision in the browser, with the impact scored as high confidentiality and high integrity loss (CVSS 3.1 base 8.1, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). The flaw is network-delivered and requires no authentication or prior privileges, but exploitation is not silent: the victim must navigate to or render attacker-controlled web content (UI:R), which keeps the practical attack path dependent on user browsing behavior rather than on a remotely reachable service. Google has shipped the fix in Chrome 154.0.8037.57 and the issue is tracked as ENISA EUVD-2026-89222 / Chromium issue 540265100; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so there is no confirmed active exploitation.
Authentication bypass and sensitive-information disclosure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift stem from a hard-coded cryptographic key (CWE-321) embedded in the product, scoring 8.1 (High) with the vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Because the key is embedded and therefore shared across deployments, an unauthenticated attacker who is positioned on the same adjacent network as an affected OpenShift deployment can bypass authentication and read or tamper with sensitive financial-transaction data, with no user interaction required; the assessment notes this is not confirmed as directly reachable from the public internet despite the description's 'remote attacker' phrasing. A vendor patch is available, and no public exploit code has been identified at time of analysis.