Citrix NetScaler ADC and NetScaler Gateway deployments running builds prior to 14.1-73.37 or 13.1-64.23 (including the corresponding FIPS and NDcPP builds 14.1-73.37 FIPS and 13.1.37.279 FIPS/NDcPP) can be driven by an unauthenticated remote attacker to achieve remote code execution or cause a denial-of-service condition. Per the available CVSS 4.0 vector the attack is network-reachable with no privileges or user interaction required, but Attack Complexity is High, meaning the attacker must first satisfy a specific, non-default precondition or timing/state condition rather than issuing a single trivial request. The vendor assigns a 9.5 base score with high impact to both the vulnerable appliance and subsequent systems; no confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and the underlying weakness class was not disclosed (CWE: N/A).
Unauthenticated command execution in Citrix NetScaler ADC (before 14.1-73.37, before 13.1-64.23, and the corresponding FIPS and NDcPP builds) and NetScaler Gateway (before 14.1-73.37 and before 13.1-64.23) lets a network-reachable attacker with no credentials and no user interaction run arbitrary commands on the appliance. Both our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) and the vendor's CVSS 4.0 score of 9.5 agree on high confidentiality, integrity, and availability impact, with the CVSS 4.0 AT:P flag indicating that a specific attack precondition must hold before the flawed input-validation path is reachable. No public exploit code has been identified at time of analysis, but this is a genuine top-priority vulnerability rather than a high-CVSS/low-real-risk case, because the only other barrier is having a vulnerable, network-exposed ADC or Gateway instance, and exposure is highest where the management or VPN virtual server is internet-facing.
HTTP request smuggling (CWE-444) in Citrix NetScaler ADC and NetScaler Gateway allows unauthenticated, remote attackers to send crafted requests that NetScaler and the protected back-end server parse differently, desynchronizing the HTTP connection so that follow-on requests are misrouted, poisoned, or injected into other users' traffic; the CVSS 9.3 score reflects high integrity and scope-changed impact on back-end traffic rather than compromise of the appliance itself (VC:N/VA:N, SC:H/SI:H). Affected are ADC builds before 14.1-73.37, before 13.1-64.23 and before 13.1-37.279 (NDcPP) plus their FIPS variants, and Gateway before 14.1-73.37 FIPS and before 13.1-64.23, per vendor advisory CTX697096. No public exploit code was identified at time of analysis, and practical exploitation is bounded by the appliance being internet-reachable and fronting a back end whose HTTP parsing differs from NetScaler's, which is the desynchronization precondition inherent to CWE-444.
Predictable value generation in Citrix NetScaler ADC and Gateway (CWE-342) lets unauthenticated remote attackers predict subsequent values from previously observed ones, primarily compromising integrity and availability rather than confidentiality. The vendor rates this 8.8 (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, VC:L/VI:H/VA:H), while our independent assessment sees a 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H) indicating a high attack complexity because exploitation typically requires harvesting at least one prior value. Affected versions are ADC before 14.1-73.37 and 13.1-64.23 (also 14.1-73.37 FIPS and 13.1.37.279 FIPS/NDcPP) and Gateway before 14.1-73.37 and 13.1-64.23; vendor patches are available and no public exploit identified at time of analysis.
Remote unauthenticated attackers can trigger a memory overflow in Citrix NetScaler ADC and Gateway, leading to unpredictable behavior or denial of service. Affected versions include ADC before 14.1-73.37 and 13.1-64.23 (plus FIPS/NDcPP builds before 14.1-73.37 and 13.1.37.279), and Gateway before 14.1-73.37 and 13.1-64.23. The vendor CVSS 4.0 base score is 8.8 with availability as the dominant impact (VA:H), and no public exploit has been identified at time of analysis.
A memory overflow in Citrix NetScaler ADC and NetScaler Gateway can be triggered by unauthenticated remote attackers (CVSS vector PR:N/UI:N/AV:N), causing unpredictable appliance behavior and denial of service. Affected deployments are ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS/NDcPP, plus Gateway before 14.1-73.37 and before 13.1-64.23. The vendor rates the flaw 8.8, and the dominant impact is availability (VA:H) rather than confidentiality or integrity compromise; no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status.
Memory overflow in Citrix NetScaler ADC and NetScaler Gateway running versions prior to 14.1-73.37 or 13.1-64.23 (and the corresponding FIPS/NDcPP builds) can be triggered over the network by an unauthenticated attacker with no user interaction, producing unpredictable or erroneous appliance behavior or a denial of service. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) is dominated by availability impact, with only incidental confidentiality and integrity exposure, so the demonstrated risk is service disruption rather than confirmed remote code execution. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the practical exposure driver is network reachability to an unpatched ADC or Gateway instance; fixed builds are available via Citrix bulletin CTX697096.
