Unauthenticated remote code execution in Rejetto HFS2 (HTTP File Server) through version 2.4.0 lets an attacker execute arbitrary commands on the underlying host by hiding server-side template syntax inside the filename of a multipart file upload. The crafted filename closes the template quoting context and injects an exec macro, which bypasses the dispatcher's authorization check, so no credentials or user interaction are required (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; vendor score 10.0). Publicly available exploit code exists and an advisory with a proof-of-concept walkthrough is referenced by VulnCheck, but no KEV entry was provided, so this is not confirmed as actively exploited; the practical limiting factor is whether the multipart upload endpoint is reachable from the attacker's network.
Unauthenticated arbitrary file read, write, append, and delete in Rejetto HFS2 up to and including 2.4.0 allows remote attackers to compromise the confidentiality, integrity, and availability of the host filesystem. The vulnerability arises because the template engine's macro dispatcher performs no authorization check and the path resolver fails to confine absolute paths to the shared folder, letting attackers manipulate macros to access files anywhere the HFS service account has permissions. Public exploit code exists, and exploitation works against default configurations; the legacy 2.x branch is affected, while HFS 3.x is a separate codebase.
Unauthenticated local file inclusion in the Visual Composer Website Builder plugin for WordPress (all versions up to and including 45.16.0) lets remote attackers supply the vcv-template request parameter to force the server to include and execute files of their choosing. Because the vulnerable code path is reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), attackers can directly bypass access controls and read sensitive files on the host; full PHP code execution is achievable only where the attacker can also plant an includable file (for example an uploaded image or other supposedly 'safe' file type) on the server. At time of analysis there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified, though the Wordfence advisory and the plugin's own Trac changeset confirm an upstream fix has been committed.
Unauthenticated privilege escalation in the Paytium: Mollie payment forms & donations WordPress plugin (all versions up to and including 5.0.3) allows an attacker to create a brand-new WordPress user with the administrator role and take over the site. The flaw lives in the unsigned pt_cf_checkout_meta() filter on the pt_meta_values hook, which copies attacker-supplied $_POST['pt_form_field'] keys, including pt-user-role, straight into payment meta and ultimately into wp_insert_user(); exploitation requires a publicly reachable [paytium] shortcode form and completion of an actual Mollie payment so the malicious role meta is persisted, after which the attacker claims the new admin account via the standard lost-password flow. No public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), though the vendor-published Wordfence advisory and the 9.8 CVSS rating (AV:N/AC:L/PR:N/UI:N) make this a high-priority unauthenticated issue for any site running the affected versions with a public Paytium form.
XML External Entity (XXE) injection in http4s-scala-xml's EntityDecoder for scala.xml.Elem (all versions before 0.24.1 and 1.0.0-M39) allows unauthenticated remote attackers who can supply XML message bodies to disclose files readable by the service process, perform server-side request forgery (SSRF) against internal network resources, or trigger denial of service via entity expansion. The decoders obtain a javax.xml.parsers.SAXParserFactory through SAXParserFactory.newInstance without configuring secure-processing features, so JDK default behavior resolves DOCTYPE declarations, external general and parameter entities, and external DTDs. Vendor-released fixes are 0.24.1 and 1.0.0-M39; no public exploit code has been identified at time of analysis, and reachability depends on an application actually using these decoders against untrusted XML.
Unauthenticated MCP tool invocation in DBHub versions prior to 0.22.5 allows a malicious website to reach the HTTP transport endpoint and dispatch database tool calls against connected Postgres, MySQL, SQL Server, Oracle, MariaDB, or SQLite databases, because the server's Origin-equals-Host check is defeated by DNS rebinding. The flaw applies only when DBHub is launched in the non-default HTTP transport mode (for example --transport http --port 8080); the default stdio transport is unaffected, and exploitation requires a victim's browser to load attacker-controlled content and successfully complete the rebind window, per the independent assessment. No public exploit has been identified at time of analysis, and while the CVSS 4.0 vector scores 9.3, the assessed real-world severity is lower (CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L), with impact bounded by DBHub's configured tool permissions and database credentials - read-only configurations limit exposure to disclosure.
Stored cross-site scripting in code16 Sharp before 9.22.5 lets an authenticated user who can submit content into a SharpEditorFormField persist executable markup that later runs in the browser of anyone who opens the stored record, including higher-privileged administrators. The bug is that markup carrying the data-html-content attribute - and, before the fix, iframe srcdoc - survived the framework's server-side sanitization even when the SharpFormEditorField::RAW_HTML toolbar button was not enabled (CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C, published base 8.7; our assessment rates the integrity/confidentiality consequences lower, C:L/I:L). No public exploit code or confirmed active exploitation was identified at time of analysis, but exploitation requires only a low-privileged editor-level account on the Sharp admin panel plus a victim viewing the poisoned record.
