Account takeover of WordPress sites running YOP Poll 7.0.10 or earlier is possible because the plugin transmits a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin, allowing any origin to capture the Administrator-scoped nonce. An unauthenticated attacker can then use the stolen nonce to change the Administrator's email address and password, but exploitation requires the logged-in Administrator to open an attacker-controlled page (UI:R) while the vulnerable plugin is active. No public exploit identified at time of analysis, and the independent assessment rates this as a genuine high-priority issue with CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Local authenticated users on systems running Linux kernel 6.17 or newer with GPU drivers that exercise drm/pagemap device-memory migration can, on the rare migration-error path, cause DMA mappings to remain after pages are released because drm_pagemap_migrate_unmap_pages() is called after the pages array has been cleared. This can lead to limited integrity and availability impacts within the affected subsystem. The input CVSS of 8.8 substantially overstates the real-world risk; independent assessment rates it 5.3 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L). No public exploit identified at time of analysis.
Authenticated remote code execution in the Honeywell PD45 Industrial Printer web management interface lets a user holding an admin or itadmin account write arbitrary files and run commands on the device by feeding Intermec Fingerprint programming-language instructions directly to the printer's internal command interpreter. Only firmware version F10.19.010040 is identified as affected, and exploitation is not possible pre-authentication: valid administrative credentials and network reachability to the management interface are both mandatory, which is why our independent assessment rates the privilege requirement as High (PR:H) rather than the vendor's Low. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; Honeywell addressed the flaw in firmware F10.22.030745.
ZITADEL Actions V1 on affected releases (3.0.0 through pre-3.4.13 and the 4.x line before 4.16.1) fails to restrict the goja Node-compatible require() registry, so an authenticated organization Action author holding ORG_OWNER, org.action.write, and org.flow.write can execute JavaScript at OIDC, SAML, or login-flow triggers and load arbitrary files readable by the ZITADEL server process. This exposes mounted configuration and secrets - notably credentials referenced by ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH and ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH - and recovered bootstrap credentials can let an organization administrator escalate to instance administrator; host command execution is not established. CVSS 3.1 base score is 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), reflecting a high-privilege prerequisite; no public exploit code has been identified at time of analysis, and the issue is patched in 3.4.13 and 4.16.1.
CPU starvation and JVM heap exhaustion in Gerrit Code Review (versions 2.1.6 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2) let remote attackers stall or crash the server by submitting crafted regular expressions through search queries (RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate and sibling predicates) or through the REST regex filter endpoints /projects/?r= (RegexListSearcher) and /projects/{project}/branches/?r= (RefFilter). Patterns built from large counted repetitions or exponential DFA-determinization shapes are compiled into an unbounded dk.brics.automaton instance on the request thread before index evaluation and before access-control visibility filtering, so trivial requests can pin request threads or trigger OutOfMemoryError regardless of configured heap size. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (availability-only, high impact), and exploitation is fully unauthenticated only where anonymous read access is enabled - if anonymous read is disabled an authenticated account is required. No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is fixed in 3.12.10, 3.13.9, and 3.14.3.
Uncontrolled resource consumption in Gerrit Code Review (versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2) allows unauthenticated remote attackers to cause a persistent denial of service by sending search queries containing deeply nested parentheses to query evaluation endpoints such as /changes/?q=, /accounts/?q=, or the SSH 'gerrit query' command. A small number of requests - roughly 25 to match the default httpd.maxThreads - can permanently pin all HTTP worker threads because the ANTLR 3 query parser recurses without memoization before capability or visibility checks and worker threads do not abort when clients disconnect, requiring a server restart. This is assessed as a genuine operational priority for Gerrit operators; no public exploit code or active exploitation has been identified at time of analysis.