Arbitrary JScript execution in Progressive Robot Ltd's hMailServer 6.0.0 through 6.3.3 on Windows lets an unauthenticated, remote attacker run attacker-controlled code inside the hMailServer service process with the service account's privileges by sending a password containing a backslash immediately followed by an apostrophe in any SMTP AUTH, POP3, or IMAP logon that names an existing active account. The flaw is only reachable in a non-default configuration - event scripting enabled (off by default), the script language set to JScript (default is the unaffected VBScript), and a relevant handler (OnClientValidatePassword, OnExternalAccountDownload, or OnDeliveryFailed) defined - and equivalent paths exist through a malicious remote POP3 server's message UID or a malicious remote SMTP server's rejection reply. The vendor's CVSS of 9.8/AV:N/AC:L understates the practical barrier because it does not model those required non-default settings; our assessed vector is AV:N/AC:H/PR:N/UI:N, no public exploit has been identified at time of analysis, and the vendor-released patch is version 6.3.4.
Improper authentication in the Debug Service of Seetong T8108, T8108P, T8116, and T8232 devices running firmware 4.6.1.4-build202604241011 lets unauthenticated, remote attackers bypass authentication and gain full control of the affected device, with the reported CVSS 4.0 base score of 9.3 (independent assessment: CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, high confidentiality, integrity, and availability impact). Publicly available exploit code exists - a GitHub proof-of-concept repository targets the Seetong TS81xx series - so any reachable device must be treated as exploitable, although the supplied data contains no CISA KEV entry confirming active exploitation. The vendor was contacted about the disclosure and did not respond, so no vendor patch is available and exposure is the primary limiting factor: the attacker only needs network reachability to the exposed Debug Service (same LAN segment, or an internet-exposed or port-forwarded device).
Host header injection in Nezha 2.2.3's OAuth2 redirect endpoint (/api/v1/oauth2/{provider}) allows an unauthenticated remote attacker who can control the HTTP Host header on a request reaching the server to make Nezha emit an attacker-chosen redirect_uri to the configured identity provider; a victim induced to start the OAuth2 login/binding flow can then have their authorization code delivered to the attacker's origin, letting the attacker complete the flow and take over the account. The bug is a regression of the GHSA-9rc6-8cjv-rcvx fix and only manifests when the new optional dashboard_host setting is left empty, so the code no longer falls back to install_host; exploitation also requires victim interaction and an identity provider that accepts the forged redirect URI, which is why the independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:R while the vendor-style CVSS 4.0 rating is 9.3. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; no patched release version was published with the advisory, only an upstream fix commit (38824dbc11a63964c5b9296ae4c68e62b34fa04b).
Feature policy bypass in Citrix NetScaler ADC and Gateway allows unauthenticated remote attackers to evade certain configured policies when those policies use HTTP URL-based expressions, potentially bypassing policy enforcement controls. Affected are ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS/NDcPP; Gateway before 14.1-73.37 and before 13.1-64.23. No public exploit identified at time of analysis, and the vendor advisory CTX697096 covers this issue alongside related NetScaler CVEs; exploitation requires the specific precondition of a URL-based feature policy, which limits real-world risk.
Stored cross-site scripting in the commercial Download Manager Pro WordPress plugin (before version 7.5.6) allows an unauthenticated attacker to inject script payloads through the plugin's email-locked download subscription form, which are then rendered unsanitized on an administrator-facing page and execute in the admin's browser session. The free plugin distributed under the same slug does not ship the affected feature and is not vulnerable, so only sites running the Pro edition with that subscription form in use are exposed - and exploitation only completes when an administrator subsequently views the poisoned admin page. Publicly available exploit code exists (WPScan published the vector), but there is no confirmed active exploitation (CISA KEV does not list it), SSVC records Exploitation: none and Automatable: no because of the mandatory admin interaction, and EPSS is low at 0.17% (6th percentile), which is why this is treated as a moderate-priority issue rather than the critical score implied by the vendor's 8.8 CVSS.
