Unauthenticated SQL injection in Piwigo 17.0.0beta1 and earlier lets anonymous guests read arbitrary database contents through the public photo-search flow whenever the rating feature is enabled. An attacker calls pwg.images.filteredSearch.create with a crafted ratings[] value and then opens the returned search URL; because only the lower rating bound is integer-cast while the raw upper bound is concatenated directly into the SQL filter, error-based and blind extraction - plus database-dependent time delays - become possible over the network with no credentials or user interaction. The independent assessment rates confidentiality impact as High with no Integrity or Availability impact, and upstream fixes exist only as commits (9755d88, aede490) with no released patched version identified at time of analysis; no public exploit code or confirmed active exploitation was identified.
Source-IP spoofing in Zoraxy 3.2.3 through 3.3.4 lets unauthenticated attackers who reach the service over IPv6 forge X-Forwarded-For and X-Original-IP values, so IP-based access controls enforced by Zoraxy's SSO forward-auth provider see a trusted client address and grant access (CWE-290). The 9.1 CVSS 4.0 severity reflects fully unauthenticated remote exploitation (PR:N), but our independent assessment (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) rates the real-world risk lower because exploitation requires IPv6 connectivity and a deployment that actually relies on forward-auth IP allowlisting as a security boundary, so IPv4-only or non-IP-gated instances are not exploitable. No public exploit code was identified at time of analysis and there is no KEV entry, though a vendor patch is available.
An authorization-code interception attack against public OIDC Relying Parties on LemonLDAP::NG::Portal 2.23.0 through 2.23.3 lets an attacker redeem a stolen code for the victim's access, ID and refresh tokens without knowing the client secret, which is precisely the theft PKCE is designed to prevent. The flaw only applies to Relying Parties flagged as public while oidcRPMetaDataOptionsRequirePKCE is set to 2 ('PKCE or secret' mode), a configuration that Dynamic Client Registration creates automatically for every RP, making exposure broad on affected deployments. Exploitation is not confirmed in the wild (no CISA KEV listing), but publicly available exploit code exists and CISA SSVC rates the issue exploitable with total technical impact; EPSS is only 0.22% (11th percentile), and the independent assessment sets attack complexity to High because the attacker must first obtain a valid authorization code issued to a public RP before the token exchange succeeds. No authentication is required for the token-endpoint step (CVSS PR:N), and the victim's only involvement is completing a normal login.
Unauthenticated OAuth2 token introspection against LemonLDAP::NG Portal lets an attacker who already holds a valid access token and knows the client_id of any Relying Party configured as 'public' confirm that the token is active and read its metadata, including scope, audience, expiry and the sub claim. The flaw sits in checkEndPointAuthenticationCredentials(), which skips the client-secret comparison for public Relying Parties yet still reports a deduced authentication method (client_secret_basic or client_secret_post), so a request with a public client_id and an arbitrary or empty secret passes introspection()'s authentication gate in versions 2.20.0 before 2.21.6 and 2.22.0 before 2.23.4. Because the returned sub is computed using the calling Relying Party's user identifier attribute, an attacker can correlate a user identifier across Relying Parties, defeating per-client and pseudonymous identifiers; CVSS vector PR:N makes this unauthenticated at the protocol level, but in practice exploitation requires possession of a live token plus knowledge of a public client_id, so no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is 0.21% (10th percentile). Vendor patches are released as 2.21.6 and 2.23.4.
Blind server-side request forgery in OpenMetadata through 2.0.2 allows an authenticated user holding permission to create or update an EventSubscription to point a WEBHOOK destination at internal hosts, loopback addresses, or the cloud metadata endpoint 169.254.169.254, because URLValidator.validateURL neither resolves DNS hostnames nor rejects internal/private addresses. Only the resulting HTTP status code is returned to the caller, so the leak is blind internal probing rather than response-body exfiltration or code execution. Publicly available exploit code exists (a proof-of-concept gist is linked from the vendor advisory) and the assessed CVSS 4.0 base score is 5.1; no confirmed active exploitation (CISA KEV) is referenced in the available intelligence.
Permanent deletion of arbitrary WordPress Media Library attachments - including administrator-owned product images, logos and documents - is possible in the Customer Reviews for WooCommerce plugin through version 5.120.0, because a missing authorization check (CWE-862) in the review-submission handler lets an unauthenticated remote attacker inject arbitrary attachment IDs into a review that is later trashed and purged through the normal moderation lifecycle. Exploitation depends on a live public review-form link (a 13-hex formId that the store distributes to customers by e-mail), which exposes the nonce needed to reach the handler without any WordPress account or session, and the impact is integrity/availability only - there is no confidentiality impact (C:N). Wordfence rates this CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); no public exploit identified at time of analysis.