Command injection in Brocade SANnav orchestrator versions before 3.0.1a enables network-adjacent attackers to execute arbitrary administrative Fibre Channel switch CLI commands and manipulate container runtimes, achieving high impact on confidentiality, integrity, and availability. The vendor CVSS 4.0 score is 8.6 (AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H); however, our independent assessment using CVSS 3.1 rates it 8.8 with PR:N (unauthenticated), and the description states unauthenticated while the vector indicates PR:L - authentication requirements are not confirmed from available data. No public exploit code has been identified at time of analysis, and there is no evidence of active exploitation (CISA KEV).
Unauthenticated denial of service in Rejetto HFS2 2.4.0 and earlier lets a remote attacker take the entire file server offline with a single crafted request to the getini handling path, which drives a serving thread into an infinite busy loop that consumes CPU and stops the server answering any client. The failure is persistent and self-perpetuating: there is no timeout or automatic recovery, so availability is only restored when an operator manually restarts the service. Publicly available exploit code exists (documented in the referenced researcher advisory and echoed by VulnCheck), and no authentication, user interaction, or non-default feature toggle is required - the only practical prerequisite is network reachability of the HFS2 listener, which matters because HFS2 is a Windows desktop file server frequently bound to a LAN or deliberately published for file sharing.
Two-factor authentication bypass in Snipe-IT (all releases before 8.7.0) allows an attacker who already knows a victim's account password to obtain a persistent, full-access Passport API token without ever supplying a TOTP code, because 2FA is enforced only by the Laravel 'web' middleware group while the personal-access-token endpoint sits in the un-gated 'api' group. The token grants read/write access across the victim's permissions and, for an admin victim, can also reach the admin users/two_factor_reset API endpoint to wipe the enrolled second factor - after which the attacker re-enrolls their own device and locks the legitimate user out of the web UI. Exploitation requires that 2FA actually be switched on (optional mode with the victim opted in, or required mode) and that the victim hold the self.api permission; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, with password possession as the sole prerequisite, and the older CVSS 4.0 score is 8.6. A complete public proof-of-concept is included in vendor advisory GHSA-hxcx-9h4f-42xx, the flaw is not listed in CISA KEV, and a vendor patch is available in Snipe-IT 8.7.0.
SQL injection in phpMyFAQ versions prior to 4.1.6 lets an authenticated administrator inject arbitrary SQL through the stop-word management feature by supplying a crafted "word" value that breaks out of the string literal built in StopWords::add(). The flaw is confined to the add()/INSERT code path - the sibling update() method escapes the same input correctly - and because it requires a high-privileged admin session (PR:H) plus access to the stop-word UI, exposure is bounded to trusted operators or compromised admin credentials rather than unauthenticated attackers. Successful exploitation permits reading, modifying, or deleting arbitrary rows and tables within the phpMyFAQ database; no public exploit code has been identified at time of analysis, and the vendor-released patch is version 4.1.6.
Incomplete log sanitization in Brocade SANnav before 3.0.1a causes extension switch IPsec pre-shared keys (PSKs) to be written in cleartext to system logs during the bulk IPsec policy collection workflow, allowing any principal with read access to container logs or exported support archives to recover those keys and potentially compromise the IPsec-protected tunnels that rely on them. The issue is local and authenticated (CVSS 3.1 AV:L/AC:L/PR:L/UI:N, confidentiality-only per independent assessment), not remotely reachable, and it is tied specifically to that diagnostic collection path rather than to arbitrary attacker input; no public exploit code has been identified at time of analysis. The 8.4 CVSS 4.0 vendor score (which also asserts high integrity impact via VI:H) should not be used as the sole triage signal, since the practical outcome depends on the attacker both holding log/support-bundle read privileges and being able to reach and reuse the leaked PSKs against the switch fabric.
Denial of service in zbateson/mail-mime-parser 2.0.0 through 3.0.5 and 4.0.0/4.0.1 allows unauthenticated remote attackers to exhaust CPU and memory by supplying a crafted email to any application that parses untrusted messages with this PHP library, since the single prerequisite is that the message is actually parsed (the cost is paid lazily on the first getAllParts() call or content read). Three independent parsing paths are super-linear in cost, so a crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory, potentially triggering an out-of-memory kill; because the parsing cost grows super-linearly, a caller-side input byte-size cap does not bound the work performed. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but the availability-only impact, low attack complexity and unauthenticated remote vector make it a genuine though moderate-priority denial-of-service risk; fixes that add configurable limits are available in 3.0.6 and 4.0.2, while the end-of-life 2.x line will not receive patches.
