Stored cross-site scripting in code16 Sharp before 9.22.5 lets an authenticated user who can submit content into a SharpEditorFormField persist executable markup that later runs in the browser of anyone who opens the stored record, including higher-privileged administrators. The bug is that markup carrying the data-html-content attribute - and, before the fix, iframe srcdoc - survived the framework's server-side sanitization even when the SharpFormEditorField::RAW_HTML toolbar button was not enabled (CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C, published base 8.7; our assessment rates the integrity/confidentiality consequences lower, C:L/I:L). No public exploit code or confirmed active exploitation was identified at time of analysis, but exploitation requires only a low-privileged editor-level account on the Sharp admin panel plus a victim viewing the poisoned record.
Command injection in Brocade SANnav orchestrator versions before 3.0.1a enables network-adjacent attackers to execute arbitrary administrative Fibre Channel switch CLI commands and manipulate container runtimes, achieving high impact on confidentiality, integrity, and availability. The vendor CVSS 4.0 score is 8.6 (AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H); however, our independent assessment using CVSS 3.1 rates it 8.8 with PR:N (unauthenticated), and the description states unauthenticated while the vector indicates PR:L - authentication requirements are not confirmed from available data. No public exploit code has been identified at time of analysis, and there is no evidence of active exploitation (CISA KEV).
Unauthenticated denial of service in Rejetto HFS2 2.4.0 and earlier lets a remote attacker take the entire file server offline with a single crafted request to the getini handling path, which drives a serving thread into an infinite busy loop that consumes CPU and stops the server answering any client. The failure is persistent and self-perpetuating: there is no timeout or automatic recovery, so availability is only restored when an operator manually restarts the service. Publicly available exploit code exists (documented in the referenced researcher advisory and echoed by VulnCheck), and no authentication, user interaction, or non-default feature toggle is required - the only practical prerequisite is network reachability of the HFS2 listener, which matters because HFS2 is a Windows desktop file server frequently bound to a LAN or deliberately published for file sharing.
Two-factor authentication bypass in Snipe-IT (all releases before 8.7.0) allows an attacker who already knows a victim's account password to obtain a persistent, full-access Passport API token without ever supplying a TOTP code, because 2FA is enforced only by the Laravel 'web' middleware group while the personal-access-token endpoint sits in the un-gated 'api' group. The token grants read/write access across the victim's permissions and, for an admin victim, can also reach the admin users/two_factor_reset API endpoint to wipe the enrolled second factor - after which the attacker re-enrolls their own device and locks the legitimate user out of the web UI. Exploitation requires that 2FA actually be switched on (optional mode with the victim opted in, or required mode) and that the victim hold the self.api permission; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, with password possession as the sole prerequisite, and the older CVSS 4.0 score is 8.6. A complete public proof-of-concept is included in vendor advisory GHSA-hxcx-9h4f-42xx, the flaw is not listed in CISA KEV, and a vendor patch is available in Snipe-IT 8.7.0.
SQL injection in phpMyFAQ versions prior to 4.1.6 lets an authenticated administrator inject arbitrary SQL through the stop-word management feature by supplying a crafted "word" value that breaks out of the string literal built in StopWords::add(). The flaw is confined to the add()/INSERT code path - the sibling update() method escapes the same input correctly - and because it requires a high-privileged admin session (PR:H) plus access to the stop-word UI, exposure is bounded to trusted operators or compromised admin credentials rather than unauthenticated attackers. Successful exploitation permits reading, modifying, or deleting arbitrary rows and tables within the phpMyFAQ database; no public exploit code has been identified at time of analysis, and the vendor-released patch is version 4.1.6.
Incomplete log sanitization in Brocade SANnav before 3.0.1a causes extension switch IPsec pre-shared keys (PSKs) to be written in cleartext to system logs during the bulk IPsec policy collection workflow, allowing any principal with read access to container logs or exported support archives to recover those keys and potentially compromise the IPsec-protected tunnels that rely on them. The issue is local and authenticated (CVSS 3.1 AV:L/AC:L/PR:L/UI:N, confidentiality-only per independent assessment), not remotely reachable, and it is tied specifically to that diagnostic collection path rather than to arbitrary attacker input; no public exploit code has been identified at time of analysis. The 8.4 CVSS 4.0 vendor score (which also asserts high integrity impact via VI:H) should not be used as the sole triage signal, since the practical outcome depends on the attacker both holding log/support-bundle read privileges and being able to reach and reuse the leaked PSKs against the switch fabric.