Incorrect authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker to bind an outstanding request token to an arbitrary user account - including an administrator - by submitting an unsigned authorization request that supplies the target identity directly instead of relying on the logged-in session. Exploitation is constrained: it requires an installation that has configured a non-default OAuth 1.0a site-wide consumer, plus knowledge of one of that consumer's outstanding (issued but unconsumed) request tokens, which is the basis for the high attack-complexity rating despite the critical 9.0 CVSS 3.1 score. Successful abuse yields administrator-level API access to the blog server, so confidentiality and integrity impact are high (the independent assessment scores availability impact as none); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has released a fix in Apache Roller 6.1.6.
Authenticated command injection in the D-Link DAP-2610 wireless access point (firmware up to 2.06B08r099) allows a user with valid low-privilege credentials on the web management interface to execute arbitrary system commands by supplying crafted parameters to the /index.xgi endpoint, giving full control of the device (CVSS 3.1 base score 8.8, C:H/I:H/A:H). The issue is network-reachable with low attack complexity and no user interaction, but authentication is required per the CVSS vector (PR:L), and CISA's SSVC assessment marks it as not automatable, so mass exploitation is unlikely. Publicly available exploit code exists; CISA KEV does not list this CVE, so active exploitation has not been confirmed at time of analysis.
Authenticated path traversal in IBM Guardium Data Protection 12.2 allows a remote low-privilege user with a valid management-interface session to read sensitive information, delete arbitrary files, or execute arbitrary code. The flaw is a CWE-22 directory-restriction bypass; SSVC rates exploitation as non-automatable, suggesting targeted rather than mass-scanning abuse, and no public exploit was identified at time of analysis (EPSS 0.54%). Patch available per vendor advisory.
Heap out-of-bounds write in the Linux kernel CIFS/SMB client (fs/smb/client) can corrupt slab memory when an ACL rewrite expands owner/group SIDs beyond the buffer that was sized from the on-disk DACL length. It is only reachable on systems that mount an SMB/CIFS share with the non-default cifsacl or modefromsid options and then trigger a local ACL-modifying operation such as chown or chmod, so the realistic outcome is kernel memory corruption or a crash rather than a remote attack; the source CVSS vector (8.8, AV:N/AC:L/PR:N/UI:R) is inconsistent with this local, mount-option-gated path. No confirmed active exploitation (no CISA KEV) and no public exploit code have been identified, and vendor patches are available with fixed builds including 6.18.53, 6.12.111, 7.2.7 and 7.3-rc3.
A use-after-free race condition in QEMU's 9pfs (virtfs) passthrough subsystem allows a malicious guest user to escape the shared directory boundary and read or write arbitrary files on the host, potentially achieving code execution as the QEMU process user (VM escape). Only hosts that have enabled 9pfs/virtfs host-directory sharing are exposed, since this is not a default configuration; the attacker must be a local guest user able to issue 9p protocol requests and must win a race between QEMU's main thread and a 9pfs worker thread with concurrent Tlcreate and Twalk requests. No public exploit code or active exploitation telemetry was identified at time of analysis, but the flaw is rated high severity (CVSS 8.8, scope-changed, C:H/I:H/A:H) and affects QEMU packages shipped in Red Hat Enterprise Linux 6 through 10, Red Hat OpenShift Container Platform 4, and related Red Hat products.
Remote code execution is achievable on self-hosted deployments of golang.org/x/playground by chaining two independent weaknesses: a crafted txtar archive that escapes the intended execution context and forces arbitrary writes into the playground host's trusted filesystem, plus a malicious go env configuration file that one of the three go vet invocation paths reads from the host's $HOME because that path fails to properly restrict its execution environment. Neither primitive is sufficient on its own - the attacker must combine the filesystem write with the poisoned environment file to reach code execution on the host, and the reachable surface is bounded to one specific vulnerable go vet invocation path out of three. The public go.dev/play service is explicitly NOT affected, so exposure is limited to independent forks and self-hosted deployments running golang.org/x/playground versions before 0.0.0-20260924211604-6d73cff14c17; no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC exploitation: none), and the vendor has released a patch.
