Unauthenticated remote code execution affects all versions of SailPoint IdentityIQ through improper input validation in its web service API. Attackers on an adjacent network segment can submit crafted content to the API to execute arbitrary code on the server without authentication or user interaction. The vendor rates this as critical (CVSS 9.6); no public exploit code has been identified as of this analysis.
Path traversal in DbGate versions up to 6.8.1, 7.0.2, 7.1.8, 7.2.5, and 7.3.1 allows remote attackers to write files outside the intended upload directory by manipulating the filePath or fileName argument in the saveUploadedFile function of the save-uploaded-file endpoint (files.js). Publicly available exploit code exists (per VulDB and a GitHub PoC), and the vendor was contacted but did not respond. The vendor's CVSS 4.0 vector rates all impacts as Low (base 5.5, AV:N/AC:L/AT:N/PR:N/UI:N), while an independent assessment rates integrity impact as High (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N); per the vendor vector no authentication is required, but this is unverified and many deployments may sit behind authentication, which would raise the effective privilege requirement.
Improper authentication in the /bin/boa CGI dispatcher of Netcore NR289-GE firmware 1.4.5102 allows unauthenticated remote attackers to bypass credential checks on the router's web management interface, with low impact across confidentiality, integrity, and availability per both the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, E:P) and our assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Publicly available exploit code exists, including a GitHub write-up documenting the authentication bypass, so exploitation is a practical concern wherever the management interface is reachable - typically the LAN, or the WAN when remote administration is explicitly enabled (not default on most consumer routers). No vendor response was received and no vendor-released patch was identified at time of analysis. EPSS data was not provided; CISA KEV status is not indicated, so this is not confirmed actively exploited, but the presence of released exploit code and the low attack complexity make the exposure meaningful for any internet-facing or remotely-administered device.
Path traversal in the btrfs storage driver of Canonical LXD 4.0.2 and later allows an authenticated client that holds project-scoped permission to create instances to delete arbitrary files on the host as root by supplying a crafted subvolume path containing ../ sequences, and on hosts whose root filesystem is itself btrfs the same primitive escalates to placing attacker-controlled content at arbitrary host paths for full host compromise. The issue is rated CVSS v3.1 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H), reflecting a scope-changing breakout from a restricted tenant role into the host root context rather than a CVSS-inflated score, since a legitimate but limited project credential is the only prerequisite. No CISA KEV listing and no public exploit code were identified at time of analysis; vendor fixes are available in LXD 4.0.14, 5.0.10, 5.21.8 and 6.10.
Unauthenticated remote attackers can disclose object-group data from ООО НПО Ритм GEOritm deployments up to version 2.45.1 because the /restapi/objects/obj-groups REST API endpoint fails to enforce authentication when handling the objectId argument (CWE-306). Publicly available exploit code exists, but the impact is bounded to low-confidentiality information disclosure with no integrity or availability effect; the vendor has released version 2.46 and patched the hosted geo.ritm.ru service. The vulnerability was also registered with FSTEC Russia as BDU:2026-11235.
Unauthenticated remote attackers can invoke the routerd.passwd_set function exposed through the /ubus management interface on Netcore POWER13 (build 2.0.240730.162638) to reset or recover device credentials through a weak password-recovery mechanism (CWE-640). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the attack is remote, low complexity, and requires neither authentication nor user interaction, though practical exposure depends on whether /ubus is reachable from the LAN only or also from the WAN; impact is scored as limited across confidentiality, integrity, and availability. Publicly available exploit code exists - a detailed proof-of-concept write-up is published on GitHub - and the vendor was contacted but did not respond, so no vendor-released patch is identified at time of analysis. EPSS and KEV data were not provided; this is not confirmed as actively exploited.