Transactions built through a remote StorageClient in @bsv/wallet-toolbox 1.1.47 through 2.3.3, @bsv/wallet-toolbox-client 1.1.47 through 2.3.3, and @bsv/wallet-toolbox-mobile 1.3.21 through 2.3.3 can be silently redirected by a malicious or compromised storage provider, which returns output locking scripts the wallet signs without confirming they match the caller's request. Because the provider can substitute a recipient script or append an attacker-controlled output funded by shrinking change, the wallet broadcasts a transaction paying the attacker while the application and user interface still display the intended recipient; the integrity impact is high with no confidentiality or availability effect, and no authentication against the victim wallet is required (CVSS 4.0 8.7, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Exploitation requires the application to use a remote StorageClient backend the attacker controls and the user to initiate a transaction through it - local-storage applications and those that independently verify outputs are unaffected; no public exploit code has been identified at time of analysis and the issue is patched in 2.4.0.
Botslab G980H dash camera firmware can leave a client's authentication state valid after that client's connection is terminated or displaced by a newly established connection, allowing an unauthenticated attacker with adjacent network access (same Wi-Fi/link-layer segment) to potentially reach functionality belonging to the displaced client's session (CWE-613). Exploitation is not internet-remote and is further gated by a race condition: the attacker must connect during the narrow window before the separate session-expiration mechanism invalidates the residual authenticated state, which is why an internal assessment scores the attack complexity as High (CVSS:3.1/AV:A/AC:H/PR:N/UI:N). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the affected CPE is a wildcard covering all firmware versions.
Session-hijacking authorization bypass in Botslab G980H dash camera firmware lets an attacker on the adjacent network (the camera's Wi-Fi/link-local segment) reach privileged, session-gated commands by presenting a session identifier that belongs to a different, already-authenticated client, because the firmware never binds session state to the connection that created it (CWE-863). Successful abuse gives high impact to confidentiality, integrity and availability of the camera itself - full compromise of the device's privileged functionality - though exploitation is not opportunistic: an attacker must be within adjacent-network range and a legitimate client must already hold a live authenticated session whose identifier can be obtained or replayed. The vendor CVSS 4.0 base score is 8.7 (High, AV:A/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H), while our independent CVSS 3.1 assessment rates it AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to reflect the session-hijack precondition; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Unauthenticated data disclosure in ServiceNow AI Platform instances stems from an authorization bypass (CVSS 8.7) that lets remote attackers read records they are not entitled to access. ServiceNow has already remediated its hosted instances, so exposure now concentrates on self-hosted and partner-managed deployments that have not applied the KB3159623 update or upgraded to a patched release. No public exploit code has been identified and no confirmed active exploitation (CISA KEV) has been reported, yet this remains a genuine priority for ServiceNow customers even in the absence of exploitation telemetry.
Unauthenticated network requests against unpatched ServiceNow AI Platform instances can create, modify, or delete instance data beyond what was intended, per a vendor-remediated improper access control flaw rated 8.7 under CVSS 4.0 (independent assessment: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Impact is integrity-only - no confidentiality or availability loss is described - and ServiceNow scopes exploitation to "certain circumstances," so the flaw is not universally reachable on every default deployment and undisclosed configuration preconditions appear to gate it. ServiceNow patched hosted instances in August 2026 and shipped the update to partners and self-hosted customers, leaving residual exposure concentrated in self-hosted and partner-managed instances that have not yet applied it. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Stored cross-site scripting in Discourse's video-placeholder component lets an authenticated user with default trust-level posting privileges embed a crafted video URL in a post that breaks out of the placeholder's data-video-src attribute and injects an attacker-controlled event handler, which fires when another user opens the post and clicks the video play overlay. Exploitation is gated by three independent conditions - a valid posting account (CVSS PR:L, so authenticated), the target instance running with its Content Security Policy disabled or relaxed (the default CSP blocks inline event handlers and defeats the attack), and specific victim interaction (UI:R) - so realistic risk is materially lower than the 8.7 base score implies; our assessment rates it AC:H with only low confidentiality and integrity impact. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and the vendor has released fixed versions 2026.1.8, 2026.6.3, 2026.7.2 and 2026.8.0.
Denial of service in NodeRedis redis-parser through 3.0.0 lets a hostile or hijacked Redis endpoint crash the Node.js client process by returning a crafted RESP multi-bulk header whose declared length exceeds 2^32-1, triggering an uncaught RangeError during parsing. The flaw is reachable by unauthenticated remote attackers (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N) but its impact is strictly availability (VA:H) - no confidentiality, integrity, or scope impact - so a malicious server, a compromised legitimate Redis instance, or an on-path injector in the RESP response stream can only take down the parsing process. Rated 8.7 (HIGH) by CVSS 4.0, with no public exploit identified at time of analysis and no confirmed vendor-released patch, though the issue is publicly tracked upstream.
