Server-side template injection in the Configlet processing feature of ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager (versions 12.8.667 and below) allows a low-privileged authenticated user to inject template expressions that the server evaluates, leading to remote code execution in the application's process context. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; the source data lists 7.6) confirms network reachability, low privileges, and no victim interaction, but valid application credentials plus access to the Configlet/template capability are prerequisites, so real-world exposure is reduced where the console is network-restricted or where accounts lack configuration-template rights. No public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; this is a genuine mid-to-upper priority issue but not an emergency.
Denial of service in FasterXML jackson-databind allows unauthenticated remote attackers to exhaust CPU resources by submitting crafted JSON that triggers quadratic complexity in forward-reference resolution for @JsonIdentityInfo object IDs. The attack requires the application to deserialize attacker-influenced JSON into a collection or map configured with @JsonIdentityInfo; a shallow document with N forward references defined in reverse order causes O(N^2) identity comparisons during deserialization. This is a conditional availability risk-only applications using identity-enabled deserialization on untrusted input are exposed-and no public exploit code has been identified at time of analysis, though a vendor patch is available.
Memory exhaustion in FasterXML jackson-databind allows unauthenticated remote attackers to grow an internal deserializer cache without bound by submitting JSON payloads that carry ever-changing, unrecognized polymorphic type IDs. TypeDeserializerBase caches each fallback resolution keyed by the raw attacker-supplied ID string, the map has no configurable size limit, and it lives for the lifetime of the long-lived ObjectMapper, so distinct unknown IDs translate directly into permanently retained heap - the reporter measured 10,000 retained entries from 10,000 distinct unknown IDs versus a single entry for 10,000 repetitions of one unknown ID. Exploitation requires a non-default configuration (name-based polymorphism via @JsonTypeInfo(use = Id.NAME) with a defaultImpl/fallback deserializer, an endpoint that accepts attacker-influenced type IDs, and a shared application-scoped mapper), so the affected population is substantially narrower than the 7.5 base score suggests; no public exploit has been identified at time of analysis and a vendor patch is available.
A crafted oversized input to the PgBouncer connection pooler (versions through 1.25.2) triggers an integer overflow in packet buffer growth logic, leaving the growth loop unable to terminate and pinning a CPU core permanently because all clients are served from a single process. Per the assigned CVSS vector (AV:N/AC:L/PR:N/UI:N) this is reachable by an unauthenticated remote attacker with only network access to the pooler's listening port, and both unauthenticated and authenticated code paths can reach the flawed computation; there is no confidentiality or integrity impact, but the pooler stalls every pooled connection until the process is killed. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied; the practical risk is therefore availability-only and depends on whether the PgBouncer port is exposed to untrusted networks rather than firewalled to trusted application hosts.
Denial of service via JVM crash affects Apache Tomcat Native versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8, where a buffer over-read (CWE-126) during the TLS handshake lets a malicious client terminate the server process, rated CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The flaw is reachable remotely and unauthenticated with no user interaction, but only where the APR/OpenSSL-based native TLS connector is actually deployed and handling TLS connections; Tomcat instances using the pure-Java JSSE/NIO connector are not affected. Impact is confined to availability - no confidentiality or integrity loss, no data exposure and no code execution - and no public exploit was identified at time of analysis, with no CISA KEV entry.
Unauthenticated remote attackers can crash PgBouncer through 1.25.2 by sending a malformed SCRAM client-final-message that triggers a NULL pointer dereference. The crash occurs before credential verification and terminates all pooled connections because PgBouncer uses a single process. No public exploit identified at time of analysis; exploitation requires PgBouncer configured with SCRAM authentication (auth_type=scram-sha-256) and network access to the listener port.