DMARC policy evaluation in Trusted Domain Project OpenDMARC through 1.4.2 can be bypassed by mail carrying sending-domain identifiers that use Unicode full-stop equivalents (such as U+3002 or U+FF0E), which the Domain Handler in policy.c treats as equivalent to the ASCII dot when it should not. Because the flaw sits in the default inbound-milter use case, any MTA running OpenDMARC <=1.4.2 (typically via Postfix or Sendmail) that relies on OpenDMARC verdicts for spoofing decisions is exposed; remote, unauthenticated attackers can send specially crafted mail with no user interaction required. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and given the independent assessment the practical impact is limited to DMARC bypass/spoofing effectiveness rather than code execution, data access, or service disruption.
OpenDMARC through 1.4.2 can mishandle Internationalized Domain Name labels during DMARC policy lookup in opendmarc_policy_query_dmarc, allowing a remote, unauthenticated attacker to trigger an encoding error with a crafted email and potentially distort DMARC evaluation on internet-facing mail servers that run OpenDMARC as a milter/library, typically with Postfix or Sendmail. Publicly available exploit code exists, but the supplied data does not confirm active exploitation or a CISA KEV entry. The independent assessment rates this as a moderate integrity and availability issue rather than a high-urgency compromise: CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L, because the flaw requires an IDN/non-ASCII domain edge case and the practical payoff depends on downstream trust in the DMARC verdict.
Improper access control in the TCP Service of Thinkware U3000 dashcams running firmware up to 1.02.04 lets a remote attacker call the get_file function and read arbitrary files, most notably /tmp/wpa_supplicant.conf, which holds the device's Wi-Fi credentials. The CVSS vector shows no authentication, no user interaction, and network reachability (PR:N/UI:N/AV:N), so any host that can reach the camera's TCP service on the LAN or a routable network can trigger it, and publicly available exploit code exists. The impact is confidentiality-only (no integrity or availability effect), and the practical risk is limited less by exploit difficulty than by the product's small deployment footprint and the fact that the attacker must first reach the device's TCP service.
Unauthenticated snapshot disclosure in the Eyeplus IoT camera (version 57.0.0.0308) lets any attacker with network reachability to the device's p2pcam service retrieve a live camera snapshot from the /snapshot endpoint - no credentials, user interaction, or special configuration are required (CVSS:4.0 PR:N/UI:N/AC:L). Impact is confidentiality-only and low (VC:L, 6.9 base) with no integrity or availability effect, but publicly available exploit code exists: a proof-of-concept write-up is published in the GitHub advisory EYEPLUS-8001-Unauth-Snapshot-Disclosure, which raises the effective severity above the raw score. Real-world risk is governed by exposure, so cameras whose p2pcam/P2P service is reachable from the LAN, or from the internet when remote viewing is enabled, are the ones immediately affected.
SQL injection in the makeresult.php script of mathurvishal's CloudClassroom-PHP-Project lets remote attackers tamper with the makeid parameter and inject arbitrary SQL into the application's database queries. Because the project ships only as a continuously-delivered rolling codebase with no tagged releases, every self-hosted deployment tracking upstream - up to and including commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be - should be considered affected, and publicly available exploit code exists (there is no CISA KEV entry, so active exploitation is not confirmed). The CVSS v4.0 score is 6.9, while our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) weighs confidentiality loss as the dominant impact; overall risk stays moderate because exposure is limited to a small number of hobby/self-hosted instances of an unmaintained PHP application, and the vendor never responded to disclosure.
Path traversal in DbGate versions up to 7.3.1 allows unauthenticated remote attackers to write arbitrary files via the outputFile parameter in the exportModelSql function of the Export Handler. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no official patch is available. The CVSS 4.0 score is 5.5 (medium), with limited integrity and availability impact; exploitation requires the DbGate API to be network-reachable, and full code execution depends on targeting a sensitive write path.
Path traversal in DbGate versions up to 7.3.1 allows unauthenticated remote attackers to write arbitrary files via the Create Connection endpoint's zipJsonLinesData function when the filePath argument is manipulated. Publicly available exploit code exists, and the endpoint was omitted from earlier hardening (PR #1530/commit 5f99b4d82) that added checkSecureExportFilePath to other export endpoints. Practical exploitation depends on the DbGate instance being network-reachable, as it is commonly bound to localhost.