Denial of service in zbateson/mail-mime-parser 2.0.0 through 3.0.5 and 4.0.0/4.0.1 allows unauthenticated remote attackers to exhaust CPU and memory by supplying a crafted email to any application that parses untrusted messages with this PHP library, since the single prerequisite is that the message is actually parsed (the cost is paid lazily on the first getAllParts() call or content read). Three independent parsing paths are super-linear in cost, so a crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory, potentially triggering an out-of-memory kill; because the parsing cost grows super-linearly, a caller-side input byte-size cap does not bound the work performed. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but the availability-only impact, low attack complexity and unauthenticated remote vector make it a genuine though moderate-priority denial-of-service risk; fixes that add configurable limits are available in 3.0.6 and 4.0.2, while the end-of-life 2.x line will not receive patches.
Unauthenticated information disclosure in Rsdoctor prior to 1.5.16 allows remote attackers to retrieve complete source code of compiled JavaScript modules, serialized build configuration, error details, and other build metadata from the default report HTTP server started by @rsdoctor/rspack-plugin. The server binds to all interfaces (0.0.0.0), exposes POST /api/data/key with no authentication, and returns wildcard CORS (Access-Control-Allow-Origin: *), so any network-adjacent or remote attacker with reachability to the port - or a victim developer lured to a malicious page that abuses the CORS header - can pull sensitive data with a single unauthenticated request while a non-CI build session is live. Exploitation is favored by the fact that the server is enabled by default with no victim configuration, though exposure is limited to developer workstations during active builds rather than production systems; no public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing).
Unauthenticated remote denial of service in the Wazuh cluster daemon (wazuh-clusterd) allows a network peer to exhaust process memory before any authentication takes place. In versions 3.9.0 through 4.14.6, the cluster protocol handler allocates a payload buffer sized directly from the peer-supplied 20-byte header - up to 256 MiB - and then simply stops sending, holding that allocation until the TCP connection closes; because Fernet decryption and peer validation only occur after the buffer is reserved, no valid cluster key is required. Multiple concurrent sockets multiply the effect with no application-level per-source connection budget, potentially terminating the cluster process, disrupting node synchronization, and interrupting distributed API forwarding; there is no public exploit identified at time of analysis and the issue is fixed in 4.14.7. This is a genuine but bounded availability risk: only deployments running in cluster mode with the cluster listener (default TCP 1516) reachable are exposed, and that port is normally an internal inter-node interface.
Stored cross-site scripting in the StarCitizenWiki MediaWiki EmbedVideo extension (all versions prior to 4.1.0) allows a wiki editor to inject arbitrary HTML and JavaScript into pages by supplying a malformed video URL or ID whose embedded double quote escapes the src attribute of the generated iframe. Exploitation requires the non-default configuration $wgEmbedVideoRequireConsent to be disabled, so stock installations are unaffected, and it further requires the ability to insert an #ev parser function or embed tag into wiki content (page-edit rights) plus a victim rendering the poisoned page for the payload to fire. No public exploit code was identified at time of analysis and there is no CISA KEV entry; note that the CVSS 3.1 vector published in the CVE record (7.5, PR:N/UI:N/S:U) does not match the actual prerequisites, and the authoritative assessed vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
PHP object injection in the wpForo Forum WordPress plugin before 3.1.6 lets an authenticated attacker with Subscriber-level access or higher submit a crafted serialized value into a user-supplied profile field that the plugin deserializes without restricting which classes may be instantiated, as rated CVSS 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the plugin ships no POP/gadget chain of its own, escalation to remote code execution, arbitrary file operations, or SQL injection depends on a compatible chain being present via another installed plugin or theme - the factor driving the high attack complexity - and absent such a chain the outcome is limited to object injection with no confirmed high-severity effect. Publicly available exploit code exists, no active exploitation has been confirmed (not in CISA KEV, SSVC exploitation: none), and this is an incomplete fix of CVE-2026-49769.