Administrator password-reset links in Sylius are built from the unvalidated request Host header, so an unauthenticated attacker who knows an administrator's email address can send a single request to /admin/forgotten-password (or POST /api/v2/admin/administrators/reset-password) with a forged Host or X-Forwarded-Host header and cause the reset-token link in the generated email to point at an attacker-controlled domain. If the targeted administrator then clicks the poisoned link, the attacker captures a valid reset token and can take over the administrator account, yielding high impact on confidentiality, integrity and availability (assessed CVSS:3.1 8.7, AV:N/AC:L/PR:N/UI:R). No public exploit identified at time of analysis, and exploitation is neutralized in deployments that enforce Symfony trusted_hosts or normalize/reject untrusted Host and X-Forwarded-Host values at a reverse proxy or load balancer; only the admin reset flow is affected, since the shop-side reset builds its link from the channel's configured hostname.
JWT audience confusion in Sylius (before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9) allows a self-registered shop customer to escalate to full administrator access. Because tokens issued by the Shop API omit any firewall/audience identifier, an attacker who registers a shop account using an existing administrator's email address receives a token that the Admin API resolves to that administrator, granting complete administrative control (CVSS 3.1 8.7, PR:L, C/I/A:H). Exploitation requires the default configuration with both Shop and Admin JWT firewalls and self-service shop registration enabled, plus knowledge of the admin's email; no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but public patch and GitHub advisory details are available.
Insufficient verification of payment-claim state in the Sylius e-commerce platform (versions before 2.1.16 and 2.2.9) lets unauthenticated remote attackers inflate an order after a payment gateway has already captured the original, smaller amount, causing Sylius to mark the enlarged order as fully paid while the gateway only collected the lower figure. The flaw is reachable with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (integrity-only, high impact) and requires no login, but does demand a live storefront with a capture/authorize-capable payment gateway, an attacker-funded legitimate small transaction, and control over the timing between gateway capture and cart recalculation. This is a genuine financial-fraud defect rather than a theoretical high-score paper cut, though no confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis.
An out-of-bounds write in the L2TP control-channel parsing routine (tunnel_set_params in tunnel.c) of D-Link DIR-895L firmware A1_102b07 lets a remote attacker corrupt memory by sending a crafted L2TP control message containing a malformed Host Name AVP. The vendor's CVSS 4.0 score of 8.6 reflects a network-reachable, low-complexity attack requiring low privileges (PR:L), and VulDB has published a public proof-of-concept write-up, so publicly available exploit code exists. Note that the vendor vector's subsequent-system (SC/SI/SA:H) clause appears inflated - the flaw is an in-process memory corruption on a single consumer router - and the DIR-895L is a discontinued model, so no vendor patch has been identified.
Authentication bypass in wolfSSL TLS clients built with Raw Public Key (RPK) support allows a malicious or on-path server to force acceptance of an unsolicited server_cert_type=RawPublicKey extension during a TLS 1.2, TLS 1.3, or DTLS 1.2 handshake, causing the client to treat RPK as the negotiated credential form and skip normal certificate-chain verification. Only builds compiled with HAVE_RPK (--enable-rpk, --enable-all, or --enable-distro) are exposed; default builds are unaffected, and exploitation additionally requires the victim to act as the client connecting to the attacker-controlled server (or an on-path injector) with no user interaction, as reflected by PR:N in the vector. There is no public exploit identified at time of analysis and no CISA KEV listing, though the raw CVSS 4.0 base score of 8.3 contrasts sharply with the non-default, compile-time-gated reachability captured in the independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), so the practical risk is concentrated in RPK-enabled deployments.
wolfSSL builds that enable the WOLFSSL_TRUST_PEER_CERT macro can be induced to accept a forged clone of a trusted-peer CA, letting a malicious (D)TLS server bypass peer authentication; when OPENSSL_COMPATIBLE_DEFAULTS is also defined the flaw spreads to all CA certificate loading. The vulnerable path is reached through wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert(), APIs used by autoconf/distro builds of nginx, haproxy, stunnel, wpa_supplicant, apache httpd, hitch, bind, rsyslog and ffmpeg, and exploitation is unauthenticated over the network (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). The practical barrier is that the attacker must already know which certificates the victim loaded before a matching clone can be forged (assessment- and vendor-cited AT:P), so this is a targeted authentication bypass rather than a mass-exploitable one; patches exist upstream but no public exploit code has been identified at time of analysis.