Authenticated root-level command execution in the Netlink ICT HG323RW router lets an attacker who already holds valid low-privilege credentials on the adjacent network upload a crafted diagnostic script through the web management interface, which the device then executes with root privileges and is fully compromised as a result. The prerequisites matter: the attacker must be able to reach the router's web management interface (normally confined to the LAN/local segment rather than the public internet) and must supply valid credentials, so real-world exposure is narrower than the raw severity suggests. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so prioritization should be driven by asset footprint and the presence of these devices on untrusted or shared network segments rather than by active exploitation.
Heap-based buffer overflow in the Nanomsg WebSocket transport (versions 0.5-beta through 1.x before 1.2.3) allows remote attackers to corrupt heap memory by sending an oversized Sec-WebSocket-Version header during the WebSocket handshake, which is processed before any authentication or user interaction takes place. Exploitation requires that the target application actually enable and expose nanomsg's ws transport; TCP- or IPC-only deployments are unaffected. The flaw yields high integrity and availability impact, and while reliable code execution depends on heap layout and platform, no public exploit code has been identified at time of analysis and the vulnerability is not confirmed as actively exploited (not in CISA KEV).
Server-side request forgery in the BentoPDF certificate/timestamp CORS proxy (cloudflare/cors-proxy-worker.js) allows unauthenticated remote attackers to relay requests to internal, reserved, or cloud-metadata destinations when the Worker is hosted on a non-Cloudflare runtime. The flaw is a time-of-check/time-of-use gap: isPrivateOrReservedHost() validates the supplied hostname separately from the DNS resolution performed by fetch(targetUrl), so an attacker who controls a domain's DNS with a very low TTL can pass validation with a public address and have the fetch land on a private one; a certificate-like path satisfies ALLOWED_PATH_PATTERNS, and the browser-oriented Origin header can simply be forged by a direct client, with PROXY_SECRET being only an anti-abuse measure that ships in the public client bundle. Affected versions are 2.8.6 and earlier, fixed in 2.8.7; no public exploit code or confirmed active exploitation was identified at time of analysis, and the assessment rates exploitation as high-complexity because it is gated on a non-default off-Cloudflare deployment that can actually route to internal addresses plus a DNS-rebinding timing race.
Amazon Kiro IDE versions before 1.0.242 can have attacker-controlled content written into the agent's auto-loaded global configuration directory (~/.kiro) when a user opens a crafted repository as an untrusted workspace and then sends any message to the agent. The flaw (CWE-829, inclusion of functionality from an untrusted control sphere) is an indirect prompt-injection chain: the agent's file-write tool is steered by repository-supplied instructions rather than by a direct network request, so the attacker does not need credentials (CVSS PR:N) but does depend on victim interaction (CVSS UI:A). Exploitation is not confirmed as active and no public exploit code was identified at time of analysis. Risk is rated High (vendor CVSS 4.0 base 8.6; independent CVSS 3.1 assessment AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L), with the dominant impact being integrity compromise of the developer's global Kiro configuration.
Missing authentication for a critical device function in Dell ThinOS 10 (all versions prior to SecurityAddon_2605.10.2766_T10) allows an unauthenticated remote attacker who can reach the exposed function to gain unauthorized access to it, reflected in a CVSS:3.1 base score of 8.6 under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L, where the high integrity impact dominates and confidentiality and availability effects are limited. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a genuine priority signal rather than a confirmed-exploited emergency. The main practical constraint on exploitation is network reachability: ThinOS endpoints are typically deployed inside enterprise/VDI network segments rather than exposed to the public internet, so meaningful risk arises when an attacker already has a foothold on a segment from which the affected service can be reached.
SQL injection in IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1 allows remote unauthenticated attackers to view, add, modify, or delete back-end database information. The flaw (CWE-89) carries a CVSS 3.1 base score of 8.6, with an independent assessment vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, indicating high confidentiality and integrity impact and low availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but a vendor patch is available via IBM support.