Authenticated path traversal in the websocket/long-polling session handling of Zammad 7.0.2 and 7.1.0 allows a low-privilege logged-in user to delete arbitrary files and directories on the server with a single crafted request. The client-supplied session (client) identifier is insufficiently validated before being interpolated into internal filesystem paths, so traversal sequences escape the session storage directory - but only on instances using the default file-based session store, since Redis-backed deployments are not affected. Confirmed impact is integrity and availability loss (arbitrary deletion, no read/exfiltration per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H); there is no confirmed active exploitation (CISA SSVC exploitation: none) and no public exploit identified at time of analysis, though the flaw is fully automatable. Note that the published CVSS 4.0 score of 8.8 carries PR:N, which overstates ease of access - the independent assessment confirms authentication is mandatory.
A use-after-free race condition in the Linux kernel's ksmbd in-kernel SMB3 server can crash the kernel (denial of service) when a session is torn down while multiple channels are bound to a session and deferred byte-range locks or pending CANCELs remain counted as running requests. Affected systems must have ksmbd enabled (CONFIG_SMB_SERVER) and exporting at least one SMB3 share, and an authenticated remote attacker (PR:L) must negotiate SMB3 multichannel to race a LOGOFF, synchronous CANCEL, or abrupt connection teardown against still-running requests; success is non-deterministic (AC:H). No public exploit code has been identified at time of analysis, and the impact is availability loss, not information disclosure or confidentiality/integrity compromise as some tags or the base CVSS may imply.
Use-after-free and linked-list corruption in the Linux kernel's qla2xxx QLogic Fibre Channel driver can occur when the NVMe-over-Fibre-Channel transport takes the LS-response reject error path in qla_nvme_xmt_ls_rsp(): the uctx structure is freed with kfree() while still linked in fcport->unsol_ctx_head, so a later list_add_tail() writes through the freed node and a subsequent list_del() can corrupt the list or panic the kernel. Affected configurations are hosts running the qla2xxx driver against a QLogic FC HBA with the NVMe-oF FC transport active, primarily enterprise SAN deployments; per the independent assessment this is a local/adjacent, high-complexity issue (AV:L/AC:H/PR:L) whose triggering depends on an error/reject condition on the LS response path rather than directly attacker-chosen input, a notable reduction from the 8.8 input score. There is no public exploit code identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing); vendor patches are available in the stable trees.
Concurrent list manipulation in the Linux kernel qla2xxx Fibre Channel driver can corrupt the per-fcport NVMe unsolicited-context list, leading to kernel instability or crashes on hosts using QLogic FC HBAs in NVMe-FC mode. The fcport->unsol_ctx_head list is mutated from four different contexts (the response-queue ISR, the DPC/purex worker, the NVMe-FC transport callback and SRB completion) without a shared lock; because multiqueue adapters add entries through different qpairs, the qpair qp_lock cannot serialize the per-fcport list, so a concurrent add/delete or two concurrent deletes can corrupt list pointers. Our independent assessment treats this as a local, high-complexity timing/reliability defect (AV:L/AC:H/PR:L/UI:N, C:N/I:L/A:H) driven by normal NVMe-FC traffic rather than attacker-supplied input - materially lower than the published 8.8 AV:A vector - and no public exploit was identified at time of analysis.
Server-side request forgery in MediaFlow Proxy through 2.4.9 lets remote, unauthenticated attackers force the proxy to fetch arbitrary internal URLs - including loopback services and cloud metadata endpoints such as 169.254.169.254 - and read the full responses back through the d query parameter on the /proxy routes. Two weaknesses combine: the forward route's destination check validated only numeric private/loopback/link-local IP literals, so hostnames like localhost or nip.io-style names that resolve to internal addresses bypassed it, while the /proxy/stream endpoint performed no internal-address check at all, leaving even bare metadata IP literals reachable. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); practical risk depends heavily on deployment, with the highest impact where the instance is internet-reachable and runs in a cloud environment that exposes a metadata service.
Authenticated code injection in Horilla HR (horilla-hr) before 2.0.0 lets any user with access to the HorillaListView export functionality run arbitrary operating-system commands with the privileges of the application process - root, in the project's shipped horilla/horilla-hr Docker image. The issue is rated CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): exploitable remotely over the network with low privileges, requiring only a valid account able to reach the list/export endpoint, with no user interaction and no non-default configuration. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor released a fix in version 2.0.0.
IBM Guardium Data Protection 12.2 stores internal REST service-account credentials in a reversible, plaintext-equivalent format (CWE-256), so an authenticated attacker who can read that stored value can recover the underlying password and mint an administrative REST access token. The flaw is network-reachable but requires a valid low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) and the ability to reach the credential storage location, which makes it condition-dependent rather than mass-exploitable - SSVC rates exploitation as none and automatable as no, EPSS sits at 0.24% (13th percentile), and no public exploit code or CISA KEV entry is associated with the issue. A vendor patch is available, so the practical risk is concentrated in unpatched 12.2 deployments where low-privileged or delegated accounts exist.