Certificate forgery in the wolfSSL client (versions 5.7.2 through 5.9.2) lets a remote attacker who already holds any certificate and matching private key that chains to a CA the client trusts mint certificates for arbitrary identities that the affected client accepts as valid, enabling full TLS man-in-the-middle of connections that client initiates. The defect is reachable only in a non-default configuration: a client build with HAVE_CERTIFICATE_STATUS_REQUEST_V2 that explicitly enables RFC 6961 multiple OCSP stapling via wolfSSL_UseOCSPStaplingV2(ssl, WOLFSSL_CSR2_OCSP_MULTI, options); in addition, the attacker-supplied end-entity certificate can be written into the persistent trust store held by the shared WOLFSSL_CTX, so later connections that reuse that context stay affected even when multi-stapling is no longer in use. No public exploit identified at time of analysis; the vendor-reported CVSS 4.0 base of 8.3 and an independent assessment of CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N both treat this as a genuine certificate-validation failure (CWE-295) rather than a merely information-disclosing bug, with the 'attacker must already hold a certificate chaining to a trusted CA' prerequisite as the main limiting factor. Upstream fix is available as PR #11027; a released patched version is not independently confirmed in the available data.
Incorrect authorization in the Sylius Shop API lets anyone holding an order token submit arbitrary payment actions - most notably refunds - against their own completed orders through POST /api/v2/shop/orders/{tokenValue}/payment-requests. Affected releases are Sylius versions before 2.1.16 and before 2.2.9; the endpoint accepted any caller-supplied action value with order ownership as the only check, so where a payment gateway wires a refund-class action into its action-indexed command provider the gateway executes the refund while Sylius still records the order as paid, producing direct financial loss. The vulnerability is remote and unauthenticated per the assessed CVSS vector (PR:N) because the order token is held by any customer for their own purchase, but exploitation is gated by that specific gateway configuration (AC:H / AT:P), and no public exploit has been identified at the time of analysis.
Stored code injection in the Ad Inserter WordPress plugin before 2.8.19 allows an authenticated user with a role as low as subscriber to save content that the plugin then executes as PHP or serves unescaped to site visitors, because one of the plugin's settings pages is not access-restricted and the data written there is not filtered. Exploitation is conditional rather than trivial: the threat actor needs a low-privileged account (easy on sites with open registration) and the site must be running a configuration in which the plugin's own settings make that page reachable by every logged-in user, which is why the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H with total technical impact. Publicly available exploit code exists, but the EPSS score is only 0.15% (4th percentile), there is no CISA KEV listing, and independent review characterises this as a real-but-conditional priority rather than an emergency.
Malcure Malware Shield (Removal, Repair, Monitor) before 19.9.7 fails to enforce an authorization check on an AJAX action, allowing an authenticated subsite administrator on a WordPress multisite network to write and delete arbitrary files in the network's shared filesystem, which can lead to remote code execution. The vulnerability requires a multisite installation and an existing privileged account (CVSS PR:H); it is not exploitable on single-site installs or by unauthenticated users, and SSVC records Automatable:no. Publicly available exploit code exists, but no active exploitation is confirmed (CISA KEV absent; SSVC Exploitation:none), and EPSS is low at 0.18% (7th percentile).
Stored cross-site scripting in the PowerPress Podcasting plugin by Blubrry for WordPress before 11.17.2 lets an authenticated user with contributor-level access or higher inject a script payload into an unsanitized block attribute, which then executes in the browser session of any higher-privileged user (editor or administrator) who views the rendered page. Exploitation is not anonymous: it requires a valid low-privilege account, the ability to add or edit a PowerPress block, and victim interaction with the poisoned content, which is why the vendor's 6.8 score is assessed as generous on both privilege required and scope. Publicly available exploit code exists and WPScan has published a proof-of-concept advisory, but EPSS is only 0.15% (4th percentile) and there is no signal of active exploitation, so this is best treated as a moderate-risk, patch-now issue for sites that grant contributor accounts.
Stored cross-site scripting in the Optima Express IDX WordPress plugin before 8.7.6 allows an authenticated user with a role as low as author to inject a script value through one of the plugin's REST endpoints, which is persisted and then echoed unfiltered into the document head whenever the affected post is rendered. Exploitation requires a valid low-privileged WordPress account and completes only when a victim (for example an administrator or site visitor) loads the poisoned post in a browser, making it a stored, persistent injection rather than a reflected one. Publicly available exploit code exists and the issue is listed in WPScan with an advisory, but there is no confirmed active exploitation (CISA KEV absent, SSVC exploitation: none) and EPSS is low at 0.15% (4th percentile), so it should be treated as a genuine but modest-priority patch-now issue. A vendor fix is available in 8.7.6.