Server-side request forgery in Logto prior to 1.43.0 allows an authenticated tenant administrator to point outbound connections at internal, loopback, link-local, or cloud metadata addresses and read the resulting response back through API errors, crossing the deployment's network boundary. The flaw affects webhook delivery (including POST /api/hooks/:id/test), custom OAuth2 connectors that forward the OAuth access token in the Authorization header to an attacker-chosen userInfoEndpoint, OIDC SSO discovery/token/userinfo requests and jwksUri fetching, and SAML IdP metadata retrieval. Rated CVSS 4.0 8.5 (HIGH), driven by the high-privilege PR:H precondition and subsequent-system impacts; no public exploit code or confirmed active exploitation was identified at time of analysis, and the highest-impact outcome (credential theft) depends on whether the deployment exposes a reachable cloud metadata endpoint such as 169.254.169.254. Vendor-released patch: 1.43.0.
Taskview Community before 1.56.0 ships its OAuth 2.0 Dynamic Client Registration endpoint enabled by default and reachable without authentication, letting any remote unauthenticated attacker register a rogue OAuth client and obtain a working client_id and client_secret. The attacker then distributes a crafted authorization link that redirects to an attacker-controlled URI, and once the victim approves the consent screen the captured authorization code is exchanged for an access token granting full API access to that victim's account data. No public exploit identified at time of analysis, but with a CVSS 4.0 score of 8.5 and high confidentiality and integrity impact this is a high-priority account-takeover flaw; because exploitation depends on victim interaction it is delivered through phishing-style social engineering rather than a silent compromise.
Pre-shared keys used for IPsec tunnel configuration are recorded in cleartext inside application log files by Brocade SANnav versions before 3.0.1a, so anyone who can read those logs or an exported support bundle can recover credentials that protect network tunnels. The exposure is triggered only when IPsec policies are actually created or modified in SANnav, and the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a local, authenticated precondition rather than anonymous remote reach, meaning an insider or a holder of an exported bundle is the realistic actor. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so priority should be driven by the sensitivity of the logged keys and by how broadly log files and support bundles are shared; the vendor has addressed it in 3.0.1a.
Plaintext disclosure of administrative switch credentials and live session tokens in Brocade SANnav discovery-service log files lets anyone who can read those logs - or who is handed an exported support bundle - recover credentials that unlock the managed SAN fabric. All SANnav releases before 3.0.1a are affected, and the logging occurs under default configuration, so the only barrier is obtaining local read access to the log directory or bundle; the CVSS v3.1 assessment (8.5, AV:L/AC:L/PR:L/UI:N, C/I/A:H) and the vendor-published CVSS v4.0 vector (8.5) both place this at high severity because a successful read escalates into full compromise of managed switches and active user sessions. Exploitation is access-gated rather than remote or unauthenticated, and no public exploit identified at time of analysis; there is no CISA KEV listing for this CVE. Actual fabric compromise is a second step contingent on the disclosed credentials still being valid and the switches being reachable.
Converting an attacker-supplied .docx file with mammoth.js before 1.12.2 allows unauthenticated remote attackers to inject arbitrary properties into Object.prototype via the document's style definitions (CWE-1321 prototype pollution). In versions 1.11.0 through 1.12.1 the pollution can additionally be leveraged to read local server files and disclose them to the document supplier, but only where the application converts further documents in the same long-lived Node.js process and returns the converted HTML back to that party. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; vendor-released patch: 1.12.2.
Stored cross-site scripting in Snipe-IT versions before 8.7.0 lets an authenticated user holding only the customfields.create permission embed HTML/JavaScript in a CustomField.name value, which is rendered unescaped as an asset-list column header title and executes on page load for any user who opens a list tied to the affected fieldset. Since customfields.create is delegable to non-superusers, the injected script runs in a higher-privileged victim's session - the vendor advisory demonstrates an account with no permissions beyond customfields.create issuing authenticated requests in a superuser's session to grant itself superuser rights. Publicly available exploit code exists (reproduction steps and SSVC exploitation state of 'poc'), CISA's SSVC assessment rates technical impact as total, while EPSS remains low at 0.30% (21st percentile) and there is no KEV listing indicating confirmed actively exploited (CISA KEV) activity at time of analysis.