Unauthenticated information disclosure in Rsdoctor prior to 1.5.16 allows remote attackers to retrieve complete source code of compiled JavaScript modules, serialized build configuration, error details, and other build metadata from the default report HTTP server started by @rsdoctor/rspack-plugin. The server binds to all interfaces (0.0.0.0), exposes POST /api/data/key with no authentication, and returns wildcard CORS (Access-Control-Allow-Origin: *), so any network-adjacent or remote attacker with reachability to the port - or a victim developer lured to a malicious page that abuses the CORS header - can pull sensitive data with a single unauthenticated request while a non-CI build session is live. Exploitation is favored by the fact that the server is enabled by default with no victim configuration, though exposure is limited to developer workstations during active builds rather than production systems; no public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing).
Unauthenticated remote denial of service in the Wazuh cluster daemon (wazuh-clusterd) allows a network peer to exhaust process memory before any authentication takes place. In versions 3.9.0 through 4.14.6, the cluster protocol handler allocates a payload buffer sized directly from the peer-supplied 20-byte header - up to 256 MiB - and then simply stops sending, holding that allocation until the TCP connection closes; because Fernet decryption and peer validation only occur after the buffer is reserved, no valid cluster key is required. Multiple concurrent sockets multiply the effect with no application-level per-source connection budget, potentially terminating the cluster process, disrupting node synchronization, and interrupting distributed API forwarding; there is no public exploit identified at time of analysis and the issue is fixed in 4.14.7. This is a genuine but bounded availability risk: only deployments running in cluster mode with the cluster listener (default TCP 1516) reachable are exposed, and that port is normally an internal inter-node interface.
Stored cross-site scripting in the StarCitizenWiki MediaWiki EmbedVideo extension (all versions prior to 4.1.0) allows a wiki editor to inject arbitrary HTML and JavaScript into pages by supplying a malformed video URL or ID whose embedded double quote escapes the src attribute of the generated iframe. Exploitation requires the non-default configuration $wgEmbedVideoRequireConsent to be disabled, so stock installations are unaffected, and it further requires the ability to insert an #ev parser function or embed tag into wiki content (page-edit rights) plus a victim rendering the poisoned page for the payload to fire. No public exploit code was identified at time of analysis and there is no CISA KEV entry; note that the CVSS 3.1 vector published in the CVE record (7.5, PR:N/UI:N/S:U) does not match the actual prerequisites, and the authoritative assessed vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
PHP object injection in the wpForo Forum WordPress plugin before 3.1.6 lets an authenticated attacker with Subscriber-level access or higher submit a crafted serialized value into a user-supplied profile field that the plugin deserializes without restricting which classes may be instantiated, as rated CVSS 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the plugin ships no POP/gadget chain of its own, escalation to remote code execution, arbitrary file operations, or SQL injection depends on a compatible chain being present via another installed plugin or theme - the factor driving the high attack complexity - and absent such a chain the outcome is limited to object injection with no confirmed high-severity effect. Publicly available exploit code exists, no active exploitation has been confirmed (not in CISA KEV, SSVC exploitation: none), and this is an incomplete fix of CVE-2026-49769.
DBHub's `readonly = true` option on its `execute_sql` tool fails to enforce read-only database access in versions prior to 0.22.6, because the connector code that would set PostgreSQL `default_transaction_read_only=on` and open SQLite in read-only mode is gated on a configuration value that is never populated. With only a first-keyword classifier left as a guard, any `SELECT` that calls a side-effecting function passes, allowing sequence tampering with an ordinary role and, with a privileged PostgreSQL role, arbitrary host file write via `lo_export`, arbitrary host file read via `pg_read_file`, and remote code execution via `dblink` combined with `COPY ... TO PROGRAM`. The HTTP transport is unauthenticated (CVSS vector PR:N) and binds to `0.0.0.0` by default, so any network caller of `/mcp` can reach the vulnerable tool; CVSS is 7.4 (AV:N/AC:H) and no public exploit code has been identified at time of analysis, though the vendor-released patch 0.22.6 resolves the issue.