Denial of service in JLine's built-in less viewer affects all 3.x releases from 3.0.0 before 3.30.15 and 4.x releases before 4.3.1: a user-supplied search or display-filter pattern containing nested quantifiers is handed straight to Java's backtracking regex engine and applied repeatedly across file content, so a pattern run against non-matching lines can consume excessive CPU and block the session thread indefinitely. The practical risk profile is multi-user Telnet or SSH deployments that embed the less viewer, where repeated sessions can exhaust a bounded worker pool and deny service to other users; the independent assessment scores this as availability-only (CVSS 3.1 A:H, no confidentiality or integrity impact) and notes that an interactive session foothold and viewable file content are prerequisites, which the published vector's PR:N rating does not reflect. No public exploit code and no confirmed active exploitation were identified at time of analysis, so exploitation is opportunistic rather than observed. The fix is the SafeRegex wrapper plus regex timeouts shipped in 3.30.15 and 4.3.1.
Unauthenticated path traversal in the OpenShift console's /locales/resource.json endpoint allows remote attackers to read arbitrary *.json files from the console pod filesystem by manipulating the lng and ns query parameters, exposing plugin manifests and configuration files, and potentially enabling traversal against registered dynamic-plugin backends. The flaw is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) and affects Red Hat OpenShift Container Platform 4; no public exploit code has been identified at time of analysis and there is no CISA KEV telemetry, but per the independent assessment this remains a credible remote-attack priority because the endpoint is reachable without credentials and yields high-confidentiality reads. Impact is limited to information disclosure - integrity and availability are not affected per the assessed vector.
Information exposure in Dell Secure Connect Gateway (SCG) Policy Manager affects all deployments running versions prior to 5.34.00.16, where sensitive data is embedded directly in shipped source or client-delivered code (CWE-540) and can be recovered and read by a remote party that obtains those artifacts. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 7.5 HIGH, describing a network-reachable, low-complexity, unauthenticated confidentiality-only flaw with no integrity or availability impact (PR:N in the vector confirms no authentication is required). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so risk is driven by the value of whatever secrets are baked into the code and by the product's niche enterprise/appliance footprint rather than by observed attack activity.
Imprivata Enterprise Access Management at version 26.2.6 and earlier ships with no capability to rotate the RSA key pair it uses when generating X.509 certificates, so the same static private key can remain in service indefinitely. An attacker cannot exploit this over the network to steal data on its own; the exposure only materializes if that long-lived key is separately obtained through theft, insider access, or eventual cryptanalysis, after which past and future certificate-based trust relationships could be undermined. There is no public exploit identified at time of analysis and no evidence of active exploitation, and EPSS rates the issue at roughly 0.07 percent (0th percentile), consistent with this being a cryptographic lifecycle and hygiene deficiency rather than a directly exploitable remote flaw.
Unauthenticated remote attackers can read protected data from WordPress sites running the Tangible Loops & Logic plugin at version 4.2.4 or earlier, because the plugin fails to enforce proper authorization on a reachable feature (CWE-862 broken access control). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 HIGH) confirms the flaw is network-reachable with no authentication, no privileges, and no user interaction, and the impact is limited to confidentiality - no modification or availability effect is possible. Exploitation requires only that the plugin be installed and active; there is no public exploit identified at time of analysis, and exposure is bounded because the plugin is a niche, developer-oriented templating tool rather than a widely deployed one.
Unauthenticated broken access control in the Online Booking & Scheduling Calendar for WordPress by vcita plugin (slug meeting-scheduler-by-vcita) through version 4.6.0 lets remote attackers reach protected plugin functionality without logging in and use it to modify data or settings, with the assessed vector (AV:N/AC:L/PR:N/UI:N) showing no privileges or user interaction required. Impact is limited to integrity (C:N/I:H/A:N) - booking, scheduler, or configuration data can be altered, while confidentiality and availability are not reported as affected. No CISA KEV entry is present and no public exploit identified at time of analysis; the advisory does not disclose the specific endpoint or action, which currently raises the effort of exploitation even though the vulnerability is remotely reachable.