Unauthenticated remote path traversal in DbGate through 7.3.1 allows attackers to manipulate the linkedFolder argument in the Archive Link Creation createLink endpoint and access paths outside the intended archive link location. Publicly available exploit code exists, and the vendor was contacted but did not respond; exploitation is limited mainly by whether the DbGate web/API service is reachable by the attacker and by the filesystem privileges of the DbGate process. The assessed impact is low against confidentiality, integrity, and availability (CVSS 3.1 C:L/I:L/A:N; CVSS 4.0 6.9 Medium).
Information disclosure in the Thinkware U3000 dashcam (firmware versions through 1.02.04) allows a remote, unauthenticated attacker to retrieve stored Wi-Fi credentials by sending a crafted GET_STATUS request with a manipulated wifi_info argument to the device's TCP service. Publicly available exploit code exists, including a full technical write-up in the researcher's GitHub disclosure repository, so the technique is trivially reproducible, though practical exposure requires reaching the dashcam's TCP service over the local/Wi-Fi network it is joined to. CVSS 4.0 scores it 6.9 with E:P, and our own assessment (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) characterises it as a genuine but low-priority issue because confidentiality impact is real but integrity and availability are unaffected.
Improper access control in the Thinkware U3000 dashcam (firmware through 1.02.04) allows remote, unauthenticated attackers to abuse the TCP Service's PUT_FILE operation - manipulating its path argument - to read and write arbitrary files, including /tmp/wpa_supplicant.conf. Because no authentication, user interaction, or special configuration is required once the service is reachable (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, and the independent assessment's CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact), the practical barrier is exposure: an attacker must have a network path to the dashcam's TCP service, typically via its own Wi-Fi hotspot or a LAN it is bridged to, which limits internet-wide exploitation. Publicly available exploit code exists (published in the Turretsec disclosure), and the vendor was contacted but did not respond, so no fix is available; there is no CISA KEV listing, so active exploitation is not confirmed.
Refly through 1.1.0 uses a hard-coded JWT signing secret in apps/api/src/modules/config/app.config.ts, allowing unauthenticated remote attackers to forge authentication tokens and impersonate any user when deployments retain the default 'test' secret. Publicly available exploit code exists, and the vendor did not respond to the disclosure. The configuration is the limiting factor: operators who override the JWT secret with a strong environment-provided value are not exploitable.
An uncaught exception in the NAS message decoder of aligungr UERANSIM's gNB component (nr-gnb, versions up to and including 3.3.0) lets a remote, unauthenticated sender crash the simulated 5G base station by delivering a malformed plain Initial NAS message during AMF slice selection, causing the gNB process to terminate. Availability-only impact: no confidentiality or integrity effect, and exploitation is limited to UERANSIM lab/test deployments. Publicly available exploit code exists (a PoC gist is referenced), but there is no indication of confirmed active exploitation, and an upstream fix commit is available.
Malformed DMARC policy tags (fo, rf, ri, pct, sp, adkim, aspf, rua, ruf) supplied in attacker-controlled DNS TXT records trigger improper handling of exceptional conditions in OpenDMARC 1.4.2 and earlier (opendmarc_policy_parse_dmarc), letting remote unauthenticated senders disrupt or weaken DMARC enforcement on mail servers that run OpenDMARC as a Postfix or Sendmail milter. Impact is confined to availability (milter crash/denial of processing) and integrity (misapplied or weakened policy), not code execution or data theft. Publicly available exploit code exists, and the vendor was contacted early but did not respond, so no vendor-released patch is identified at time of analysis; the independent assessment characterizes this as a genuine but modest DMARC-integrity issue rather than a high-severity emergency.
Off-by-one bounds error in Trusted Domain Project OpenDMARC through 1.4.2 lets a remote, unauthenticated attacker send a crafted message that causes the DMARC record parser's opendmarc_util_cleanup routine to write one byte past the end of a buffer; publicly available exploit code exists. The practical impact is narrow - the overflow is a single NUL byte, so the realistic outcome is a crash or denial of service rather than controllable memory corruption, which aligns with the independently assessed CVSS:3.1 vector (C:N/I:L/A:L). The flaw requires the target to run an affected OpenDMARC milter on an internet-facing mail server and to process attacker-influenced input whose length exactly equals the destination buffer size, so triggering is constrained.