Heap out-of-bounds write in the Linux kernel's hinic network driver (Huawei HiNIC NICs), where check_mbox_seq_id_and_seg_len() permits the final mailbox segment (seq_id=42) to carry a full 48-byte payload, writing 16 bytes past the 2048-byte MBOX_MAX_BUF_SZ receive buffer. The bug is reachable only where the hinic driver is loaded and a mailbox segment can be injected with seq_id=42 and a maximal payload - realistically via the PF/VF hardware mailbox path (for example a malicious VF in an SR-IOV setup) or a compromised device - so per our independent assessment the input CVSS 3.1 score of 8.8 (S:C, C:H/I:H/A:H) materially overstates real-world risk relative to the more realistic AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H profile, which favors a device crash or DoS over reliable code execution. There is no public exploit identified at time of analysis and no CISA KEV listing; vendor patches are available in the stable trees. The sibling hinic3 driver already handled this case correctly via MBOX_LAST_SEG_MAX_LEN, and the same check has now been ported to hinic.
Host root code execution is reachable from inside a Google gVisor sandbox built prior to commit 573a9e73cf844f when the host Linux platform has CUSE (Character Device in Userspace) enabled. A local attacker holding container-image deployment privileges (CVSS PR:L) can embed a /dev/cuse device node in an image; opening it in the sandbox passes through to the host gofer instead of the sentry's emulated device registry, letting the attacker register a host device and abuse CUSE's unrestricted ioctl handling to overwrite root udev helper memory. Exploitation is local and gated on the CUSE-enabled host prerequisite plus the pre-fix passthrough character-device behavior, so default hosts without CUSE are not exploitable; no public exploit code was identified at time of analysis and there is no CISA KEV listing (EPSS not provided).
Privilege escalation in the Knit Pay WordPress plugin through 9.6.1.0 lets an authenticated attacker with Subscriber-level access and above promote their own account to administrator by tampering with the hidden role field of a Gravity Forms submission. The flaw requires the plugin's Gravity Forms integration to be active and a feed configured so that user_role_field_id points at a form field; the plugin then passes that attacker-controlled value directly to WP_User::set_role() with no allowlist validation, and the process is further helped by $0 orders being marked SUCCESS synchronously at submission and by the role-assignment fallback to $lead['created_by'], the submitter's own user ID. At time of analysis no public exploit code or CISA KEV entry was identified, but with CVSS 8.8 and an authenticated low-privilege prerequisite, this is a high-priority issue for any site running the vulnerable plugin together with a configured Gravity Forms feed.
Remote code execution in the WordPress s2Member plugin (all versions up to and including 260814) lets unauthenticated attackers execute arbitrary PHP on the server by injecting code through the 'first_name' parameter, which is substituted unsanitized into an eval'd Signup Tracking Codes template. Exploitation is conditional rather than default-config: the site administrator must have configured a Signup Tracking Codes template containing the documented %%first_name%% placeholder, and the attacker must first obtain the site-global proxy verification key that s2Member exposes in plaintext in the JSON response of any PayPal Checkout AJAX request, which also permits bypassing PayPal postback verification. Both prerequisites together yield unauthenticated remote code execution with high attack complexity and no user interaction; no public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was provided.
Cross-site request forgery in Elementor Website Builder (all versions through 4.3.1) lets a remote attacker who holds no credentials of their own induce a logged-in WordPress administrator into silently executing unintended state-changing actions inside the victim's authenticated session. Exploitation requires both a privileged user to be authenticated and that user to be lured onto attacker-controlled content (CVSS UI:R), which caps practical severity despite the high base score of 8.8 reported by the researcher; our independent assessment scores the same vector at C:L/I:L/A:N because the achievable action set is not fully characterised in the advisory. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score or client-side patch detail was supplied in the source data.
Unauthenticated denial of service in Zammad prior to 7.0.2 allows any remote attacker who can reach the host to tie up a Puma request worker for roughly 115 seconds per request by POSTing to /api/v1/import/otrs/import_check. The import_check and import_status actions are missing the setup_done_response guard that other actions in the same controller enforce, so they run against fully set-up production instances, where the code enters a retry loop against a blank OTRS endpoint and sleeps 30 s then 45 s between attempts. Each request costs the attacker almost nothing, so a sustained rate of just a few requests per second saturates the worker pool and keeps the instance unavailable as long as the traffic continues; no account, valid import configuration, or target knowledge beyond the hostname is required, and the CSRF token is trivially harvested from any prior GET response. This is a genuine availability risk that is trivial to trigger, but no public exploit code or confirmed active exploitation has been identified at time of analysis.