Pre-authentication heap memory corruption in BusyBox's built-in TLS implementation can be triggered by a remote, unauthenticated attacker who sends a single crafted ClientKeyExchange handshake message to a BusyBox process acting as a TLS server, corrupting the heap and crashing the process (CVSS 3.1 base 7.5, availability-only with no confidentiality or integrity impact rated). Exploitation requires a BusyBox binary compiled with TLS support and reachable in a server role, a deployment pattern that is the exception rather than the norm since BusyBox TLS is most often used outbound (for example by wget https), which sharply narrows the realistically exposed population. No public exploit code or confirmed active exploitation (CISA KEV) was identified in the available intelligence; the issue is tracked by Red Hat via its CVE page and Bugzilla, with no public exploit identified at time of analysis.
Unauthenticated path traversal in ManageEngine OpManager and ManageEngine Network Configuration Manager versions before 12.8.671 allows remote attackers to read arbitrary files from the appliance. Because the CVSS vector is PR:N/UI:N (7.5, AV:N/AC:L), no credentials or user interaction are required against a default-reachable deployment - an attacker with network access to the web console can directly request files outside the intended document root and expose configuration, credential, or key material. Impact is confidentiality-only (C:H with I:N/A:N), so the flaw does not permit modification of data or cause denial of service. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); the main limiting factor is exposure, since these are typically internal management consoles rather than internet-facing services.
Denial of service in Apache Tomcat's asynchronous WebSocket write path allows remote, unauthenticated attackers to exhaust server resources by triggering lost write timeouts, so non-blocking WebSocket sends are never released after their effective lifetime. All maintained branches are affected - 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121, plus the end-of-life 8.5.0-8.5.100 and 7.0.43-7.0.109 lines - although exposure is bounded to instances whose deployed applications actually perform asynchronous (non-blocking) WebSocket writes; servers with no WebSocket endpoints or only synchronous writes are not exposed. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only) and CISA's SSVC assessment records no observed exploitation, with no public exploit code identified at time of analysis; the primary risk is sustained resource pressure that degrades or halts the affected connector rather than data compromise.
Denial of service in Apache Tomcat allows an attacker to pin an AJP processing thread through a single AJP request, exhausting the connector's limited thread pool (CWE-770, allocation of resources without limits or throttling). The affected range is broad: 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, plus the end-of-life branches 8.5.0-8.5.100 and 7.0.0-7.0.109, which remain affected even though they are no longer supported. There is no public exploit identified at time of analysis, no KEV listing, and no EPSS score in the input; the independent assessment rates the issue CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (availability-only impact), but exploitation requires the AJP connector to be enabled and network-reachable, which has not been the default configuration since Tomcat 9.0.31.
Uncontrolled resource consumption in Apache Tomcat's WebSocket close-message handling allows unauthenticated remote attackers to exhaust server resources and degrade availability on instances that expose WebSocket endpoints. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), the impact is limited to availability (Low) with no confidentiality or integrity effect, and no user interaction is required. Affected releases are 11.0.0-M5 through 11.0.25, 10.1.8 through 10.1.59, 9.0.74 through 9.0.121, plus the end-of-life 8.5.88 through 8.5.100 line; fixes are available in 11.0.26, 10.1.60, and 9.0.122. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, but the low attack complexity and unauthenticated network reachability make prompt patching advisable for any deployment using WebSockets.
Google Chrome stable builds earlier than 154.0.8037.57 contain a race condition (CWE-362) that a remote attacker can trigger by getting a victim to load attacker-controlled web content, yielding high confidentiality, integrity, and availability impact within the browser's renderer sandbox. No authentication or special browser configuration is required (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), though user interaction - visiting or rendering hostile content - is the primary exploitation prerequisite, and a separate sandbox escape would be needed to reach the host. Exploitation status: no public exploit identified at time of analysis, and there is no CISA KEV listing; the vendor has shipped a fixed release.