Stored cross-site scripting in the WP YouTube Lyte WordPress plugin before 1.7.31 allows an authenticated user with only contributor-level access to inject script via YouTube embed block attributes that are rendered into HTML without escaping. The payload does not fire on its own: a higher-privileged user such as an editor or administrator must subsequently view or render the poisoned block for the stored script to execute, so realistic exposure is limited to sites that grant contributor-or-higher accounts to semi-trusted users and that review contributor content. Publicly available exploit code exists, but EPSS is low at 0.15% (4th percentile), there is no CISA KEV listing, SSVC records no observed exploitation, and an independent assessment rates the practical risk as a high-scoring-but-modest-real-impact stored XSS rather than a mass-exploitable bug. Note the vendor-reported vector (6.8, PR:H) is more conservative than the independently assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), which considers the contributor-level prerequisite and the required user interaction.
Stored cross-site scripting in the WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 lets an authenticated user with the Contributor role or higher inject a script payload into content pulled from an attacker-influenced RSS feed, which the plugin then saves as post content without sanitization; the payload executes when a victim renders the affected post. Exploitation is not automatic and requires the victim to view the poisoned post, so it is a genuine but low-urgency issue, reinforced by a very low EPSS score of 0.15% (4th percentile) and no indication of active exploitation in CISA KEV or the SSVC assessment (Exploitation: none, Automatable: no) - although publicly available exploit code does exist. Only sites running versions prior to 2.8.27 with low-privilege Contributor-level accounts are affected.
Stored cross-site scripting in the EmbedPress WordPress plugin before 4.6.7 allows an authenticated attacker holding at least the Contributor role to inject a payload through one of the plugin's block attributes, which is written into an HTML attribute without escaping and executes in the browser of a higher-privileged user (Editor or Administrator) who views or previews the compromised post. Exploitation is not autonomous - it requires an existing low-privilege account plus victim user interaction - and the independent assessment rates it as a plausible but low-priority issue; EPSS is 0.15% (4th percentile), CISA SSVC records no exploitation and no automatable path, and there is no KEV listing, although publicly available exploit code exists. A vendor fix is available in EmbedPress 4.6.7.
Authorization bypass in NextScripts SNAP (Social Networks Auto-Poster) before 4.4.8 allows an authenticated WordPress user who has been granted access to SNAP's posting features to export configured social account credentials, delete arbitrary posts, and reset the plugin configuration. The AJAX actions lack capability and ownership checks and rely on a nonce, which can be obtained from the plugin interface, so no administrator role is needed once posting access exists. Publicly available exploit code exists; EPSS is low at 0.13% (2nd percentile), there is no CISA KEV listing, and a vendor fix is available in 4.4.8.
Missing authentication in Coolify's GitHub App setup handler (Github::redirect at /webhooks/source/github/redirect) in versions up to and including 4.1.0 allows unauthenticated remote attackers to supply a crafted 'state' value matching an existing GitHub App UUID and cause the application to run the GitHub App manifest conversion flow, overwriting that App's stored client ID, client secret, webhook secret and private key. Publicly available exploit code exists, but exploitation is gated on knowing a valid - typically mid-setup - GitHub App UUID, which the independent assessment treats as raising attack complexity above the vendor's AC:L rating (CVSS:3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), making this a genuine but moderate-severity credential-overwrite issue rather than a trivially mass-exploitable bypass. No CISA KEV entry or confirmed in-the-wild activity has been reported; the CVE is currently associated only with published proof-of-concept material against the affected endpoint.
Missing authorization in Coolify up to and including 4.1.2 allows remote attackers to perform resource-update operations they are not entitled to, because the CanUpdateResource route-level middleware was shipped with its entire authorization body - the Gate::allows('update', $resource) check and the surrounding resource-resolution logic - commented out, turning it into a no-op pass-through. Any multi-user or multi-team Coolify deployment on 4.1.2 or earlier is exposed across application, database, service, server, environment and project update routes; the vendor's CVSS 4.0 vector rates the flaw PR:N while the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) indicates a valid authenticated Coolify account is realistically required, since the affected routes sit behind login. Publicly available exploit code exists and upgrading to 4.2.0 fixes the issue; there is no CISA KEV listing, so this is not confirmed active exploitation.
Unauthenticated remote users can still reach the installer and admin-config-setup endpoints of Krayin CRM (laravel-crm) 2.2.4 and earlier because the CanInstall middleware and InstallerController never abort once the application has already been installed, an authorization bypass that allows installer functionality to be re-driven on a live instance. Publicly available exploit code exists (a published advisory demonstrating an unauthenticated installer bypass), though there is no confirmed active exploitation (not in CISA KEV); the assessed vector is network-reachable, no privileges, no user interaction, with low confidentiality, integrity, and availability impact. Only self-hosted deployments left network-reachable with the Installer package present are exposed, and the vendor has released a patched version.