Authentication bypass in Python Social Auth (social-core) versions prior to 5.0.0 allows unauthenticated remote attackers to impersonate any VK user when an application uses the vk-app backend, as the backend skips signature verification if the auth_key parameter is omitted. An attacker can forge callback fields such as viewer_id, access_token, api_id, and api_result to authenticate as an arbitrary VK identity, potentially taking over accounts in the target application. The vulnerability is fixed in version 5.0.0, and no public exploit code or active exploitation has been identified at this time.
Stored cross-site scripting in code16 Sharp before 9.22.5 lets an authenticated user who can edit a rich-text Editor field persist JavaScript via the iframe srcdoc attribute; the payload executes in the browser of any other user - typically a higher-privileged administrator - who later views the stored content, enabling session hijacking, account takeover, privilege escalation or disclosure of administrative data. The vendor confirmed the issue in advisory GHSA-qxg3-46rw-79j8 and shipped a fix in version 9.22.5 (commit ec509a22) that removes srcdoc from the permitted iframe attributes; exploitation requires a valid account with Editor-field edit permission and a second viewing victim (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, 7.3). There is no indication of active exploitation and no public exploit identified at time of analysis.
Improper firmware authenticity verification in the Botslab G980H dash camera allows an attacker who can intercept the device's firmware download or supply a crafted update package to install modified firmware and execute unauthorized code on the device. The update process fetches firmware over an unprotected connection and validates only an integrity value delivered alongside the payload rather than a trusted cryptographic signature, so anyone who controls the delivered bytes and recomputes that value defeats the check. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this as high severity but with a harder attack path than the vendor-published CVSS 4.0 score of 9.2 suggests, since the attacker needs either an on-path network position between camera and update source or authenticated update-submission access; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the intelligence signals around this advisory remain thin.
CRLF header injection in zbateson/mail-mime-parser before 3.0.6 and 4.0.2 allows an attacker-influenced attachment filename - including one harvested directly from parsed inbound mail - to be interpolated unescaped into Content-Type and Content-Disposition, so a filename containing \r\n serializes into one or more additional attacker-controlled header lines, for example a forged Bcc: that silently exfiltrates a copy of the outgoing message. Exploitation is limited to PHP applications that use the library to build or forward MIME messages with untrusted filenames (reusing getFilename() output or passing an attacker-supplied name into the attachment APIs); parse-only applications that never re-serialize the filename are not exposed. Per the CVSS vector the issue is network-reachable and requires no authentication or user interaction, no public exploit code was identified at time of analysis, and the vendor has shipped fixes in 3.0.6 and 4.0.2 while the 1.x and 2.x lines are end-of-life and will not be patched.
Authenticated local file inclusion and code execution affects the MasterStudy LMS WordPress plugin in versions from 3.5.29 up to (but not including) 3.7.50, where one display-style setting is used to build a template path without validation. Exploitation requires an authenticated WordPress account with the Contributor role or higher, and turns into arbitrary PHP execution only when a suitable PHP file already exists on the server. Publicly available exploit code exists (WPScan), but there is no confirmed active exploitation (not in CISA KEV) and SSVC rates exploitation as none and non-automatable, making this a high-priority, manually driven issue rather than an emergency; this is especially true for sites that do not permit untrusted users to register at Contributor level or above.
Account impersonation in Python Social Auth (social-core) before version 5.0.0 allows an authenticated Vend user from one shop to be authenticated as a pre-existing local account that was linked to a user from a different shop sharing the same numeric Vend user_id. Only applications that use the Vend OAuth2 backend and authenticate users from more than one Vend shop are affected; the numeric-ID collision is not attacker-controlled and may be uncommon, but successful exploitation yields full compromise of the colliding local account (CVSS 6.8, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) with no victim interaction required. No public exploit identified at time of analysis.
Stored cross-site scripting in the WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 allows authenticated users holding the Contributor role or higher to inject script into a campaign configuration field, which is rendered unescaped when a specific plugin feature is enabled, and the payload then executes in the browser session of any higher-privileged user (Editor or Administrator) who later views that campaign in wp-admin. Publicly available exploit code demonstrating the flaw exists, though there is no confirmed active exploitation and CISA's SSVC decision framework rates the issue as not automatable. The combination of authenticated low-privilege access, a non-default feature toggle and required victim interaction makes this a moderate rather than urgent priority.
Stored cross-site scripting in the WPeMatico RSS Feed Fetcher WordPress plugin before version 2.8.26 allows authenticated users with contributor-level privileges to inject malicious scripts via a crafted RSS feed, which then execute in the browser of a higher-privileged user (editor or administrator) who reviews the campaign. Exploitation requires user interaction and is not automatable; publicly available exploit code exists, but no active exploitation has been observed (CISA SSVC exploitation: none). This is a genuine but conditional risk that primarily affects multi-author WordPress sites where untrusted contributors can create campaigns, and it does not affect default single-admin installs.