A tenant isolation bypass in BerriAI LiteLLM versions before 1.101.0-rc.1 lets an authenticated holder of a valid virtual key read other tenants' entries from the semantic cache and, in the worst case, have attacker-supplied tool calls executed under a victim's credentials. The flaw stems from an inconsistency in how the cache layer derives the tenant scope versus the metadata variable name, so semantically similar prompts sent to routes such as /v1/responses and /bedrock/* can collide with and return another tenant's cached response - potentially exposing PII, financial data, or source code. Exploitation requires a multi-tenant deployment with semantic caching enabled and a sufficiently similar prompt to hit the victim's cache entry, and it is rated CVSS 8.7 with a vendor patch already released (commit 16db51e2, fixed in v1.101.0-rc.1); no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV.
Improper privilege management in Zammad helpdesk/customer support systems allows an attacker holding a valid but deliberately restricted API token to create new administrator accounts, inheriting the latent authorization authority of the token's parent account instead of honoring the token's granular scope. This affects all Zammad releases prior to 7.0.2 and 7.1.0, and exploitation is authenticated (CVSS PR:L) since a scoped token must already be held, though no user interaction is required and the vector is network-reachable; success grants full access to tickets, customers, and configuration and effectively hands the attacker complete control of the instance. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), but the independent assessment rates it a genuine high-priority privilege-escalation flaw rather than a high-CVSS-but-low-risk case, and EPSS-style risk is elevated by the trivial post-exploitation payoff.
Authenticated administrators of the Zammad helpdesk platform (versions prior to 7.1.2) can achieve remote code execution on the Zammad server by injecting specially crafted text into an AI Agent configuration field that bypasses the application's ERB sanitizer. Because the pre-7.1.2 sanitizer used Ruby's `.sub` and escaped only the first `<%` opener, an attacker with AI Agent create/edit permissions can smuggle a nested ERB tag (e.g. `<%<%= ... %>`) that executes automatically the next time the affected agent processes a ticket, with no interaction from other users required; this yields full read/write/delete access to data on the host (VC:H/VI:H/VA:H). The flaw is a genuine remote code execution issue, not a mislabeled availability problem, and it requires admin-level privileges (PR:H) plus the optional AI Agent feature being in active use; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor fix ships in Zammad 7.1.2 (GHSA-gp3x-9xm8-rcj6).
Stored cross-site scripting in GLPI 11.0.6 through 11.0.8 allows an authenticated technician to inject active markup into supplier website fields, which executes in the browser of any user who opens the suppliers list for the affected contact or contract. The vulnerability is fixed in version 11.0.8, and no public exploit identified at time of analysis. Successful exploitation requires a privileged account (PR:H) and user interaction from a victim (UI:P), and the impact is limited to the victim's session context (CVSS 4.0 score 8.5).
Reflected cross-site scripting in Horilla HR (horilla-hr) before 1.6.0 allows a remote, unauthenticated attacker to execute arbitrary JavaScript in the browser of an authenticated employee or administrator by tricking that user into opening a crafted link to /employee/employee-filter-view. The search parameter is written into the DOM through jQuery's .html() in employee/templates/employee_nav.html, so the injected markup is rendered and executed rather than displayed as text; because the payload runs in the victim's session, the attacker can read browser-visible session data and perform actions with the victim's application privileges. There is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); impact is capped at the client/browser layer (VC:H/VI:H but VA:N and no scope change to the server in the vendor's CVSS 4.0 vector, with our independent assessment scoring CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Insufficient path validation in GLPI's profile-picture update flow lets any authenticated user - including ordinary self-service accounts with no administrative rights - force the application to delete an attacker-selected file on the server's filesystem. Affected releases are GLPI 10.0.0 through 10.0.25 and 11.0.x before 11.0.8; the flaw is fixed in 10.0.26 and 11.0.8. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the CVSS 4.0 base score of 8.5 reflects a remote (AV:N), low-complexity (AC:L) attack with high integrity and availability impact once a valid low-privilege session (PR:L) is obtained.
Stored cross-site scripting in the AIL Framework's username timeline lets a remote, unauthenticated attacker execute arbitrary JavaScript in an authenticated analyst's browser by seeding a crafted username - for example an <img> tag with an onerror handler - into a chat or forum that AIL monitors. The malicious username is stored without character restrictions and fires when the analyst hovers over the corresponding timeline entry, because var/www/static/js/d3/timeline_basic.js interpolates the value d.obj directly into D3's html() tooltip without sanitization. CIRCL reports the issue and an upstream fix commit (455dd92c) is available; no public exploit and no CISA KEV entry were identified at time of analysis, and successful exploitation can lead to session hijacking, data exfiltration, or unauthorized actions taken within the analyst's authenticated session.