MrSteam iSteamX mobile app and hub users can have their device telemetry and control exposed because the pre-9/18/2026 AWS IoT policy allowed any authenticated app user to subscribe and publish to wildcard MQTT topics. An attacker with a valid iSteamX account and knowledge of the topic namespace can read other users' profile/device data, start or stop connected steam devices, and potentially cause scalding through unintended activation. The flaw requires low-privilege authentication (PR:L) and no victim interaction; it was remediated server-side before 9/18/2026, and no public exploit identified at time of analysis.
Kernel crashes in the Linux kernel's ACPI/AML interpreter can be triggered when acpi_ut_copy_simple_object() adds invalid references for local, argument, or debug objects while processing crafted ACPI tables. Affected versions include Linux kernels before 6.18.53 on the 6.18.y branch, before 6.12.111 on the 6.12.y branch, and upstream before the fix in 7.2; patching is available. No public exploit or KEV listing is identified at time of analysis, and although the published CVSS is 8.4, the independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H because exploitation requires privileged ACPI table injection or malicious firmware and realistically causes denial of service rather than code execution or disclosure.
Integer overflow in the Linux kernel's ACPICA AML interpreter allows memory corruption and a likely kernel crash when a crafted Mid() (three-operand) AML operation is evaluated with operand values chosen so that Index + Length wraps around. Affected are Linux kernels before 6.12.111, before 6.18.53, and before 7.2 in the mainline tree, as tracked under CPE cpe:2.3:a:linux:linux and EUVD-2026-86064. This is not remotely reachable: exploitation realistically requires either the ability to supply malicious ACPI firmware tables (DSDT/SSDT) or root/CAP_SYS_ADMIN-level access such as via debugfs custom_method, so an ordinary unprivileged local user cannot trigger it on a default configuration; no public exploit has been identified at time of analysis, and vendor patches are available. Note that the NVD CVSS of 8.4 (AV:L/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates real-world risk for this class of Linux-kernel ACPICA flaw; our assessment rates it AV:L/AC:H/PR:H/UI:N with impact dominated by kernel memory corruption and denial of service rather than a realistic full confidentiality/integrity compromise.
The Linux kernel's ACPICA interpreter fails to validate the object type of handler objects in acpi_ev_has_default_handler() and acpi_ev_find_region_handler(), so malformed or crafted ACPI/AML tables can drive those paths to operate on a handler of an unexpected type. Exploitation is local and practical only for an attacker who can supply the AML - most plausibly by overriding ACPI tables via CONFIG_ACPI_CONFIGFS table loading (which normally requires CAP_SYS_ADMIN) or by controlling platform firmware/DSDT, and no public exploit or confirmed active exploitation was identified at time of analysis. Our independent assessment rates real-world risk substantially below the published NVD CVSS 3.1 score of 8.4, since the attack is local, depends on a non-default custom-table-loading configuration, and yields integrity/availability impact rather than code execution.
A use-after-free in the Linux kernel's ACPICA AML interpreter, reached through acpi_ds_terminate_control_method(), fails to clear references to a control method's locals and arguments on termination, leaving dangling pointers that can crash the kernel (denial of service). Affected are kernels built from the pre-fix code through the stable branches below 6.12.111 and 6.18.53 and the 7.2 line, with the CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* applying to unpatched builds; triggering requires control of ACPI/AML content - malicious platform firmware supplying crafted DSDT/SSDT tables, or a local user with CAP_SYS_ADMIN injecting AML via configfs/ACPI custom_method - so there is no remote or unprivileged path on default configurations, and the practical outcome is predominantly a kernel crash rather than reliable code execution. Vendor-released patches are 6.12.111, 6.18.53 and 7.2; no public exploit identified at time of analysis.