Unauthenticated attackers can force full refunds and immediate subscription cancellations on WordPress sites running the WPForms plugin before 2.0.2 by submitting a Stripe payment object that actually belongs to a different application sharing the same Stripe account. Because the plugin never verifies that the referenced Stripe object was created by WPForms (CWE-284, improper access control), any public form submission carrying a known, valid payment or subscription identifier is acted upon directly against the site owner's Stripe account. Exploitation is remote and unauthenticated per the assessed vector (PR:N/UI:N) but is constrained by high attack complexity (AC:H): Stripe identifiers cannot be enumerated through the flaw, so an attacker must already possess a legitimate reference. Publicly available exploit code exists; no active exploitation has been confirmed (CISA SSVC Exploitation: none), and impact is limited to integrity - refunds and cancellations - with no data disclosure.
Sites running the CMB2 WordPress plugin before 2.13.0 can have arbitrary WordPress options created or overwritten by any authenticated user holding a Subscriber-level account, because one of the plugin's AJAX actions performs no capability check; this can corrupt core site settings and render the site unusable. Exploitation is conditional: the site must have declared an oEmbed field - either through CMB2 itself or, far more commonly, through another plugin or theme built on CMB2 - since CMB2 registers no oEmbed fields of its own, and publicly available exploit code exists, though CISA SSVC records no known exploitation. The stored value is never attacker-controlled, so the impact is confined to integrity and availability (CVSS 6.8) with no confidentiality loss and no privilege escalation, and the vendor has released CMB2 2.13.0 as the fix.
Reusable authentication values in Botslab G980H dash camera firmware let an attacker on the adjacent network replay a captured credential from a different client to obtain an authenticated session with privileged device functionality. The vulnerability affects all firmware revisions tracked under CPE cpe:2.3:a:botslab:g980h:*:*:*:*:*:*:*:* and is rated 8.6 under CVSS 4.0 (assessed 8.1 under CVSS 3.1 as AV:A/AC:H/PR:N/UI:N, with high confidentiality and integrity impact and no availability impact). Exploitation is unauthenticated per the vector (PR:N/UI:N) but requires the attacker to already be positioned on the same local network or RF proximity as the camera and its legitimate client, and to capture a valid authentication value before or while it is still usable; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so risk signals are moderate-to-high rather than urgent.
Missing authorization in the 10Web Booster WordPress plugin before 2.34.0 exposes an unauthenticated routine that issues the plugin's cloud-connection shared secret, allowing any anonymous visitor to read that secret and then repeatedly delete it. The practical impact is limited to confidentiality of the cloud credential and availability of the legitimate administrator's cloud connection: an attacker cannot achieve code execution or broader site compromise, but they can disclose the secret and block an administrator from completing a valid 10Web connection. Exploitation requires no authentication or user interaction per the assessed vector (AV:N/AC:L/PR:N/UI:N), publicly available exploit code exists, and no confirmed active exploitation has been reported (CISA SSVC Exploitation: none); this is a moderate-priority issue whose real-world ceiling sits well below its 6.5 base score.
SAML account association in python-social-auth (social-core) before 5.0.0 lets an attacker who already holds a valid account on an identity provider trusted by the target application link that SAML identity to a logged-in victim's local account, after which the attacker can authenticate through SAML and access the victim's account. The flaw only reaches deployments that use the SAML backend and enable authenticated account association, and it requires the victim to be logged in and driven through the association flow while the unsolicited SAML response is timed to that session, which is why the assessed vector is network-reachable but high-complexity with user interaction (CVSS:3.1/AV:N/AC:H/PR:L/UI:R, base 6.4). This is a conditional integrity and authentication problem rather than a mass-exploitable emergency; no public exploit identified at time of analysis, and version 5.0.0 resolves it by validating SAML responses against stored AuthnRequest IDs.
Decepticon versions prior to 1.1.17 fail to neutralize ChatML-style special-token literals (e.g. <|im_start|>, <|eot_id|>, <start_of_turn>, [INST], <<SYS>>) embedded in web crawl results returned by agent reconnaissance, so an attacker who plants such a string on a crawled page can forge an authoritative operator turn that the model acts on, bypassing Decepticon's agent guardrails and achieving arbitrary command execution inside the Kali Linux sandbox. Exploitation is unauthenticated (PR:N) but conditional: it requires the BYOK deployment model with a self-hosted or OpenAI-compatible backend (vLLM, SGLang, TGI, Ollama, LM Studio, text-generation-webui) whose tokenizer preserves special-token IDs, and the operator must actually crawl attacker-controlled or attacker-compromised content - both normal for a red-team tool. Deployments using hosted providers such as OpenAI or Anthropic are not vulnerable because those strip special tokens server-side; no public exploit code has been identified at time of analysis, and the advisory ships with a vendor fix in 1.1.17.