DBHub's `readonly = true` option on its `execute_sql` tool fails to enforce read-only database access in versions prior to 0.22.6, because the connector code that would set PostgreSQL `default_transaction_read_only=on` and open SQLite in read-only mode is gated on a configuration value that is never populated. With only a first-keyword classifier left as a guard, any `SELECT` that calls a side-effecting function passes, allowing sequence tampering with an ordinary role and, with a privileged PostgreSQL role, arbitrary host file write via `lo_export`, arbitrary host file read via `pg_read_file`, and remote code execution via `dblink` combined with `COPY ... TO PROGRAM`. The HTTP transport is unauthenticated (CVSS vector PR:N) and binds to `0.0.0.0` by default, so any network caller of `/mcp` can reach the vulnerable tool; CVSS is 7.4 (AV:N/AC:H) and no public exploit code has been identified at time of analysis, though the vendor-released patch 0.22.6 resolves the issue.
Authentication bypass in Python Social Auth (social-core) versions prior to 5.0.0 allows unauthenticated remote attackers to impersonate any VK user when an application uses the vk-app backend, as the backend skips signature verification if the auth_key parameter is omitted. An attacker can forge callback fields such as viewer_id, access_token, api_id, and api_result to authenticate as an arbitrary VK identity, potentially taking over accounts in the target application. The vulnerability is fixed in version 5.0.0, and no public exploit code or active exploitation has been identified at this time.
Stored cross-site scripting in code16 Sharp before 9.22.5 lets an authenticated user who can edit a rich-text Editor field persist JavaScript via the iframe srcdoc attribute; the payload executes in the browser of any other user - typically a higher-privileged administrator - who later views the stored content, enabling session hijacking, account takeover, privilege escalation or disclosure of administrative data. The vendor confirmed the issue in advisory GHSA-qxg3-46rw-79j8 and shipped a fix in version 9.22.5 (commit ec509a22) that removes srcdoc from the permitted iframe attributes; exploitation requires a valid account with Editor-field edit permission and a second viewing victim (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, 7.3). There is no indication of active exploitation and no public exploit identified at time of analysis.
CRLF header injection in zbateson/mail-mime-parser before 3.0.6 and 4.0.2 allows an attacker-influenced attachment filename - including one harvested directly from parsed inbound mail - to be interpolated unescaped into Content-Type and Content-Disposition, so a filename containing \r\n serializes into one or more additional attacker-controlled header lines, for example a forged Bcc: that silently exfiltrates a copy of the outgoing message. Exploitation is limited to PHP applications that use the library to build or forward MIME messages with untrusted filenames (reusing getFilename() output or passing an attacker-supplied name into the attachment APIs); parse-only applications that never re-serialize the filename are not exposed. Per the CVSS vector the issue is network-reachable and requires no authentication or user interaction, no public exploit code was identified at time of analysis, and the vendor has shipped fixes in 3.0.6 and 4.0.2 while the 1.x and 2.x lines are end-of-life and will not be patched.
Authenticated local file inclusion and code execution affects the MasterStudy LMS WordPress plugin in versions from 3.5.29 up to (but not including) 3.7.50, where one display-style setting is used to build a template path without validation. Exploitation requires an authenticated WordPress account with the Contributor role or higher, and turns into arbitrary PHP execution only when a suitable PHP file already exists on the server. Publicly available exploit code exists (WPScan), but there is no confirmed active exploitation (not in CISA KEV) and SSVC rates exploitation as none and non-automatable, making this a high-priority, manually driven issue rather than an emergency; this is especially true for sites that do not permit untrusted users to register at Contributor level or above.
Reusable authentication values in Botslab G980H dash camera firmware let an attacker on the adjacent network replay a captured credential from a different client to obtain an authenticated session with privileged device functionality. The vulnerability affects all firmware revisions tracked under CPE cpe:2.3:a:botslab:g980h:*:*:*:*:*:*:*:* and is rated 8.6 under CVSS 4.0 (assessed 8.1 under CVSS 3.1 as AV:A/AC:H/PR:N/UI:N, with high confidentiality and integrity impact and no availability impact). Exploitation is unauthenticated per the vector (PR:N/UI:N) but requires the attacker to already be positioned on the same local network or RF proximity as the camera and its legitimate client, and to capture a valid authentication value before or while it is still usable; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so risk signals are moderate-to-high rather than urgent.