WatchGuard AuthPoint Gateway contains a missing authentication check in its LDAP Sync first-factor authentication that allows unauthenticated remote attackers to bypass single-factor password verification under non-default conditions. Exploitation requires the gateway to be configured with LDAP Sync as the first-factor method and involves some user interaction, but default deployments are unaffected; only the first factor is bypassed, so any additional MFA factors still apply and prevent full account compromise. No public exploit has been identified at time of analysis, and the vendor (WatchGuard PSIRT) rates this as CVSS 4.0 7.4 High with vector AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N.
Cross-site scripting in LimeSurvey's administrative survey-import workflow lets an attacker run arbitrary JavaScript in a logged-in administrator's session by getting that administrator to import a crafted .lss survey file, allowing theft of session context and modification of survey or administrative data. The issue is rated 7.4 (HIGH) under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N) - the attacker needs no LimeSurvey account (PR:N), but success depends entirely on a privileged admin actively importing the malicious file (UI:A), making this a social-engineering-gated attack rather than direct remote exploitation. There is no indication of CISA KEV listing and no public exploit code was identified at time of analysis; an upstream fix is available from the vendor.
Malformed 3G/UMTS RRC signalling messages delivered to the ASR Crane/Falcon cellular baseband trigger a NULL pointer dereference in the as_rrc module (file 3g.mod/lib/src/urrsir.c), crashing the modem and denying cellular service to the affected device. ASR's self-assigned CVSS 3.1 score is 7.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L), whereas independent assessment rates it AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - a radio-proximity availability attack against 3G-capable ASR modem platforms, with no demonstrated code execution or data compromise. Exploitation requires the victim handset to be camped on or processing signalling from a hostile 3G cell (rogue base station or air-interface man-in-the-middle), and no public exploit code has been identified at time of analysis; the CVE is not listed in CISA KEV and the sole reference is the vendor PSIRT advisory.
Address bar spoofing in Arc Browser lets remote, unauthenticated attackers paint a convincing fake address bar over the genuine browser chrome by embedding a <select> element on an attacker-controlled page that invokes the Fullscreen API; because Arc fails to display the expected fullscreen notification, the victim never gets the visual cue that would normally reveal the browser is in a special display state. Exploitation is gated on user interaction - the victim must open the malicious page and engage with the select element - and the outcome is deception/phishing rather than code execution or direct data access, which is why the authoritative assessment lowers the integrity impact to I:L instead of the I:H in the widely-cited 7.4 vector. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Missing authentication for a critical function in Dell Secure Connect Gateway (SCG) Policy Manager before version 5.34.00.16 allows remote attackers to reach functionality that should require a credential check, resulting in unauthorized access with high confidentiality and integrity impact. The assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (7.4) confirms no privileges and no user interaction are required, while the high attack-complexity rating indicates a non-trivial precondition must be satisfied rather than a guaranteed single-request compromise. Real-world risk is bounded by exposure: the Policy Manager interface must be network-reachable, and SCG is a specialized enterprise gateway typically deployed in restricted management networks; no public exploit was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
XML external entity (XXE) injection in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an unauthenticated attacker positioned on an adjacent network segment to submit crafted XML that the product's parser resolves against external entities, resulting in disclosure of server-side files or server-side request forgery against internal services. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 7.4 High) requires no credentials and no user interaction, but the adjacent-network attack vector and the confidentiality-only impact mean exploitation depends heavily on whether an XML-accepting endpoint is reachable from an untrusted same-segment network and on what sensitive files or internal services are reachable from the server context. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), and IBM has published a patch advisory; despite the High score this is a moderate-priority issue that should not be over-prioritized relative to internet-reachable, integrity- or availability-impacting flaws.