Stored cross-site scripting in AIL Framework allows an authenticated attacker who can influence matched, tracked, or tagged content to inject HTML or JavaScript into Bootstrap popovers rendered with data-html="true", executing in a victim analyst's session when they view the affected popover. The vulnerability affects versions prior to the fix commit ee63a0a and requires victim interaction (opening the popover, typically on hover); no public exploit code was identified at time of analysis. A vendor patch is available via the referenced commit, but practical risk is moderate given the authenticated attacker prerequisite, required victim interaction, and the niche threat-intelligence context of the tool.
Authorization bypass in the Rattadan Cosmowarp asset_registry smart contract (CosmWasm/Rust) lets any sender execute the privileged UpdateConfig message on deployments where the on-chain config.admin field is unset (None), because the sender-vs-admin check is nested inside an `if let Some(current_admin) = config.admin` block that is silently skipped. Impact is high on integrity and availability (VI:H/VA:H) with limited confidentiality loss (VC:L), scoring 8.4 under CVSS 4.0 and assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H; exploitation is only possible against pre-56c6147 builds of the rattadan/Cosmowarp_Contract asset_registry module running with an unset admin, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. The condition is narrow but the consequence is full admin-level config control for whoever submits the transaction first.
Stored cross-site scripting in Zammad prior to 7.0.1 lets an authenticated low-privilege user persist arbitrary HTML markup and JavaScript event handlers inside a ticket title through the normal ticket-creation workflow, because the title is stored without sanitization and later rendered unescaped. The payload fires when a victim - typically a support agent or administrator with an active session - opens the affected ticket or receives a notification, escalation or reminder email that interpolates the title, yielding script execution in the victim's browser context. No public exploit code has been identified at time of analysis, the flaw is not listed as actively exploited, and exploitation requires both an authenticated account with ticket-creation rights and victim interaction; Zammad 7.0.1 contains the vendor fix.
Brute-force attacks against the POST /api/auth login endpoint in Flame through 2.4.0 let remote, unauthenticated attackers submit unlimited password guesses because the endpoint implements no rate limiting, attempt counters, delays, or lockouts. A successful guess yields full administrator access and the ability to modify application configuration. Exploitation requires network reachability to the instance and is only practical against weak or default-style admin passwords - a long, high-entropy password makes guessing impractical (reflected in AC:H/AT:P), and no public exploit code has been identified at time of analysis; instances behind a VPN, an authenticating reverse proxy, or on isolated LANs are not remotely reachable.
Authentication denial of service in RabbitMQ affects deployments running the rabbitmq_auth_backend_oauth2 plugin from 3.13.0 through the fixed releases (4.3.3, 4.2.9, 4.1.14, 4.0.23, 3.13.18), where the JWKS signing-key fetch routine in uaajwt.erl fails to check the HTTP response status code and treats any well-formed HTTP transaction as a success, so a single non-200 response with valid JSON that lacks a 'keys' field wipes all cached signing keys and breaks OAuth2/JWT authentication for every user until the next successful refresh. The vulnerability is remotely reachable and unauthenticated (CVSS:4.0 PR:N / independent CVSS:3.1 PR:N), but exploitation depends on attack requirements being met (AT:P) - the attacker must induce or coincide with an error-returning JWKS response - and the resulting impact is a persistent availability outage (VC:N/VI:N/VA:H in the assessed vector, C:N/I:N/A:H in the independent 3.1 assessment), with no data exposure or code execution. No public exploit code was identified at time of analysis and there is no CISA KEV listing; treat this as a genuine availability threat rather than a top-tier emergency.
OAuth2 client secret disclosure in the RabbitMQ Management UI affects versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3.2, where the configured management.oauth_client_secret is embedded in the JavaScript served by the unauthenticated endpoint /js/oidc-oauth/bootstrap.js. Any party with network reachability to the management HTTP port can retrieve the secret with a simple GET request - authentication requirements confirmed unauthenticated (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) and the assessed impact is high confidentiality loss (VC:H) with no integrity or availability impact. The flaw only manifests when OAuth2 authentication is enabled for the Management UI and the IdP flow uses a confidential client secret, so default or non-OAuth2 deployments are unaffected; no public exploit code has been identified at time of analysis, and the issue is fixed in 4.3.3 and 4.2.9.