Predictable session identifier generation in the Botslab G980H dash camera allows an unauthenticated attacker on the same adjacent network to enumerate or guess a valid session ID and use it to bypass the device's authorization controls, gaining high-impact read/write access to camera functionality. Exploitation is constrained rather than trivial: the attacker must already be on the same local/link-layer network as the camera and must time the attempt to coincide with a legitimate active session, and the supplied CVSS 4.0 vector reflects that prerequisite via AT:P alongside AV:A, PR:N and UI:N. There is no remote-internet attack path, so this is best characterized as a genuine but not high-priority weakness; no public exploit code has been identified at time of analysis and no CISA KEV listing or EPSS data accompanies this report.
Path traversal in the HTTP server built into the Botslab G980H dash camera lets anyone already connected to the camera's own WiFi network retrieve files from its removable storage without authentication or user interaction. Readable content includes recordings, images, diagnostic logs and firmware files, which are exactly the artifacts a web server should never expose. CISA's ICS advisory ICSA-26-267-01 tracks the issue as CWE-22 and scores it 7.1 (High), driven entirely by confidentiality impact; proximity is the limiting factor, since the flaw is reachable only from the adjacent network and cannot be triggered from the general internet. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Cleartext transmission of sensitive data by the Botslab G980H dash camera firmware exposes stored recordings, live video, GPS location, images and diagnostic logs to anyone who can observe the device's WiFi traffic, because the camera exchanges this data with its companion mobile app over unencrypted HTTP and RTSP rather than TLS or encrypted RTSP. The exposure is unauthenticated but adjacent-only (CVSS:4.0 AV:A/AC:L/PR:N, scored 7.1; independently assessed as CVSS:3.1 AV:A/AC:H with confidentiality-only impact), so it requires an attacker within wireless range of, or already joined to, the network the G980H uses to talk to its phone app. No public exploit code has been identified at time of analysis and the issue has not been confirmed as actively exploited (not in CISA KEV); practical risk hinges on how easily the WiFi segment can be reached, which is worse if the camera's access point uses a predictable or default password.
Physical access to the Botslab G980H dash camera's UART interface grants an unauthenticated root shell and exposes the device's WiFi password. The root account requires no password, allowing an attacker with hands-on hardware access to obtain full control and recover network credentials. No public exploit code or active exploitation has been identified, and the CVSS 4.0 base score is 7.0 with a physical attack vector.
Hard-coded root credentials in Botslab G980H dash camera firmware allow anyone who can reach the device's UART/serial interface to obtain full root access, because the password is embedded in the firmware and cannot be changed, rotated, or disabled by the user. Exploitation is physically gated: it requires hands-on access to the camera plus a serial connection, and per the assessed vector (CVSS:3.1 AV:P/AC:L/PR:N/UI:N, CVSS:4.0 base 7.0) there is no prior-privilege or user-interaction barrier once that physical connection is made, while remote or network exploitation is not possible. There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is limited to attackers with device custody or those who obtain a firmware image, in which case the exposed credential grants complete control of the device (C:H/I:H/A:H).
Multi-factor authentication bypass in authentik (goauthentik) allows an attacker who already knows a target user's password to redirect the email authenticator's one-time code to an address they control, complete enrollment of the email factor as the victim, and obtain a session with access to any single sign-on applications behind the account. Only deployments that enroll the email authenticator during an authentication or enrollment flow are affected, and only where the target has not yet enrolled the email factor; other authenticator types are unaffected. Rated 8.9 by the vendor (independent re-assessment scores it slightly lower on availability impact), there is no public exploit identified at time of analysis and no CISA KEV listing, but the precondition of prior credential knowledge makes this a high-value account-takeover primitive for attackers who phish or reuse passwords. Fixed in 2026.2.7, 2026.5.7, and 2026.8.2.
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low privileges to execute arbitrary operating system commands by exploiting a path traversal flaw (CWE-22). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) yields a High severity score of 8.8, reflecting full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and a vendor patch is available.
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special elements that are passed into an OS command, allowing a remote attacker holding any low-privilege platform account to execute arbitrary operating-system commands on the DataStage host with the privileges of the vulnerable service. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), the exposure is gated by authentication: there is no anonymous internet-facing path, but multi-tenant deployments, shared service accounts, or any compromised low-privileged credential are sufficient to reach full command execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, while a vendor patch is available.