SQL injection in the updateresultdetails.php script of the CloudClassroom-PHP-Project allows remote attackers to manipulate the 'editid' parameter and potentially read or modify database contents. The vulnerability is confirmed by publicly available exploit code, and the vendor has not responded to disclosure, leaving all versions affected because the project lacks versioning. Despite a high technical severity (assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), real-world risk is low due to the project's limited deployment as an unmaintained hobby application.
Server-side request forgery (SSRF) in October CMS 4.3.4 and earlier allows unauthenticated remote attackers to bypass the validateExternalImageHost protection in System/Classes/ResizeImages.php by supplying a crafted IPv6-mapped IPv4 host, causing the server to fetch attacker-controlled or internal URLs. Publicly available exploit code exists (no CISA KEV confirmation of active exploitation), and the assessed impact is a largely blind SSRF with Low confidentiality, integrity and availability impact, so real-world severity depends on what internal services or cloud metadata endpoints the server can reach. October CMS 4.3.5 resolves the bypass; the issue is genuine but should be treated as low-to-moderate priority.
Incomplete scheme validation in October CMS's image resizer (getSourcePathForResize() in modules/system/classes/ResizeImages.php) allows non-HTTP PHP stream wrappers such as phar://, file:// and ftp:// to be stored in the resize cache and later handed to the underlying image library, producing a server-side request forgery condition that on phar:// paths can trigger metadata deserialization during subsequent file operations. Affected builds are 4.1.x up to 4.1.19, 4.2.x up to 4.2.25 and 4.3.0 through 4.3.4; upgrading to 4.3.5 or 4.4.0 resolves the issue (patch commit 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58). Publicly available exploit code exists (reported by 0xGenesi, tracked as CVE-2026-100909), but no confirmed active exploitation has been observed; reachability is narrow because the flaw only matters where a pre-existing injection primitive already pipes untrusted input into the |resize Twig filter or the ResizeImages::resize() API without validating the scheme, so default templates and trusted-value usages (uploaded file models, theme assets, static URLs) are not exposed.
Unauthenticated information disclosure in Eyeplus firmware 57.0.0.0308 lets remote attackers retrieve user account records - including plaintext passwords - by invoking the GetUsers operation on the ONVIF Device service at /onvif/Device. Both the vendor CVSS 4.0 vector (6.9) and the independent assessment (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) agree the flaw is network-reachable, unauthenticated (PR:N), requires no user interaction, and yields high confidentiality impact with no integrity or availability effect. Publicly available exploit code exists (a GitHub proof-of-concept advisory), and because credentials are returned in cleartext the exposure is especially severe - the only limiting factor is network reachability of the ONVIF interface, which is frequently LAN-restricted unless the device is internet-exposed or port-forwarded.
Server-side request forgery in athlon1600 youtube-downloader up to 4.0.1 lets remote, unauthenticated attackers make the server issue attacker-controlled HTTP/HTTPS requests by manipulating the url argument of public/stream.php. Publicly available exploit code exists (per VulDB and the linked exploit gist), but there is no CISA KEV confirmation of active exploitation, and assessed impact is limited to low confidentiality and integrity effects against internal services and cloud metadata endpoints reachable from the host. The vendor was contacted early and never responded, and the only code change tied to this component (commit 6ffe823, 'better security for public/stream.php') is a partial hardening rather than a fix.
A NULL pointer dereference in the Trusted Domain Project's OpenARC ARC milter (affected versions up to and including 1.0.0.Beta1) allows a remote, unauthenticated sender to crash the milter by delivering an email whose ARC canonicalization (c=) tag causes arc_parse_canon_t in libopenarc/arc-canon.c to dereference a NULL pointer. Publicly available exploit code exists, but the impact is confined to availability - the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and the reported CVSS 4.0 vector both carry no confidentiality or integrity consequence, so this is a pure denial-of-service condition, not code execution or data exposure. Exploitation requires that OpenARC be deployed inbound on a Postfix or Sendmail MTA and actively performing ARC validation on received mail, which limits real-world exposure given the product's beta-stage, optional mail-authentication footprint.