Sandbox escape leading to arbitrary host code execution in vm2 (the npm sandbox library, CPE cpe:2.3:a:patriksimek:vm2) affects all versions before 3.12.2 when NodeVM is configured with a custom `require.external` resolver and `context: 'host'`. Because the resolver records the allowed module directory as an unanchored prefix pattern, untrusted guest code can require an allowlisted package (e.g. `foo`) and then require a non-allowlisted sibling sharing that prefix (e.g. `node_modules/foo2/index.js`), whose top-level code is loaded via `hostRequire` in the host process before `vm.readonly` wrapping, yielding code execution outside the sandbox. Exploitation requires the non-default host-passthrough external-resolver deployment plus a prefix-sharing sibling package, but needs no authentication or user interaction (CVSS:4.0 9.5, AT:P/PR:N/UI:N; assessed CVSS:3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H); no public exploit code was identified at time of analysis and the flaw is not in CISA KEV, though the vendor has published patched commits and version 3.12.2.
Out-of-bounds write in Trusted Domain Project OpenDKIM through 2.11.0 allows remote, unauthenticated attackers to corrupt memory by sending a crafted DKIM-Signature header whose h= signed-headers tag is manipulated before it reaches dkim_canon_selecthdrs during canonicalization. The practical impact is expected to be a milter crash or mail-flow denial of service, with confirmed memory corruption rather than proven code execution, and the independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L while the supplied CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N. Publicly available exploit code exists for this issue, and no vendor-released patch was identified at time of analysis; the vendor was contacted and reportedly did not respond.
SQL injection in the addnewstudent.php endpoint of mathurvishal's CloudClassroom-PHP-Project lets remote attackers inject arbitrary SQL via user-supplied input, with the disclosed vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N, base 6.9) and our assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N both indicating no authentication barrier and a high confidentiality impact, with integrity loss limited to portions of the database reachable by the application's DB account. Publicly available exploit code exists: a proof-of-concept write-up was published on GitHub (vinniboy021-blip/Advisory, addnewstudent-sqli.md) complementing the VulDB entry, so the skill needed to weaponize the flaw is low, although there is no CISA KEV entry confirming active exploitation and no EPSS score was supplied. Practical exposure is heavily constrained because this is an unversioned, hobby-grade PHP project with no packaged releases, an unresponsive vendor, and an addnewstudent endpoint that in a real deployment may sit behind an administrative login even though the vector claims PR:N.
Command execution as the Liquidsoap process user is possible in AzuraCast through 0.23.x when an authenticated station user with Streamers and Profile permissions sets a streamer username containing shell metacharacters and a live recording session closes. The flaw (CWE-78, CVSS 8.7) requires the live-recording feature to be active and the malicious username to be passed unquoted into process.run during Liquidsoap config generation; there is no public exploit identified at time of analysis, and exploitation is limited to insiders or attackers who already hold streamer-level credentials on a station where recording is enabled.
Obot deployments started with the README's Docker quickstart expose port 0.0.0.0:8080 with authentication disabled, allowing unauthenticated attackers who can reach that port to take full Owner/Admin control of the Obot API and UI. Because every request is mapped to a synthetic 'nobody' user that already holds Owner and Admin roles, an attacker can register and launch attacker-controlled MCP servers, and since the quickstart also mounts /var/run/docker.sock into the container, that control extends to the host's Docker daemon. All versions through commit d7e6970 are affected; the vendor fix is documentation-only (the quickstart now enables authentication), no public exploit code has been identified at time of analysis, and instances are safe only if the operator set OBOT_SERVER_ENABLE_AUTHENTICATION=true or kept port 8080 off untrusted networks.
Unauthenticated local file inclusion in the WebFacing WordPress plugin before 5.4 lets any remote visitor reach a bundled script that the plugin fails to access-restrict and pass a user-supplied path into a local file include, exposing files readable by the web-server user such as wp-config.php. Exploitation requires no authentication, no user interaction, and no non-default configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U), and publicly available exploit code exists, though CISA KEV does not list this CVE as actively exploited and EPSS remains low at 0.31% (21st percentile). WPScan and the vendor rate confidentiality impact as Low (5.3), while our independent assessment rates it High (C:H) because the contents of readable configuration files can be immediately leveraged against the site.