UI spoofing in Arc Search for Android before 1.12.10 lets an unauthenticated remote attacker use a crafted webpage that enters fullscreen while the app is backgrounded to suppress the return-from-background fullscreen notification and render fake browser UI, such as a spoofed address bar. The victim must visit the attacker-controlled page and be deceived by the spoofed origin, so exploitation requires user interaction and carries no confidentiality or availability impact, though integrity impact is high for phishing. No CISA KEV listing or public exploit code was identified at time of analysis; CVSS 3.1 base score is 7.4 (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).
Apache Tomcat Native 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15 can, under a narrow timing window, down-grade the client-certificate verification requirement for connections, weakening mutual-TLS authentication for deployments that enforce client-cert auth through the APR/OpenSSL-based connector. The flaw is a CWE-366 race condition within a thread (CVSS 3.1 base 7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), so an unauthenticated network attacker must win a non-deterministic race to succeed, making exploitation probabilistic rather than guaranteed. Only Tomcat instances that actually use Tomcat Native and are configured for client-certificate verification are exposed; no public exploit identified at time of analysis, and no CISA KEV confirmation of active exploitation. Vendor-released fixes are available in 2.0.16 and 1.3.9.
Local privilege escalation to root in Flatpak before 1.18.1 lets an unprivileged user holding an active local session abuse the revokefs writer used by flatpak-system-helper: by opening two concurrent revokefs sessions and planting a symlink from one session directory into the other, the attacker retains a file descriptor into a peer session and keeps modifying its files after the system helper has already validated and imported them. The practical payoff is tampering with ostree commit objects in the system repository after signature verification, which translates into root-controlled writes to attacker-chosen paths. Exploitation requires local access and winning a TOCTOU race against the dual-session setup (CVSS AV:L/AC:H/PR:N), and no public exploit code has been identified at time of analysis; the issue is not confirmed as actively exploited (not in CISA KEV).
Reflected cross-site scripting (XSS) in LimeSurvey Community Edition 7.0.14 allows an attacker to execute arbitrary JavaScript in an authenticated administrator's browser when the admin imports a crafted CSV file of survey participants. The payload is reflected on the import result page via unencoded invalid attribute field names or duplicate record fields (firstname, lastname, email), requiring the attacker to social-engineer an admin into importing the malicious file. No public exploit code has been identified at time of analysis, and this is not confirmed as actively exploited; the impact is bounded to code execution within the victim admin's browser context, potentially enabling session hijacking or actions on behalf of the admin.
Data exposure in ManageEngine Firewall Analyzer - and in the co-listed ManageEngine OpManager - version 12.8.709 and below allows an unauthenticated attacker positioned on the same network segment as the Firewall Analyzer syslog collector to read sensitive information, including data belonging to the monitored firewall and network devices, which is why the vendor score carries a scope change despite the confidentiality-only impact. No authentication or user interaction is required and complexity is low (CVSS 3.1 7.4, AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N); the adjacent-network requirement is the principal limiting factor, since the collector is not reachable directly from the internet unless its syslog service has been exposed beyond the local segment. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) in the supplied intelligence, which consists solely of a vendor advisory and CPE mappings, and no EPSS score was provided.
Stored cross-site scripting in the RabbitMQ management UI allows an attacker who can obtain a TLS client certificate signed by a CA the broker trusts to embed JavaScript in the certificate's Subject DN, which is rendered unescaped in the connection detail page and executes in an administrator's browser session when that connection is viewed. Success enables full administrative account takeover within the management UI - creating users, exporting definitions, and performing any action the viewing admin can perform. Exploitation is heavily gated: the TLS listener must be configured with ssl_options.verify = verify_peer (not the default), the certificate must be signed by a CA in the broker's trust store (self-signed certificates do not work), and an administrator must open the affected connection page; the management UI's CSP includes 'unsafe-inline', so inline script is not blocked. Patched versions are 3.13.15, 4.0.20, 4.1.11, and 4.2.6; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Missing authentication for a critical function in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote, unauthenticated attacker to read sensitive information and modify system configurations on an affected deployment. With CVSS 7.3 (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are required, so any network-reachable FTM instance with the vulnerable function exposed is at risk; exploitation is limited chiefly by FTM's narrow enterprise-payments install base and whether that endpoint is actually reachable. No public exploit code has been identified at time of analysis, and IBM has released a patch.