Server-side request forgery in Privoce VoceChat Server 0.5.36 and earlier lets unauthenticated remote attackers force the server to issue outbound HTTP requests to arbitrary URLs through the OpenGraph link-preview endpoint, potentially reaching internal services or cloud metadata endpoints reachable from the server's network position. Publicly available exploit code exists, and the vendor was notified early but did not respond, so no vendor-released patch has been confirmed. Per the assessed vector (AV:N/AC:L/PR:N/UI:N) this is a real but moderate-priority SSRF - no credentials or user interaction are required, but impact is bounded to low confidentiality, integrity and availability effects and depends on whether fetch responses or errors are reflected back to the attacker (blind vs non-blind is not confirmed in the source data).
Remote denial of service in aligungr UERANSIM up to 3.3.0 allows an unauthenticated network attacker who can reach the nr-gnb signaling interface to trigger memory corruption by sending a crafted dedicatedNASMessage in an RRC ULInformationTransfer message. The assessed impact is limited to availability loss (crash) rather than code execution, confidentiality, or integrity compromise, and the affected software is an open-source 5G simulator typically deployed in research or test networks. Publicly available exploit code exists, and the vendor was reportedly contacted but did not respond.
A NULL pointer dereference in the Trusted Domain Project's OpenDMARC (up to and including 1.4.2) can crash the mail filter when it processes certain SPF data for an inbound message. The flaw sits in opendmarc_spf_ipv6_explode() in libopendmarc/opendmarc_spf.c, where manipulation of the `cp` argument causes the parser to dereference a NULL pointer; it is remotely reachable by an unauthenticated attacker (CVSS 4.0 6.9, CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) who can influence the SPF information evaluated during mail handling. Publicly available exploit code exists and the vendor did not respond to the disclosure, but there is no confirmed active exploitation (not listed in CISA KEV). Impact is limited to availability of the filter process rather than host compromise; the referenced proof-of-concept is published at weitongli.com.
Arbitrary code execution in Google Cloud Application Integration (versions prior to 2026-06-28) allows an authenticated user holding only standard permissions to run code on shared, multi-tenant production servers by crafting a JavaScript Task script that bypasses the platform's built-in parameter guards and reaches an unsafe deserialization path. The CVSS 4.0 base score is 9.4, and because the flaw breaches the tenant trust boundary the subsequent-system metrics are also High, meaning other customers on the same shared infrastructure are exposed rather than just the attacker's own tenant. Authentication is required (CVSS vector PR:L), there is no public exploit identified at time of analysis, and Google remediated the issue entirely server-side on 28 June 2026, so no customer action is needed and the vulnerability is no longer exploitable against the managed service.
Authenticated Google Cloud users holding permission to configure Application Integration tasks could abuse an incorrectly authorized, internal-only task type to trigger arbitrary internal RPCs that executed inside Google's production network under a privileged Google identity. The flaw (CWE-863) affected Application Integration on Google Cloud Platform in all versions prior to the 17 June 2026 fix, and the vendor's CVSS 4.0 vector of 9.4 reflects a genuine privilege-escalation and scope-crossing condition (SC/SI/SA:H) rather than simple data exposure. Google remediated the issue server-side on 17 June 2026 and states no customer action is required, meaning no current deployment remains exploitable; no public exploit code has been identified at time of analysis, and CISA KEV does not list this issue.
Blocked accounts can keep authenticating on the authentication paths that the Blacklist Manager for WooCommerce WordPress plugin (versions 1.3.0 through 2.3.1) fails to hook, so a user whom the site owner has explicitly blocked retains the privileges of their original role - typically a customer-level WordPress/WooCommerce account - with the block neither enforced nor recorded. Exploitation requires the attacker to already hold valid credentials for a blocked account (CVSS 3.1 score 5.4, AV:N/AC:L/PR:L/UI:N, authenticated), and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) is indicated at time of analysis. Because access is capped at the account's existing role, there is no privilege escalation - impact is limited to confidentiality and integrity of data that account could already reach, plus the failure of the blocking control itself.