Authorization bypass in Obot before v0.21.1 lets any authenticated user with a known MCP Server ID connect to restricted MCP servers through the /mcp-connect/{id} gateway endpoint, which fails to enforce Access Control Rules and MCP Registry membership. Because the gateway reuses Obot's stored OAuth/API credentials for the upstream server, an attacker in a Basic role or above can invoke that server's tools - reading and writing data in whatever backends those credentials reach - even when administrators explicitly scoped the server to a small group. Independently assessed at CVSS 9.3, this is a genuine high-priority authorization flaw limited to multi-user deployments that register credential-bearing MCP servers and depend on ACRs for isolation; no public exploit code has been identified at time of analysis, and vendor-released patched version 0.21.1 is available.
Unauthenticated information disclosure in the Mailchimp for WooCommerce WordPress plugin before version 6.3 allows anyone who already knows a customer's email address to retrieve that customer's saved cart contents and confirm that the individual shops at the store. The saved-cart endpoint trusts a request-supplied identifier derived from the customer's email without requiring authentication or verifying ownership, so the attack is remote, needs no credentials and no user interaction, but is limited to read-only disclosure of cart data for accounts whose email the attacker already possesses. Vendor-released patch is available (version 6.3), publicly available exploit code exists, and exploitation has not been confirmed as active (CISA KEV not listed); EPSS is 0.18% (6th percentile), consistent with a low-severity, targeted-reconnaissance issue rather than a mass-exploited one.
Unauthenticated attackers can retrieve digital-goods files attached to arbitrary orders through the Verge3D Publishing and E-Commerce WordPress plugin (through version 4.13.0) because its file-download handler performs no access control. CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a bounded confidentiality impact, and EPSS is 0.14% (3rd percentile); publicly available exploit code exists, but the vulnerability is not in CISA KEV and SSVC records exploitation as none. The exposure is confined to the digital-goods files themselves - not site credentials, admin functions, or the wider database.
Credential disclosure in the UpdraftPlus WordPress backup and migration plugin lets any authenticated user - including a low-privileged subscriber - read the passwords and secret keys of the site's configured remote backup destinations, but only while the site is left in a specific post-migration state. Affected releases are the 1.x branch from 1.23.8 up to (but not including) 1.26.8 and the 2.x branch from 2.23.8 up to (but not including) 2.26.8.26; both branches are fixed in 1.26.8 and 2.26.8.26. Publicly available exploit code exists via the WPScan entry, but EPSS is low at 0.14% (roughly 3rd percentile) and the CISA SSVC assessment records no observed exploitation, so exploitation depends on a site actually being in the vulnerable post-migration state.
Unauthenticated remote attackers can force the creation of a fixed author-role WordPress account - and repeatedly rotate that account's application password - on any site running the Optima Express IDX plugin from 8.5.0 up to (but not including) 8.7.6, because one of its AJAX actions lacks any authorization check and is exposed to logged-out users. Exploitation requires no authentication (PR:N), no user interaction (UI:N), and low complexity; publicly available exploit code exists, though CISA's SSVC records no observed exploitation and EPSS is low at 0.14% (3rd percentile). Impact is bounded: the forged account is an author, not an administrator, so the flaw yields low-level integrity and confidentiality effects rather than full site takeover.
Remote attestation relay in Edgeless Systems Contrast before 1.16.0 allows an attacker to impersonate a Contrast Coordinator or a Contrast workload and defeat attested TLS (aTLS) identity verification. Contrast accepted any TEE attestation report that verified correctly and matched expected firmware patch levels and software measurements, without binding that attestation to specific, physically-trusted hardware, so a valid report captured from one machine can be replayed to stand in for another. Per the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), no public exploit code has been identified at time of analysis, and this is not exploitable against a default deployment by a purely remote attacker: it requires a network man-in-the-middle position on the aTLS path plus a genuine TEE machine under the attacker's physical control. The vendor's CVSS 4.0 score of 9.1 (Critical) substantially overstates real-world risk because it does not fully reward the steep compound preconditions this attack requires.
OS command injection in Fleet's generator for Fleet-maintained macOS app install and uninstall scripts allows crafted Homebrew cask metadata containing shell metacharacters such as $(...) to be carried unescaped into scripts that run as root on managed macOS hosts. Manifests generated before 2026-08-19 are affected; the flaw is a supply-chain vector because the attacker needs no Fleet credentials, only the ability to land crafted metadata in an upstream Homebrew cask that must then survive both upstream Homebrew cask review and Fleet's review of the automated ingestion pull request before a managed host installs or uninstalls the app. The vendor CVSS 4.0 base is 8.9, but the vendor's own vector is PR:H while CERT's independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, and the two independent review gates plus central, pre-built manifest distribution on 2026-08-19 sharply limit real-world exploitability; no public exploit code has been identified and there is no confirmed active exploitation (not in CISA KEV), so exploitation is assessed as difficult rather than imminent.