Unauthenticated insertion of malicious runbook content into the vector database backing IBM Financial Transaction Manager (FTM) for Red Hat OpenShift's AI agent allows retrieval-augmented generation (RAG) poisoning that can steer AI-driven MCP tool calls toward unauthorized payment actions or exfiltration of payment data. IBM self-rates the issue CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting unauthenticated network reachability and low attack complexity rather than high per-impact severity, since the realized effect is mediated by LLM behavior and is probabilistic rather than deterministic. The flaw is rooted in CWE-74 at api.vectordb.runbooks.js:51; no public exploit code identified at time of analysis and the issue is not tied to confirmed active exploitation, with exposure limited to deployments where the FTM AI agent endpoint is network-accessible and the agent has MCP tools wired to payment-affecting actions.
Local privilege escalation in Claris FileMaker Pro for Windows lets a low-privileged local user drop a malicious DLL into the directory used by the product's installer and thereby execute arbitrary code in the administrator context once a privileged user runs that installer. Only Windows installer builds prior to 26.0.3 are affected (EUVD records the range as 0 through 26.0.3); the installed application at runtime is not impacted. Exploitation requires local host access plus an admin-initiated installer run (CVSS:3.1/AV:L/AC:L/PR:L/UI:R), so it is neither remotely reachable nor automatable - CISA's SSVC rates Exploitation as none and Automatable as no - and no public exploit code exists, with EPSS at 0.15% (3rd percentile) reflecting the narrow local-use precondition. This is a local privilege-escalation issue with realistic but constrained risk; a vendor fix is available.
A heap buffer overflow in BusyBox's romfs filesystem image parsing path can be triggered when the utility processes an attacker-crafted romfs image whose volume ID metadata is read with an unbounded strlen, producing an out-of-bounds heap write (CWE-787) rated CVSS 3.1 base 7.3. Because the attack vector is local (AV:L), the malicious image must be delivered to the target system - for example via removable media, a downloaded archive, a firmware/container image, or a package - and some process or user must then parse or mount it (UI:R); it is not remotely triggerable over a network. Under the assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) no privileges are required, and successful corruption could yield code execution in the context of the parsing process with high impact to confidentiality, integrity, and availability; no public exploit or POC was identified in the supplied intelligence and there is no confirmed active exploitation.
Command injection in the automation controller's external logging (rsyslog) configuration of Red Hat Ansible Automation Platform 2 allows a superuser to achieve arbitrary command execution inside the control-plane rsyslog component, exposing the controller SECRET_KEY and database credentials and enabling decryption of all stored credentials. Exploitation requires authenticated superuser privileges (CVSS 3.1 7.2, PR:H, no user interaction) and only takes effect when external logging is in use, so the malicious RainerScript configuration is actually generated and loaded. No public exploit code was identified and there is no CISA KEV listing indicating active exploitation, meaning real-world risk is strongly gated by the elevated privilege requirement even though the post-exploitation impact is a full control-plane compromise.
Improper authentication in the OpenShift Console's CatalogdHandler allows unauthenticated remote attackers to forward the openshift-session-token cookie and send requests to the in-cluster catalogd service, disclosing the internal operator-catalog index and providing a relay into the openshift-catalogd namespace (CVE-2026-75886, CVSS 7.2). This affects Red Hat OpenShift Container Platform 4. No public exploit identified at time of analysis; exploitation requires network reachability to the exposed console endpoint.