Authorization bypass in the ServiceNow AI Platform lets any authenticated user with an ordinary low-privilege account read records and data they are not entitled to, and because the flaw crosses a security scope boundary it can also enable further unintended access on resources beyond the vulnerable component. Exploitation is network-reachable and requires only a valid low-privilege session - no elevated role, no user interaction, and no special client configuration - so the practical attack path is a compromised, internal, or low-tier tenant account rather than an anonymous attacker. ServiceNow has already remediated hosted instances and distributed the update to partners and self-hosted customers, and the vendor states it is not aware of malicious exploitation; no public exploit code or CISA KEV entry was identified at time of analysis, leaving unpatched self-hosted and partner deployments as the primary exposure.
A double-free in the Linux kernel's virtio-fs driver can corrupt kernel memory when a virtiofs device advertises more request queues than its transport actually provides, causing virtio_find_vqs() to fail during probe and the cleanup path to free fs->vqs and fs->mq_map twice. The flaw is reachable only from the device/hypervisor side: a guest must be running with a malicious or malfunctioning virtio-fs device, and the bug triggers solely on the probe-failure cleanup path, so it is not reachable in default configurations that do not attach a hostile virtio-fs device. Independent assessment rates this CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H (local, high attack complexity, low integrity and high availability impact), which is materially lower and narrower than the published CVSS 8.4 that assumes PR:N and full integrity impact; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and EUVD's 'Information Disclosure' tag conflicts with the double-free / availability-focused nature of the defect.
Authenticated, low-privileged WordPress users can read other accounts' non-public event and venue content - including unpublished, pending and trashed events and full street addresses - on sites running the Events Manager plugin before 7.4.5, because the logged-in event and location search does not force the search scope to the caller when a custom 'owner' value is supplied. Any account on the target site (subscriber-level or similar) is sufficient and no user interaction or administrative rights are required, making this a read-only information disclosure rated CVSS 4.3 (MEDIUM) and described by CISA's SSVC assessment as non-automatable with partial technical impact. Publicly available exploit code exists, but there is no confirmed active exploitation (the issue is not listed in CISA KEV), and the vendor has addressed it in version 7.4.5.
Any authenticated user of a WordPress site running the Masteriyo LMS plugin before 3.4.2 can retrieve the correct answer keys for quizzes across the entire site, including quizzes belonging to courses they are not enrolled in, because the plugin's answer-redaction routine only covers a fixed list of question types and returns every other type's answers in full. The issue requires only a low-privileged account such as a student (CVSS vector PR:L, base score 4.3) and publicly available exploit code exists; however, CISA's SSVC assessment rates the flaw non-automatable with only partial technical impact, and there is no KEV listing or other evidence of active exploitation in the wild at time of analysis.
Missing authorization checks in the MasterStudy LMS WordPress plugin before 3.7.50 let any authenticated user - including a self-registered subscriber - record lesson completions for courses they are not enrolled in, corrupting course-progress and completion data. Exploitation requires only a low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), with no administrative rights and no user interaction, and publicly available exploit code exists (no CISA KEV entry, so confirmed active exploitation is not established). Impact is limited to integrity of progress records - there is no confidentiality or availability effect - making this a genuine but low-severity data-integrity flaw rather than an emergency.
Any authenticated WordPress user - down to the lowest-privilege Subscriber role - can invoke an administrative maintenance action in the MasterStudy LMS plugin (versions 2.3.0 through before 3.7.50) because the handler performs no capability check and no nonce verification, resulting in published content created and attributed to the attacker's own account. The network-reachable, PR:L vector (CVSS 3.1 4.3, CWE-862) means the only real prerequisite is obtaining a login, which is trivial on LMS sites that permit open self-service registration and a genuine limiter where registration is closed; no user interaction or admin rights are needed, and the assessed impact is integrity-only. Publicly available exploit code exists via the WPScan advisory, but there is no CISA KEV listing and SSVC rates exploitation as none, so this is a low-to-moderate priority finding rather than an actively exploited one; a vendor patch is available in 3.7.50.
Masteriyo LMS, a WordPress learning-management plugin, discloses the course-progress and learning-activity records of every learner on a site to any authenticated user in versions before 3.4.2. Exploitation requires only a valid, low-privileged WordPress account - a self-registered Subscriber is sufficient - because the endpoint's ownership check is skipped when the requested account is not supplied as a non-zero value, causing a site-wide dump of all learners' records. Publicly available exploit code exists; the issue is rated modest priority (CVSS 4.3, confidentiality-only, no write or code-execution impact) and no confirmed active exploitation has been reported.