Denial of service in vm2 sandboxes before 3.12.2 allows an untrusted script running via VM.run to terminate the host Node.js process. The BaseHandler construct trap returns Reflect.construct's result without calling markHostPromiseHandled() the way the adjacent apply trap does, so if an embedder exposes a constructable host function whose constructor returns a resident rejected Promise, invoking it with `new` and discarding the result lets the rejection cross the sandbox bridge unhandled; under Node's default strict unhandled-rejection policy this is promoted to a process-terminating uncaught exception. The bug is unauthenticated in the sense that the attacker only needs to submit script code (PR:N/UI:N), but exploitation is conditional: it requires a specific embedder integration exposing such a constructable Promise-returning host constructor, which is the AT:P precondition and is not vm2 default behavior; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Authenticated contributors can bypass publishing permissions and spoof post authorship in WordPress sites running WPeMatico RSS Feed Fetcher before 2.8.27. By running a feed campaign, a user with contributor-level access or above can publish posts live without editorial review and set any registered user, including an administrator, as the author. Publicly available exploit code exists, but no active exploitation has been reported, and the EPSS score is low at 0.13% (percentile 2%). The independent assessment rates this as a moderate-severity, low-priority authorization flaw.
Deserialization of untrusted data in MONAI's auto3dseg utility (monai/auto3dseg/utils.py) allows arbitrary code execution when algo_from_pickle() is called on an attacker-supplied .pkl file: the function reads the raw file bytes and hands them to pickle.loads() without any source or content validation, so any object defining __reduce__ runs in the victim application's context. Exploitation is conditional rather than remote-against-a-service: an attacker must first deliver a malicious pickle (model exchange, shared storage, or a pipeline input) and the victim's code must invoke this specific function, and per the authoritative assessment the vector is local with user interaction required (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rather than unauthenticated network exploitation. A working proof-of-concept is documented in the upstream GitHub advisory GHSA-89gg-p5r5-q6r4 (publicly available exploit code exists), but there is no confirmed active exploitation (CISA KEV).
Sandbox escape in the heym workflow platform before 0.0.91 allows an authenticated user who can author or edit workflow expressions to execute arbitrary Python and run operating-system commands as the backend process. The flaw lives in the expression engine's DotList map/filter item expressions and its fallback resolver, which fail to block dunder attribute traversal, letting an attacker chain attributes to reach functions such as os.system. Exploitation requires a valid account with workflow-authoring rights (PR:L) but no user interaction, making this a network-reachable, low-complexity compromise of confidentiality, integrity, and availability; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation.
Python eval()-based remote code execution in Heym (heymrun/heym) before 0.0.53 lets an authenticated user who can edit a workflow branch or condition node - or a victim who imports a workflow template containing a malicious condition node - run arbitrary Python as the backend process user whenever the workflow executes. The same release bundles four further flaws: fail-open Slack and Telegram webhook verification that allows unauthenticated workflow triggering with the owner's credentials when a trigger node has no credentialId or an empty signing secret, an OAuth redirect_uri scheme-validation gap that permits javascript:/data: URIs and script execution in the Heym origin, and plaintext storage of WorkflowExecutionToken, PortalSession, HITLRequest.public_token and OAuthAuthorizationCode values. No public exploit code and no confirmed in-the-wild exploitation were identified at time of analysis, and the 0.0.x pre-release product has a very small deployment base.
Code injection in AzuraCast through 0.23.5 lets an authenticated user holding the RemoteRelays station permission inject nested Liquidsoap interpolation syntax (for example #{#{EXPR}}) into the remote relay password field, achieving arbitrary code execution inside the Liquidsoap process, disclosing internal API keys, or disrupting station operation. The root cause is an incomplete migration in ConfigWriter.php from the vulnerable cleanUpString() sanitizer to the safe toRawString() helper; a prior commit (ff49ef4) migrated host, username, mount, name, description, genre, and URL fields but left the password field behind. No public exploit identified at time of analysis, and exploitation is gated by the RemoteRelays privilege (PR:L) and by the station's Liquidsoap configuration being regenerated and loaded.