EasyStore for Joomla versions 1.0.0 through 3.0.0 does not enforce CSRF token verification across most administrator AJAX endpoints, enabling an attacker to trick a logged-in Joomla administrator into changing store data such as orders, coupons, media, customers, settings, tags, categories, reviews, and collections. Only the products() action checked tokens; the vendor fix moves verification into ApiController::execute() and applies Session::checkToken() to POST, PUT, PATCH, and DELETE requests. No public exploit code was identified at time of analysis, and exploitation requires an active admin session plus user interaction, so this is a moderate-risk CSRF issue despite the potential for high integrity and availability impact.
CSRF in JoomShaper EasyStore for Joomla versions 1.0.0 through 3.0.0 allows an attacker to silently modify the core Joomla mail sender name and address (fromname, mailfrom) in configuration.php by tricking a logged-in administrator into visiting a malicious web page. The vulnerable endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration lacks anti-CSRF token validation and administrative authorization checks. Exploitation requires an authenticated admin session (UI:R) but no attacker credentials (PR:N); impact is limited to altering mail sender identity, and no public exploit was identified at time of analysis.
PHP Object Injection in the Reycob Product Import Export plugin (versions up to and including 2.3.0) allows an authenticated attacker with the WooCommerce 'Shop manager' role or higher to submit crafted serialized data, potentially achieving arbitrary code execution if a suitable POP gadget chain is present in the loaded PHP codebase. The vulnerability is network-exploitable (CVSS 3.1: 7.2 HIGH, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction, but the high-privilege requirement limits exploitation to trusted roles. No public exploit code or active exploitation has been identified at the time of analysis.
Stored cross-site scripting in HumHub 1.18.5 lets an authenticated user who holds the delegated, non-system-administrator 'Manage Users' permission (admin_manage_users) inject persistent HTML/JavaScript through a Profile Field Category title, which is later rendered unescaped into the page. The payload executes in the browser of any other user or administrator who views the affected profile-field configuration or rendering page, so exploitation is precondition-gated: it requires a high-privileged management account and victim interaction, making this a real but modest insider/compromised-privileged-account risk rather than open unauthenticated access. No public exploit code or confirmation of active exploitation was identified at time of analysis, and the upstream fix is available as PR #8499 in the HumHub repository.
Path traversal in Plex Media Server before 1.43.3.10861 lets an attacker who can reach the /system/agents/media/get endpoint read files accessible to the targeted Plex user by supplying ../ sequences in the url parameter. The primary exploitation path requires a valid Plex session token (the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, i.e. authenticated), while a secondary, lower-barrier path lets a LAN-adjacent attacker supply a crafted X-Forwarded-For header that the server trusts as evidence of local context. Read access is nominally bounded by the victim account's permissions, but because the reachable files include the PlexOnlineToken store, successful exploitation escalates from file disclosure to full Plex account and server takeover; no CISA KEV entry or public exploit code appears in the supplied intelligence, and a vendor fix is available in version 1.43.3.10861.
Photoview through 2.4.0 contains an authorization bypass in the shareAlbum GraphQL mutation that lets any authenticated low-privileged user generate valid share tokens for albums owned by other users. Because album IDs are sequential integers, an attacker with a normal account can enumerate IDs and create working share links without needing any elevated privileges; distributing the resulting link exposes the victim's photos and sub-albums. Exploitation requires a multi-user deployment and an authenticated session, and no public exploit code has been identified at time of analysis, though the vendor has released an upstream fix.
Denial of service in RabbitMQ versions prior to 4.2.7 and 4.3.1 allows any authenticated AMQP 0-9-1 client to crash the entire Erlang VM, taking down all vhosts and connections, by exhausting the atom table with roughly one million requests. The attack exploits the direct reply-to feature: queue names or routing keys beginning with 'amq.rabbitmq.reply-to.' cause an ETF-encoded pid node name to be passed to binary_to_atom without using binary_to_existing_atom, and because atoms are never garbage collected, the try/catch cannot reclaim them. Exploitation requires a valid AMQP connection (any credential, any permission level) and the ability to send the large number of operations; no public exploit identified at time of analysis.