Attribute-injection cross-site scripting in xhtml-purifier (npm package node-xhtml-purifier) before 0.4.3 lets an attacker who can supply HTML to the sanitizer smuggle a JavaScript event handler - for example onmouseover or onerror - past purification so that it executes when the purified output is rendered in a browser. The serializer in XHTMLPurifier.js writes each attribute value straight into a double-quoted attribute without HTML-entity encoding, so a double quote inside any allowed attribute (class, style, title, alt, src, href) terminates the attribute and starts a new one, converting data into markup. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) indicates no authentication requirement but a user-interaction prerequisite, since the victim must render the output and, for handlers like onmouseover, trigger the element; this is a genuine sanitizer bypass but a moderate-priority issue overall, and exploitation is contingent on an application actually passing attacker-controlled HTML through this niche library. No public exploit code and no confirmed active exploitation were identified at time of analysis.
CVE-2026-91766 is referenced only through a vendor-originated report from Ubuntu (vendor:ubuntu), and the identifier arrives with no description, no CVSS score or vector, no CWE classification, no CPE data, and no version information. Because the affected component, attack vector, and required privileges are all undefined, the concrete impact on Ubuntu systems cannot be stated, and risk cannot be meaningfully assessed from the available data. No public exploit has been identified at time of analysis, and patch availability could not be determined from the provided data; analysts must retrieve the corresponding Ubuntu Security Notice or the Ubuntu CVE tracker entry to establish the affected source package, supported releases at risk, and any prerequisites.
Command injection in Dokploy before 0.29.13 lets an authenticated organization member with service:read permission execute arbitrary commands as root inside the Dokploy container by injecting shell metacharacters into the repoPath parameter of the patch.readRepoDirectories tRPC procedure. Because the standard deployment mounts /var/run/docker.sock, successful exploitation can pivot to control Docker and compromise the host and its managed applications; the vendor fix is available in 0.29.13, and no public exploit identified at time of analysis. The vulnerability is rated CVSS 9.9 with scope change and high confidentiality, integrity, and availability impact.
Privilege escalation in Rapid7 Velociraptor allows an authenticated user holding only the 'investigator' role to execute arbitrary VQL statements with administrator privileges on the Velociraptor server by populating the internal 'compiled_collector_args' field when submitting a hunt-creation/scheduling API request. Because the server accepts this internal field from the caller, the attacker-supplied pre-compiled VQL is trusted and the ACL checks that normally gate artifact compilation are skipped (CVSS 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exploitation requires a valid investigator-or-higher account that can schedule hunts, making this an insider/privilege-escalation path rather than an unauthenticated remote compromise; no public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status was provided. The vendor advisory is published at https://docs.velociraptor.app/announcements/advisories/cve-2026-19072/.
Use-after-free in the Linux kernel's server-side SUNRPC RPCSEC_GSS credential decoder (svcauth_gss_decode_credbody) leaves the pooled per-request credential (svcdata->clcred in gss_svc_data) holding a dangling gc_ctx.data inline pointer into a released request XDR page while gc_ctx.len still carries a stale length from an earlier request, so a downstream length-driven consumer such as gss_svc_searchbyctx() walks freed memory. Exposure is limited to hosts running an NFS server with RPCSEC_GSS/Kerberos security enabled (exports mounted with sec=krb5, krb5i, or krb5p); systems using only AUTH_SYS or running no NFS server are not affected. A remote, unauthenticated attacker who can reach the GSS-enabled service and craft a credential body that fails XDR decode can trigger the fault, but reliability is limited because the dangling state depends on residue from a prior request and on the request pages being released, so denial of service with limited information disclosure is the realistic outcome rather than assured code execution; no public exploit identified at time of analysis, and vendor patches are available for the affected stable trees.