Authenticated command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote attacker with valid low-privileged credentials to execute arbitrary operating-system commands, potentially compromising confidentiality, integrity, and availability (CVSS 8.8). Exploitation requires network reachability to the DataStage/CP4D interface and the ability to supply input that is mapped into an unneutralized environment variable (CWE-78); no user interaction is needed. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with total technical impact, so this is a genuine high-severity finding but not an emergency.
Command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only a low-privilege account to execute arbitrary OS commands on the host, with high impact to confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires valid credentials and the ability to reach a code path that constructs an operating system command from user-supplied input without neutralizing shell special elements; no user interaction is needed, and the deployment context - an internal enterprise ETL service rather than an internet-facing endpoint - plus the narrow affected version materially constrain real-world exposure. No public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV); a vendor patch is available per IBM's advisory.
Privilege escalation in the authentik identity provider allows an account holding delegated group, group-membership, or user management rights to elevate itself to superuser by joining a group whose ancestor groups grant superuser status, or by assigning an existing role to a group without holding the change_role permission. Deployments running authentik before 2026.2.7, before 2026.5.7 on the 2026.5 line, or before 2026.8.2 on the 2026.8 line are affected, but exploitation is confined to installations that delegate those management capabilities to accounts that are not full administrators - single-administrator or non-delegated setups are unaffected. The flaw rates CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requires the attacker to hold an authenticated delegated account, and no public exploit code has been identified at time of analysis; vendor patches are available and the fix set is documented in advisory GHSA-h6c5-mpvq-j4jc.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker with only low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N) run arbitrary operating system commands on the affected platform, yielding high confidentiality, integrity, and availability impact for an overall CVSS base score of 8.8. Exploitation requires a valid CP4D session and access to the DataStage functionality that forwards attacker-controlled input into a shell command without sanitization; no public exploit identified at time of analysis, and IBM has published a vendor fix. Only the 5.4.0.0 build is explicitly named as affected, so patched builds referenced in IBM's advisory remove the exposure.
Authenticated remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a low-privileged user with network access to the service reach an unsafe deserialization sink and execute arbitrary code in the context of the affected component. The issue is CWE-502 (deserialization of untrusted data) rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so a successful attack yields high confidentiality, integrity and availability impact with no user interaction required. Exploitation requires previously obtained valid CP4D/DataStage credentials (PR:L) and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as none and the attack as not automatable, though the technical impact is rated total.
Catalyst::Seal before 0.03 memoises how a request path resolved using the path alone as the cache key, so an unauthenticated GET to a path whose action is declared POST-only poisons that entry and permanently disables the route for every later request in the same Perl process, including the legitimate POST. Where a POST-only action sits below a shallower action on the same path, a priming GET memoises the shallow route and a subsequent POST is dispatched there, skipping the deeper controller's auto() authorization guard. Exploitation requires a Catalyst application that has installed this non-default module; no public exploit has been identified at time of analysis and EPSS is low at 0.35% (26th percentile), while our independent assessment revises the impact down from the vendor-reported C:H/I:H/A:H to C:L/I:L/A:L (unauth., AV:N/AC:L/PR:N/UI:N/S:U), reflecting functional denial plus a possibility of an authorization check not running rather than a full compromise.
Heap over-read in DCMTK through 3.7.0 allows unauthenticated remote attackers to crash applications or leak adjacent heap memory by supplying a crafted DICOM instance whose declared NumberOfFrames exceeds the actual PixelData buffer length. The flaw resides in the ConcatenationLoader module (dcmfg) and is triggered when loading multi-frame DICOM concatenations; exploitation requires an ingestion path that processes untrusted instances (e.g., a DICOM network storage service), as offline viewers typically require a user to open the file. No public exploit code is identified at time of analysis, and a vendor patch is available via upstream commits.