Authenticated but low-privileged users of Red Hat Ansible Automation Platform 2 can bypass the automation-controller's sanitize_jinja() input-validation guard and have ansible-core evaluate attacker-supplied Jinja inside the execution environment, yielding arbitrary command execution and disclosure of secrets belonging to credentials the attacker cannot normally read. The flaw is exploitable remotely with no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N per independent assessment) and requires only a controller account able to set one of the affected launch-time fields. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; priority is bounded by the required authenticated foothold and the niche deployment footprint.
Denial of service in RabbitMQ Server (versions prior to 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15) allows an authenticated AMQP 0-9-1 client with publish permission to exhaust broker memory by declaring an excessive content-header BodySize and streaming message fragments without completing assembly. The unvalidated uint64 BodySize bypasses the max_message_size check, which only runs at assembly completion, causing unbounded memory accumulation in the reader process until the memory alarm triggers or the node runs out of memory, degrading all publishers cluster-wide. No public exploit code has been identified at time of analysis, and vendor patches are available.
Denial of service in Robur Albatross (specifically the albatross-console component) versions 1.0.0 through 2.x before 2.7.2 lets an authenticated user who can send console subscription commands drive the albatross-console process into an unterminated loop over the unikernel log ring buffer, consuming CPU and making console access unavailable. Exploitation requires the targeted unikernel to have generated enough output to fill the 1024-line ring buffer, and the request must specify a very high or negative line count, or a timestamp earlier than every buffered message; the vendor states it is not exploitable by unauthorized clients, and the independent assessment confirms PR:L with availability-only impact (C:N/I:N/A:H). No public exploit code has been identified at time of analysis, so this is a genuine but bounded availability risk rather than a high-urgency threat.
Missing authorization checks in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let unauthenticated attackers execute unauthorized payment actions against the payment-action interface, compromising transaction integrity with a limited availability impact (CVSS 3.1 base 7.1, CWE-862). The assessed vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) means the attacker must already sit on an adjacent network - the same LAN segment, an established VPN, or the OpenShift cluster/service-mesh network - rather than reaching the service from the open Internet, so exposure is bounded by network placement even though no credentials or user interaction are required. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); this reads as a genuine but moderate-priority integrity issue rather than an inflated high-severity finding, and IBM has published a fix.
SQL injection in the Tainacan WordPress plugin through version 1.2.0 lets an attacker with an authenticated Subscriber-level account inject arbitrary SQL into one of the plugin's database queries, potentially reading sensitive data from the underlying WordPress database. The prerequisite is meaningful: the site must permit low-privilege account creation (for example, WordPress self-registration enabled), which substantially narrows the exposure for sites with registration disabled. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor's own vector (AC:H) indicates some crafting or precondition beyond a trivial payload, keeping this a genuine but bounded threat rather than an opportunistic mass-exploitation risk.
Reflected cross-site scripting in the WordPress plugin Calculated Fields Form affects all versions up to and including 5.5.1.1 and allows an unauthenticated remote attacker to execute script in the browser of a user who follows a crafted link or loads a malicious page. The assessed impact is confined to client-side execution inside the target site's origin (low confidentiality and integrity impact, with scope change), and the attack relies on victim interaction, so higher-value outcomes require luring a privileged user such as a site administrator. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and the available intelligence does not confirm a fixed release.
Reflected cross-site scripting in Core Web Vitals & PageSpeed Booster, a WordPress performance plugin, affects versions 1.0.31 and earlier and lets an unauthenticated remote attacker get arbitrary script executed in a victim's browser session, carrying a CVSS 3.1 base score of 7.1 (High). Exploitation is not autonomous: it requires a victim (a site visitor or a logged-in administrator) to interact with an attacker-crafted request or link that reaches the vulnerable input-handling code path, so realistic abuse depends on phishing or social engineering, and the specific vulnerable parameter or page is not disclosed in the available intelligence. No public exploit code and no confirmed active exploitation are identified at time of analysis.