Out-of-bounds memory access in the Linux kernel's RDMA RTRS server (rtrs-srv) module, used by RNBD remote block devices, is reachable by an unauthenticated remote attacker (CVSS vector PR:N) who can open an rtrs client session over an RDMA/RoCE/InfiniBand fabric and send a process_read or process_write message whose network-supplied usr_len field exceeds off. The unchecked subtraction data_len = off - usr_len underflows to a huge size_t that is then handed to the rdma_ev callback as a memory length, producing the out-of-bounds access. The independent assessment rates this AV:N/AC:L/PR:N/UI:N/S:U with Low confidentiality and integrity impact and High availability impact (substantially below the vendor's 9.8), and practical exposure is narrowed because rtrs-srv is not present on general-purpose systems and requires RDMA-fabric reachability rather than ordinary IP routing; no public exploit code identified at time of analysis.
Improper authentication in Delta Electronics DIAEnergie before 1.11.00.022 allows authentication bypass, enabling remote attackers to reach protected functionality without valid credentials. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires no authentication, no user interaction, and no non-default configuration - only network reachability to the DIAEnergie service. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the practical exposure is limited chiefly by the product's footprint, as DIAEnergie is a niche ICS energy-management platform typically deployed on operational or enterprise networks rather than the public internet.
A credential-isolation flaw in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker who controls or can predict the MCP server URL a victim configures to cause MD5-derived credential-store paths to collide or match, potentially exposing or overwriting another server's cached OAuth tokens via the getServerUrlHash function in src/lib/utils.ts. The package is an npm bridge that connects local MCP clients to remote MCP servers, so practical exploitation depends on the victim adding the attacker's server URL and on the OAuth credential-persistence feature being in use (user interaction), which is inconsistent with the no-interaction AV:N/AC:L/PR:N/UI:N profile of the 9.8 headline score. No public exploit code was identified at time of analysis and EPSS is low (0.29%, 19th percentile), so the CWE-94 arbitrary-code-execution framing should be treated as unverified rather than confirmed remote code execution.
Session fixation in the HTTP management interface of Apache Qpid Broker-J through 10.1.0 lets remote, unauthenticated attackers hijack an administrator's authenticated management session by reusing a session identifier that is retained across successful authentication, yielding full confidentiality, integrity, and availability impact (C:H/I:H/A:H) over the broker's management functions. Exploitation requires the HTTP management interface to be reachable by the attacker and, critically, requires a legitimate management user - typically an administrator - to authenticate using a session identifier the attacker has planted, fixed, or otherwise obtained before login, so the assessed vector is AV:N/AC:H/PR:N/UI:R rather than the NVD-published 9.8 CRITICAL (AC:L/UI:N), which is inconsistent with the session-fixation class. There is no public exploit identified at time of analysis, and brokers are only exposed where management access is not otherwise restricted; upgrading to 10.1.1 addresses the flaw.
Heap out-of-bounds write in QuickJS's bytecode deserializer (JS_ReadFunctionTag) lets a crafted serialized blob corrupt heap memory, giving an attacker the potential for arbitrary code execution in the context of the host process. The flaw is only reachable when the embedding application calls JS_ReadObject with the JS_READ_OBJ_BYTECODE flag on attacker-controlled input - not the default pattern of executing JavaScript source - so exposure is confined to plugin, cache, or IPC loaders that treat serialized bytecode as untrusted data; where that path is exposed, the flaw is remotely triggerable by an unauthenticated attacker (CVSS vector PR:N) with a single malformed blob and no user interaction. Public exploit code has not been identified at time of analysis (EPSS 0.17%, 5th percentile), and while the vendor score is 9.8 with AC:L, an independent assessment rates attack complexity as high (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because exploitation depends on a non-default deserialization path in the hosting application.
Integer overflow in minimp3's mp3dec_skip_id3v1() tag-parsing routine allows a crafted APEv2 tag-size field inside an MP3 file to corrupt internal size arithmetic, which can lead to memory corruption in any application that decodes untrusted audio with a build at or around commit ea99364f. The CVSS vector supplied with the record is 9.8 (AV:N/AC:L/PR:N/UI:N), but our assessment lowers user interaction to UI:R: minimp3 is a passive single-header decoder library, so a victim or automated ingestion pipeline must open or feed the malicious file before the overflow is reachable, and there is no direct network attack surface in the library itself. No public exploit code has been identified at time of analysis, EPSS is low at 0.15% (3rd percentile), and the CVE is not listed in CISA KEV, so exploitation is unconfirmed and real-world risk depends on whether the consuming application processes hostile media.