Out-of-bounds reads in the Linux kernel's Greybus audio topology parser allow a malicious or compromised Greybus module to leak kernel memory and crash the system. The module declares a small topology blob size but supplies large le32 section sizes (size_dais, size_controls, size_widgets) that are added to build the control, widget and route section offsets without ever being checked against the fetched blob, so gbaudio_tplg_parse_data() walks past the allocation. Exploitation requires the kernel to be built with Greybus audio support and a rogue module attached to the UniPro/Greybus interconnect - a rare hardware configuration - and no public exploit code has been identified at time of analysis. Note that while the supplied NVD-style vector rates this 8.8 with C:H/I:H/A:H under AV:A, our assessment is that the weakness is fundamentally a read-side bug requiring physical/hardware access (AV:P, C:H/I:N/A:H), and the 8.8 score overstates both the access path and the integrity impact.
Remote code execution in mcp-remote 0.1.16 through 0.1.38 allows an attacker who controls or compromises a remote MCP server to run arbitrary code on a connected client by supplying a malicious OAuth authorization URL that the tool passes to open() without validation. Exploitation requires the victim to initiate a connection to that malicious server (user interaction, UI:R) and no victim-side authentication is required (PR:N); users who connect only to trusted first-party MCP servers are not affected. The EPSS score is low (0.29%, 19th percentile), no public exploit identified at time of analysis, and no CISA KEV confirmation of active exploitation.
Out-of-bounds access to native Wi-Fi header fields in the Linux kernel's ath11k driver can corrupt kernel stack memory when a received frame's length exceeds the maximum native Wi-Fi header size in the DP_RX_DECAP_TYPE_NATIVE_WIFI decapsulation path (ath11k_dp_rx_h_undecap_nwifi). Unauthenticated adjacent attackers within radio range (AV:A, PR:N, UI:N) against systems running the ath11k driver on supported Qualcomm Wi-Fi hardware - tested on WCN6855 hw2.1 PCI with WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 firmware - can trigger a malformed over-the-air frame that leads to kernel stack corruption and a crash; no public exploit has been identified at time of analysis. Independent assessment rates this CVSS 3.1 AV:A/AC:H/PR:N/UI:N/C:L/I:L/A:H, meaning the vendor/NVD score of 8.8 overstates real-world risk: the trigger path must be active, the attacker must be radio-adjacent, and the confirmed outcome is memory corruption/crash rather than demonstrated code execution.
Error recovery in the Linux kernel's nvme-fc (NVMe-over-Fibre-Channel) transport can abort in-flight requests against an io tagset that has not yet been allocated, producing a lockdep 'trying to register non-static key' warning and faulting the error-recovery path when a newly created controller in CONNECTING state loses connectivity. Affected systems are those running kernels before 6.12.111 or 6.18.53 (the fix is also merged for the 7.2 line), specifically hosts with NVMe-over-FC hardware such as an lpfc HBA; the trigger is an admin request timeout during controller connect caused by FC link loss, so it is a local availability/robustness defect rather than an attacker-supplied input, with no public exploit identified at time of analysis. The independent assessment rates this AV:L/AC:H/PR:L with availability-only impact and high attack complexity and, notably, the published CVSS 8.8 network-adjacent score is not supported by that analysis - the practical exposure is confined to FC-attached hosts whose connect path already failed.
Out-of-bounds read in the Linux kernel's cfg80211 wireless stack allows an attacker within 802.11 radio range to deliver a crafted, too-short association-response management frame - including the S1G variant with its distinct information-element offsets - which the client parses during the association window before frame length is validated, resulting in reads beyond the received buffer that can crash the kernel (availability impact) and expose limited adjacent memory. No authentication is required (CVSS PR:N) and no user interaction is needed, but exploitation is constrained to over-the-air proximity to a client that is actively associating on a vulnerable pre-patch kernel; a target with WiFi disabled or not associating is unaffected, there is no Internet reachability, and no public exploit code has been identified at time of analysis. Vendor patches are available for the affected stable and mainline branches.
Out-of-bounds array indexing in the Linux kernel's iwlwifi mvm wireless driver can crash the kernel and read a small amount of adjacent memory when a compromised or malicious Intel WiFi adapter firmware sends a BA_WINDOW_STATUS_NOTIFICATION containing an out-of-range station ID. Systems running affected kernels before 6.12.111 or before 6.18.53 with an active Intel WiFi device are in scope, but the attacker must already control the firmware-side notification, so the NVD CVSS 3.1 score of 8.8 (AV:A/AC:L/PR:N/UI:N) substantially overstates real-world risk. No public exploit code or confirmed active exploitation was identified at time of analysis.