Improper TLS certificate validation in Dell ThinOS 10 endpoints running SecurityAddon builds prior to 2605.10.2766_T10 lets an adjacent-network attacker bypass a protection mechanism and gain unauthorized access to client communications and credentials. The flaw is rated CVSS 8.3 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), meaning no authentication or user interaction is required, but the attacker must already sit on the same Layer-2 segment, VLAN, or Wi-Fi network as the thin client to position themselves for a machine-in-the-middle interception. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a genuine elevated-priority issue rather than an emergency - the practical risk is driven by how flat and trusted the thin-client network segment is.
Attackers can inject arbitrary additional servers into a PyMongo (MongoDB Python Driver) client's connection topology by smuggling the percent-encoded form of a host-list delimiter (for example %2C) inside a hostname value that an application places into a connection string, because PyMongo decodes percent-escapes before it splits the host list. The request is unauthenticated (CVSS 4.0 PR:N) but carries an attack-requirement prerequisite (AT:P): the target application must build a URI at runtime from a host the attacker can influence, meaning static or hardcoded connection strings are not exploitable. MongoDB's own CVSS 4.0 rating of 8.3 (High) is driven by a high integrity impact - the client may route its authentication exchange and subsequent database operations to the rogue host, which can observe limited information and return altered query results. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in PyMongo 4.18.2.
Heap out-of-bounds write in the MongoDB C Driver (libmongoc) allows an unauthenticated attacker who controls DNS resolution and the responses of hosts in a client's connection string to corrupt memory and crash the application. Exploitation requires a privileged network position (MITM or rogue server) and results in denial of service, not code execution or data disclosure. Patched versions 1.30.12 and 2.5.5 are available; no public exploit code or active exploitation has been identified at time of analysis.
A stack-based buffer overflow in Altera Trusted Firmware (the ARM Trusted Firmware-A port for Altera/Intel SoC FPGA Hard Processor Systems) through socfpga_v2.14.0 lets a high-privileged local attacker corrupt a fixed-size stack buffer inside the secure monitor and cross the normal-world-to-secure-world trust boundary. The attacker must already control the normal-world OS on the affected HPS device (CVSS vector PR:H, AV:L, UI:N), so this is an access-gated escalation primitive rather than a remotely reachable issue; the assessed impact is high integrity and availability loss with limited confidentiality exposure in the secure world (CVSS 8.3). No public exploit code has been identified at time of analysis, and no evidence of active exploitation was provided by the vendor or in the supplied intelligence.
Local, high-privileged attackers who can invoke the ARM Trusted Firmware secure-monitor interface on Altera SoCFPGA Hard Processor System (HPS) devices can exploit an untrusted pointer dereference (CWE-822) in Trusted Firmware builds through socfpga_v2.14.0, achieving high integrity and availability impact within the secure world while confidentiality impact is limited. Exploitation requires prior privileged code execution in the normal world to pass a crafted pointer via SMC calls; there is no remote or network-facing exposure and no user interaction. No public exploit code or confirmed active exploitation was identified at the time of analysis.
Privileged local code running in the non-secure world of an Altera SoC FPGA HPS device can make Altera Trusted Firmware dereference an attacker-supplied pointer, corrupting firmware memory protections and crossing the normal/secure-world boundary in all releases up to and including socfpga_v2.14.0. Rated CVSS 8.3 (v4.0) with high integrity and availability impact, the flaw is real but narrow in scope: exploitation requires an already-high-privileged, locally-positioned attacker (PR:H, AV:L, no user interaction), so realistic exposure is limited to actors who have already compromised the running system or its supply chain. No public exploit code has been identified at time of analysis, and neither CISA KEV listing, EPSS score, nor a confirmed patched version was provided in the available data.
Out-of-bounds read in Altera Trusted Firmware for SoCFPGA hard processor systems (all builds through socfpga_v2.14.0) lets an attacker who already holds high privileges in the normal world corrupt or read beyond intended memory bounds inside the secure monitor, enabling escalation from the non-secure HPS environment into the secure world. Exploitation requires local access and pre-existing root-level code execution (CVSS PR:H), so it is not a remote or pre-authentication vector; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. The independent assessment rates this a genuine but access-limited priority given the privileged local precondition.