A memory-management correctness defect in the Linux kernel's x86 page-attribute code (arch/x86/mm/pat) causes split page tables to be allocated outside the normal kernel page-table path, so they are never marked as kernel page tables and their associated IOTLB entries are not invalidated when the tables are freed. Exploitation requires local, high-privileged access on an affected kernel (the 6.18.7 through 6.18.53 band or 6.19) that also runs an IOMMU with shared virtual addressing (SVA), plus a timing/reuse window in which a stale IOTLB entry is actually consumed; the independent assessment rates the realistic impact as negligible confidentiality impact, limited integrity impact and possible availability impact (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H), materially below the 8.2 vendor-published vector. There is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), while vendor-released fixes are available in Linux 6.18.53, 7.2.7 and 7.3-rc4.
The RabbitMQ management plugin in versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3.2 writes an 'auth' cookie containing the base64-encoded 'username:password' pair after a successful POST /login, with no HttpOnly, Secure, SameSite, or expiration attributes, so anyone who can read that cookie can trivially decode it back to plaintext administrator credentials. The flaw is not directly exploitable on its own: the attacker must also hold one of three separate primitives - a same-origin cross-site scripting foothold in the management UI, an HTTP-readable network position (cleartext or man-in-the-middle), or local read access to the victim's browser cookie store - which is why the vendor's 8.2 (CVSS 4.0, AT:P/AC:H) score overstates practical risk while the underlying confidentiality impact is high. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor fixes are available in RabbitMQ 4.2.8 and 4.3.2.
Uninitialized-memory handling in the Linux kernel's Broadcom bnxt_en network driver can leave an rx_tpa[] entry zeroed after a failed TPA buffer reallocation during an RX ring reset, causing a zero DMA address to be handed to the NIC. The bug is not a remotely reachable path: the authoritative assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, and triggering it requires a host-side memory-allocation failure (-ENOMEM in bnxt_alloc_one_tpa_info_data) to coincide exactly with an RX ring reset on a NetXtreme-C/E adapter with TPA active, so NVD's 8.1 AV:N/PR:N score materially overstates the real risk. Vendor-released fixes exist in 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3, and no public exploit identified at time of analysis.
Linux kernel SCTP timer handling is vulnerable to a time-of-check-to-time-of-use race that can unbalance an association's reference count and cause a use-after-free during association teardown, allowing an unauthenticated remote peer to crash or destabilize an affected system. Any kernel built with the SCTP protocol enabled (CONFIG_IP_SCTP) and exposing an SCTP endpoint to untrusted peers is in scope; the assessed vector is AV:N/AC:H/PR:N/UI:N with no confidentiality impact, low integrity impact, and high availability impact, because winning the narrow timing race is the attacker's main obstacle. There is no public exploit identified at time of analysis and no CISA KEV listing; the upstream and stable-branch fixes are already published, and no EPSS score was supplied in the available intelligence.
The Linux kernel's Reliable Datagram Sockets (RDS) connection teardown path contains a race condition in rds_conn_shutdown() that can crash or hang the kernel, causing denial of service on systems where the RDS subsystem is loaded and connections are being shut down or failed over. The flaw stems from teardown merely sampling the RDS_IN_XMIT and RDS_RECV_REFILL fastpath bits as clear instead of owning them, so a concurrent rds_send_xmit() or rds_ib_recv_refill() can re-acquire the bit and run while the transport re-initializes its rings and rds_send_path_reset() rewrites transmit state under it. Because the store-buffering pattern only manifests where memory ordering is weak (for example ARM), and because the accept-side state check must pass before the path moves to RDS_CONN_DISCONNECTING, reliable triggering is difficult and the practical impact is limited to kernel instability; no public exploit code has been identified at time of analysis and vendor patches are available.
Unauthenticated configuration tampering in Apache Roller 6.1.5 lets any remote attacker persistently rewrite the site-global frontpage weblog selection on a default installation, because the installation-time setup action remains anonymously reachable after setup completes and persists the value without any authorization check. Impact is bounded rather than severe: only one site-global setting is altered, no data is disclosed (C:N), and a global administrator can restore the setting afterward, which is why our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L rather than the submitted 8.2 high with I:H/A:L. The attack is a single unauthenticated HTTP request with no user interaction, so exposure is broad wherever 6.1.5 is internet-facing; exploitation status is no public exploit identified at time of analysis, and the issue is not tied to any optional feature or non-default configuration.
Authenticated MasterStudy LMS members can bypass membership-plan restrictions to enroll in paid courses outside their plan and exceed the plan's course-count limits in plugin versions from 1.9 before 3.7.50. The flaw is a server-side authorization failure in the enrollment flow: the plugin does not verify that the requested course is covered by the member's plan or that the submitted plan identifier actually belongs to that member. Publicly available exploit code exists, per the WPScan advisory, and the issue is rated low-to-moderate; the CVSS vector shows network access with a member-level account (PR:L) and low confidentiality/integrity impact, with no availability impact.