Out-of-bounds reads and subsequent kernel instability in the Linux kernel's iwlwifi MVM driver (Intel WiFi) can be triggered when the WiFi firmware returns a malformed TX_CMD response whose frame_count does not match the actual response buffer layout. The affected code parses status entries by walking frame_count and then reads a trailing SCD SSN field without first validating that the buffer is long enough, so a malicious, compromised, or substituted device firmware can push the parser past the end of the payload, yielding limited information disclosure and, more likely, a kernel fault that takes down the driver or system. Systems running any Linux kernel built from the affected ranges (fixed in 6.12.111, 6.18.53, and 7.2) with an Intel WiFi adapter are exposed; there is no public exploit code and no confirmed active exploitation (CISA KEV) at time of analysis, and the practical attack surface is a firmware-to-host trust boundary rather than over-the-air radio traffic. Note that the supplied CVSS of 8.8 (AV:A/AC:L) overstates real-world risk; an independent assessment scores this AV:L/AC:H with confidentiality Low and availability High.
Out-of-bounds tid_data array access in the Linux kernel's iwlwifi mvm driver (CVE-2026-93790) is a theoretical flaw that writes the lq_color value into an unrelated tid_data slot, but it is not practically triggerable because multi-TID blockack is not in use, meaning the TFD loop counter 'i' is always 0 and the write remains in-bounds on unpatched systems. The affected component is the Intel iwlwifi mvm Wi-Fi driver in Linux kernel versions prior to 6.18.53, 6.12.111, and 7.2. An attacker within Wi-Fi radio range (adjacent, unauthenticated per the assessed CVSS vector) would need a contrived multi-TID blockack scenario to cause minor rate-control state corruption; no public exploit code exists and there is no evidence of active exploitation, so real-world risk is low.
SQL injection in Delta Electronics DIAEnergie before version 1.11.00.022 allows an attacker holding a valid low-privileged account to read from and write to the platform's backend database, putting the confidentiality, integrity, and availability of its operational data at risk. The flaw is network reachable (AV:N), requires only a low-privileged session (PR:L), and needs no user interaction; it is not confirmed as actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis. Delta released the fix in advisory PCSA-2026-00014 alongside a batch of related DIAEnergie flaws, including an authentication bypass (CVE-2026-78308) that could supply the very credentials this SQL injection depends on.
SQL injection in Delta Electronics DIAEnergie versions before 1.11.00.022 lets a remote attacker with any valid low-privileged account (CVSS PR:L) execute arbitrary SQL against the underlying database, resulting in full loss of confidentiality, integrity, and availability (CVE-2026-78309, CWE-89, base score 8.8). The flaw is network-reachable with low attack complexity and no user interaction, so it can be triggered directly over the DIAEnergie web interface, though valid credentials are required and the specific vulnerable parameter or endpoint has not been disclosed in the available data. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV), so the immediate risk is highest for internet- or IT-network-exposed deployments where low-privileged accounts are broadly issued. The advisory from Delta covers this CVE alongside five siblings (CVE-2026-78308 through CVE-2026-78313).
The Linux kernel's Thunderbolt XDomain (host-to-host / peer) service handling carries a lifetime defect: the service ID is released in tb_service_release() while the ID array that backs it is owned by the parent XDomain, so a service can outlive the XDomain reference it depends on and teardown of a Thunderbolt connection can access a freed/absent parent structure. The assessed practical outcome is a kernel crash (denial of service) with only limited integrity impact, and reaching the bug requires a system with the Thunderbolt driver active plus a physically attached Thunderbolt device or peer host to establish the XDomain connection - the supplied CVSS 8.8 vector (AV:A/AC:L, C:H/I:H/A:H) is significantly overstated versus the assessed physical-access, high-complexity vector (AV:P/AC:H, C:N/I:L/A:H). Vendor patches are available for the stable trees and mainline (5.10.266, 5.15.217, 6.12.111, 6.18.53, and 7.2), and no public exploit code was identified at time of analysis.