Heap-buffer-overflow in MPack 1.1.1's Node (tree) parsing API on 32-bit platforms lets remote, unauthenticated attackers corrupt memory and crash the host application by delivering a MessagePack array32 or map32 header that declares an oversized element count. The declared count overflows the size_t arithmetic used to size an internal page allocation in mpack_tree_parse_children(), producing an undersized heap buffer that is then written past its end with mpack_node_data_t records. Exploitation is constrained to 32-bit builds that call the tree/Node API on attacker-supplied data: on 64-bit builds the overflow is effectively unreachable, and applications using only the streaming Expect/Reader API are not affected. EPSS is 0.14% (3rd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; NVD scores this 9.8, while independent assessment rates it lower (C:L/I:L/A:H) because of the 32-bit-only deployment prerequisite.
The Perl CPAN distribution IO::Socket::SSL::SelfCertificate version 1.00 is itself the attack artifact: its generate_certificate() routine writes a Python script disguised as a certificate file and executes it, causing base64-obfuscated code to be fetched from a hardcoded HTTP URL and run in memory without ever dropping a script to disk. Anyone who installs the 1.00 tarball and calls that function is exposed - a local, unauthenticated action requiring user interaction (assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), rather than the remote pre-authentication scenario implied by the CNA's 9.8 network vector - and outbound HTTP egress must be reachable for the payload to be retrieved. The advisory notes there are no test scripts or build hooks, so nothing fires automatically at install time and the payload must be manually triggered; no public exploit code beyond the malicious package itself has been identified at time of analysis, EPSS is negligible at 0.12% (1st percentile), and the nearly identical CVE-2026-95831 covers the sibling Crypt::SelfCertificate module.
Unauthenticated remote code execution in Honeywell PD45 Industrial Printer firmware F10.19.010040 lets any network-reachable attacker upload attacker-controlled files through the web management interface and execute them as malicious files and commands. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) reflects the complete absence of authentication or user interaction required, consistent with CWE-306 missing authentication for a critical function, so a single unauthenticated HTTP request path is enough to gain code execution on the device. Honeywell has released fixed firmware F10.22.030745; no public exploit code has been identified at time of analysis, but exposure is constrained mainly by the fact that these industrial printers typically sit on internal warehouse or manufacturing networks rather than the public internet, meaning an attacker usually needs an existing network foothold or adjacent access first.
Predictable session identifier generation in the Botslab G980H dash camera allows an unauthenticated attacker on the same adjacent network to enumerate or guess a valid session ID and use it to bypass the device's authorization controls, gaining high-impact read/write access to camera functionality. Exploitation is constrained rather than trivial: the attacker must already be on the same local/link-layer network as the camera and must time the attempt to coincide with a legitimate active session, and the supplied CVSS 4.0 vector reflects that prerequisite via AT:P alongside AV:A, PR:N and UI:N. There is no remote-internet attack path, so this is best characterized as a genuine but not high-priority weakness; no public exploit code has been identified at time of analysis and no CISA KEV listing or EPSS data accompanies this report.
Path traversal in the UEditor upload interface of ShopXO (yhx070424/shopxo) through version 2.2.7 lets remote attackers manipulate the path_type argument in config/ueditor.php to write or access files outside the intended upload directory. The CVSS v4.0 vector (AV:N/AC:L/PR:N/UI:N, E:P) indicates the attack is network-reachable with no authentication or user interaction required, and publicly available exploit code exists; there is no confirmed evidence of active exploitation (not listed in CISA KEV). The vendor was notified via an issue report but has not responded, so no vendor-released patch has been identified at time of analysis, and the realistic impact is bounded to Low confidentiality and integrity effects rather than full system compromise.
Missing authentication in the volotat Anagnorisis Socket.IO Connect interface exposed through app.py lets any remote party able to reach the service interact with the endpoint without credentials, producing limited confidentiality, integrity and availability impact. The issue affects versions up to 0.3.1/0.4.0, requires no user interaction or privileges (PR:N/UI:N in both the CVSS 4.0 and the independently assessed CVSS 3.1 vectors), and publicly available exploit code exists, though there is no confirmation of active exploitation (CISA KEV). Risk is best described as low-to-moderate in practice: the project is a niche, typically self-hosted application, the endpoint must be network-reachable, and the assessed impact is capped at Low across C/I/A.
Information disclosure in Intelliants Subrion CMS up to 4.2.1 lets remote attackers retrieve owner/user information through a manipulated q parameter in the /actions.json?action=assign-owner endpoint. Publicly available exploit code exists, but there is no confirmed active exploitation such as a CISA KEV entry. The CVSS 4.0 score is 5.5, while the independent assessment rates real-world risk as LOW-to-MODERATE because impact is partial confidentiality only and the administrative nature of assign-owner may in practice require a valid authenticated session even though the published vector lists PR:N; authentication requirements should be verified against the deployed instance.