An out-of-bounds array access in the Linux kernel's Broadcom bnxt_en Ethernet driver can crash the kernel at boot or during receive processing on affected 57500/57600-family NICs, most notably the BCM57608 running firmware that advertises fewer concurrent TPA aggregations than the firmware's TPA ID range. Because the driver allocates rx_tpa with only bp->max_tpa entries (32 on the documented firmware version 233) while the software TPA ID derived from the firmware ID can reach 1023, bnxt_rx_pkt dereferences an invalid pointer and triggers a general protection fault. There is no public exploit identified at time of analysis, and the independent assessment is materially less severe than the published CVSS 8.1 - the flaw is a deterministic local/host-side denial-of-service condition on specific Broadcom hardware and firmware combinations, affects only kernels built from commit ec4d8e7cf024 onward, and no code execution or data disclosure primitive has been demonstrated. Remote attackers cannot trigger it without first gaining a position on the affected host's receive path; the operative impact is loss of availability (kernel panic).
A race condition in the Linux kernel's RDS-over-TCP transport (net/rds) lets a local user who can open and use an AF_RDS socket corrupt connection state when a transmit is in flight at the same moment the accept path resets the connection's callbacks. Because rds_tcp_reset_callbacks() only samples the RDS_IN_XMIT bit as clear rather than owning it, rds_send_xmit() can re-take the bit immediately afterwards and run concurrently with rds_send_path_reset() rewriting cp_xmit_* state, producing torn transmit state and a potential kernel crash/denial of service with limited integrity impact. The authoritative assessment scores this CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H - local access with low privileges, a narrow timing window, and, critically, manifestation restricted to weakly ordered CPUs (ARM, PowerPC) since the store-buffering pattern cannot occur on strongly ordered x86; no public exploit code has been identified at time of analysis and there is no confirmation of active exploitation (no CISA KEV entry), although the public tag of 'Information Disclosure' is a mischaracterization of what is really a CWE-362 concurrency bug. Vendor-released patches exist for the stable branches (6.12.111, 6.18.53, 7.2.7, and 7.3-rc2).
Remote code execution in Microsoft Outlook (delivered through Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024) arises from an integer overflow/wraparound that an unauthorized attacker can trigger by delivering a specially crafted message or file to an affected client. The vector is network-reachable, unauthenticated (PR:N), and lists no user interaction (UI:N), but high attack complexity (AC:H) means the attacker must satisfy specific, not fully controllable conditions to convert the wraparound into reliable memory corruption and code execution; CISA SSVC accordingly marks the flaw non-automatable and no exploitation has been observed. Signals are mixed and point to a serious-but-not-emergency priority: EPSS is only 0.35% (26th percentile), no public exploit code or KEV listing exists, technical impact is total if successful, and Microsoft has released a vendor patch.
A server-side request forgery in the VMware datastore driver of OpenStack glance_store lets an authenticated OpenStack user supply a crafted image location URI pointing at an attacker-controlled server, causing the driver's _retry_request function to attach sensitive vCenter authentication headers to that outbound request and disclose them. The deployment must be configured with the non-default VMware/vCenter datastore backend, and the attacker needs an account with the ability to set or override image locations (typically gated behind the set_location / show_multiple_locations policy); SSVC rates the issue as Exploitation=poc with publicly available exploit code on GitHub (sadandbset/CVE-2026-51772-CVE-2026-51773), Technical Impact=total, but Automatable=no, so it is a targeted attack rather than a mass-exploitation candidate and there is no confirmed active exploitation (CISA KEV) at time of analysis. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) reflects high confidentiality impact from credential theft; our independent assessment adjusts the integrity impact to Low because the primary outcome is leakage of authentication material rather than direct modification of data.
DNS rebinding against Rojo's unauthenticated 'rojo serve' HTTP API (default bind localhost, port 34872) allows a malicious webpage to read every file in the served project, write attacker-controlled code to disk, and trigger execution of local programs through the opener::open() handler. The issue affects pre-patch builds of the rojo-rbx/rojo crate and is network-reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, 8.1 High), but requires the developer to be running 'rojo serve' at the moment they visit an attacker-controlled page and requires the attacker to control DNS for the rebinding; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV. Impact is high for both confidentiality and integrity (full project source disclosure and arbitrary file writes) with no availability impact; exploitation is bounded to machines actively running the dev server.