Type confusion in the AWS pgcollection PostgreSQL extension (versions 2.0.0 through 2.1.1) lets an authenticated remote database user execute arbitrary code as the postgres operating system user by submitting crafted SQL that triggers mismatched type metadata during collection value retrieval and array conversion. The flaw carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H), reflecting a network-reachable, low-complexity attack that requires only a valid low-privileged database role but yields full confidentiality, integrity and availability impact. AWS has released pgcollection 2.1.2 as the fix; no public exploit code has been identified at time of analysis, and exploitation is constrained to databases where the non-default extension is actually installed and where an attacker can execute the affected SQL functions.
Account takeover of WordPress sites running YOP Poll 7.0.10 or earlier is possible because the plugin transmits a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin, allowing any origin to capture the Administrator-scoped nonce. An unauthenticated attacker can then use the stolen nonce to change the Administrator's email address and password, but exploitation requires the logged-in Administrator to open an attacker-controlled page (UI:R) while the vulnerable plugin is active. No public exploit identified at time of analysis, and the independent assessment rates this as a genuine high-priority issue with CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Local authenticated users on systems running Linux kernel 6.17 or newer with GPU drivers that exercise drm/pagemap device-memory migration can, on the rare migration-error path, cause DMA mappings to remain after pages are released because drm_pagemap_migrate_unmap_pages() is called after the pages array has been cleared. This can lead to limited integrity and availability impacts within the affected subsystem. The input CVSS of 8.8 substantially overstates the real-world risk; independent assessment rates it 5.3 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L). No public exploit identified at time of analysis.
Authenticated remote code execution in the Honeywell PD45 Industrial Printer web management interface lets a user holding an admin or itadmin account write arbitrary files and run commands on the device by feeding Intermec Fingerprint programming-language instructions directly to the printer's internal command interpreter. Only firmware version F10.19.010040 is identified as affected, and exploitation is not possible pre-authentication: valid administrative credentials and network reachability to the management interface are both mandatory, which is why our independent assessment rates the privilege requirement as High (PR:H) rather than the vendor's Low. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; Honeywell addressed the flaw in firmware F10.22.030745.
ZITADEL Actions V1 on affected releases (3.0.0 through pre-3.4.13 and the 4.x line before 4.16.1) fails to restrict the goja Node-compatible require() registry, so an authenticated organization Action author holding ORG_OWNER, org.action.write, and org.flow.write can execute JavaScript at OIDC, SAML, or login-flow triggers and load arbitrary files readable by the ZITADEL server process. This exposes mounted configuration and secrets - notably credentials referenced by ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH and ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH - and recovered bootstrap credentials can let an organization administrator escalate to instance administrator; host command execution is not established. CVSS 3.1 base score is 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), reflecting a high-privilege prerequisite; no public exploit code has been identified at time of analysis, and the issue is patched in 3.4.13 and 4.16.1.
CPU starvation and JVM heap exhaustion in Gerrit Code Review (versions 2.1.6 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2) let remote attackers stall or crash the server by submitting crafted regular expressions through search queries (RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate and sibling predicates) or through the REST regex filter endpoints /projects/?r= (RegexListSearcher) and /projects/{project}/branches/?r= (RefFilter). Patterns built from large counted repetitions or exponential DFA-determinization shapes are compiled into an unbounded dk.brics.automaton instance on the request thread before index evaluation and before access-control visibility filtering, so trivial requests can pin request threads or trigger OutOfMemoryError regardless of configured heap size. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (availability-only, high impact), and exploitation is fully unauthenticated only where anonymous read access is enabled - if anonymous read is disabled an authenticated account is required. No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is fixed in 3.12.10, 3.13.9, and 3.14.3.
Uncontrolled resource consumption in Gerrit Code Review (versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2) allows unauthenticated remote attackers to cause a persistent denial of service by sending search queries containing deeply nested parentheses to query evaluation endpoints such as /changes/?q=, /accounts/?q=, or the SSH 'gerrit query' command. A small number of requests - roughly 25 to match the default httpd.maxThreads - can permanently pin all HTTP worker threads because the ANTLR 3 query parser recurses without memoization before capability or visibility checks and worker threads do not abort when clients disconnect, requiring a server restart. This is assessed as a genuine operational priority for Gerrit operators; no public exploit code or active exploitation has been identified at time of analysis.