Local privilege escalation in Altera Trusted Firmware (TF-A) on socfpga Hard Processor Systems lets an attacker who already holds high privileges on the normal-world OS drive an out-of-bounds read inside the secure monitor, exposing and corrupting secure-world memory and escalating execution context, in all versions through socfpga_v2.14.0. The flaw is reachable only by invoking secure-monitor calls from an already-privileged local context, with no network vector and no user interaction, but because it crosses the normal-world/secure-world boundary it yields high integrity and availability impact beyond the vulnerable component (CVSS 4.0 base 8.3; independent assessment CVSS 3.1 8.3). No public exploit code has been identified and the issue is not listed in CISA KEV, so exposure is confined to devices where an adversary has already achieved privileged local execution.
Privilege-gated out-of-bounds write in Altera Trusted Firmware (the SoCFPGA port of ARM Trusted Firmware-A) through socfpga_v2.14.0 allows an attacker who already holds high privileges in the normal world to corrupt memory in the secure firmware, degrading the integrity and availability of the trusted execution environment and extending the scope of compromise beyond the attacker's original context. The root cause is an improperly configured or implemented memory protection (CWE-787) that is reachable only from a local, already-privileged position on Altera/Intel SoC FPGA Hard Processor System platforms, so it is not remotely reachable and does not affect general-purpose systems; no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV).
Buffer overflow in Altera Trusted Firmware (ARM Trusted Firmware-A) running on the Hard Processor System (HPS) of socfpga FPGA SoCs lets a locally-positioned attacker who already holds high privileges corrupt firmware memory through an incorrectly calculated buffer size. All Trusted Firmware releases up to and including the socfpga_v2.14.0 branch are affected, and exploitation requires local access combined with high-privileged normal-world code execution capable of reaching the firmware's service interface - the flaw is not remotely reachable and cannot be triggered by an unprivileged user. There is no confirmed active exploitation and no public exploit identified at time of analysis; the assessed risk is primarily post-compromise privilege and trust escalation on the specific embedded hardware, with real-world exposure constrained by the local, high-privilege prerequisite.
A stack-based buffer overflow in Altera's Trusted Firmware port for SoC FPGA devices (the SoCFPGA branch through socfpga_v2.14.0) lets a local attacker who already controls the non-secure rich OS - root or kernel on the HPS ARM cores - corrupt the secure monitor's stack via the SMC interface and potentially escalate across the trust boundary into the secure world. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H) confirms this is an access-gated privilege/trust-boundary escalation requiring an existing high-privileged foothold, not a remotely reachable default-configuration flaw; impact to integrity and availability is high and scope is changed, but confidentiality impact is limited. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV).
MFA bypass in ZITADEL Login V2 (versions 4.0.0 through 4.16.0) lets an attacker who already holds a victim's valid first-factor password complete an OIDC or SAML login to a customer application without ever satisfying the user's voluntarily enrolled TOTP, OTP, or U2F second factor. The browser session created after password verification is reused when the login flow is abandoned at the MFA step and restarted, and the pre-fix session-validity check only demanded MFA when the organization had Force MFA or Force MFA for local users enabled. The assessed CVSS 3.1 vector is 8.2 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) reflecting the requirement of the victim's password; Login V1, the ZITADEL Console, Management/Admin APIs, and user self-management are unaffected, a vendor patch is available as 4.16.1, and no public exploit code has been identified at time of analysis.
An authorization gap in OpenWA before 0.23.5 allows a low-privilege VIEWER API key to receive the `session.qr` pairing event over the /events WebSocket gateway, even though the equivalent REST endpoint GET /api/sessions/{sessionId}/qr enforces the OPERATOR role. When a session is in the waiting-to-be-paired state, the leaked QR code lets the key holder link an external device to the linked WhatsApp account, after which they can read and send messages outside OpenWA and outside its audit trail. Exploitation is authenticated (CVSS PR:L) and gated by a transient pairing window that drives the high attack-complexity rating (AC:H); no public exploit code identified at time of analysis. Vendor-released patch: 0.23.5.