Quadratic-time CPU exhaustion in the brace-expansion npm library (all releases prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12) lets unauthenticated remote attackers stall the Node.js event loop by supplying a crafted brace pattern shaped like '{a},b}' with a very large number of trailing closing braces. Parsing such input forces successive full-string rescans with growing working strings, so ~128 KB of the payload has been measured to block the event loop for tens of seconds; the process recovers afterward, making this a recoverable denial-of-service rather than a persistent crash, which is why it is rated only 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Exploitation requires that an application pass attacker-controlled input into expand() - directly or transitively through consumers such as minimatch/glob - and it affects Node.js runtimes only; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Malformed JSON Web Token headers can cause an uncaught RecursionError in PyJWT 2.13.0 through versions before 2.14.0, resulting in HTTP 500 for the request handling the token. Unauthenticated remote attackers can trigger the condition by sending a deeply nested JWS header to an application that calls jwt.decode or PyJWS.decode on untrusted token input. No public exploit identified at time of analysis; the assessed CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), making this a bounded availability impact rather than a confidentiality or integrity compromise.
Unauthenticated time-based blind SQL injection in the Dayforce Payroll password-recovery (forgot-password) function lets remote attackers push arbitrary SQL into a query parameter that is concatenated into a SQL predicate, potentially exposing or altering backend payroll data. The published CVSS 4.0 score is 9.3 with PR:N and no user interaction, and the independent assessment agrees on high confidentiality and integrity impact with no availability impact, but exploitation is time-based blind, so it demands many timed requests and is slower and more detectable than direct exfiltration. The issue is confirmed only in version R2026.2.0 after unsuccessful vendor contact attempts; no public exploit code or confirmed active exploitation was identified at time of analysis, and because much of Dayforce is delivered as vendor-hosted SaaS the set of independently exploitable targets is narrower than the raw score implies.
Unauthenticated SQL injection in the OrdaSoft Book Library (Free) extension for Joomla, affecting all versions below 6.4.6, allows remote attackers to inject arbitrary SQL into an ORDER BY clause via the field and direction request parameters handled by the books() function in site/booklibrary.php. Because the injection lands in an unquoted ORDER BY position, the extension's keyword-blacklist filter (protectInjectionWithoutQuote()) can be defeated with a trailing decoy comment such as '-- xselect' that makes the filter merely quote the value instead of rejecting it, and exploitation requires only a prior request to prime session-stored sort defaults before the vulnerable code path is reached. Both the vendor's CVSS 4.0 vector (9.3, AV:N/AC:L/AT:N/PR:N/UI:N, high C/I/A) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicate a fully unauthenticated, low-complexity, network-reachable flaw with high confidentiality, integrity, and availability impact; no public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated SQL injection in the OrdaSoft Real Estate Manager (Free) extension for Joomla before 6.7.9 allows remote attackers to inject arbitrary SQL through the order_field parameter, which is concatenated unquoted into the ORDER BY clause of three public frontend property-listing queries (category browsing, search results, and full listing). Because the injection point is exposed on pre-authentication pages with no login, user interaction, or non-default configuration required, any reachable installation is at risk; the assessed impact is high confidentiality loss (blind extraction of database contents), while the ORDER BY sink constrains the attacker to data-read techniques rather than direct modification. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the only reference supplied is the vendor site, so patch status should be verified directly with OrdaSoft.
Unauthenticated SQL injection in the Vehicle Manager (Free) extension for Joomla versions prior to 6.5.8 allows remote attackers to inject SQL code via the order_field and order_direction parameters at three frontend entry points (category listing, search, and all-vehicles listing). Because the injection point is an unquoted ORDER BY clause, exploitation is constrained to blind/inferential techniques, but it can still lead to high confidentiality impact (e.g., extraction of sensitive database contents) with limited integrity and availability impact. No public exploit code has been identified, and the vulnerability requires no authentication or non-default configuration, making any public-facing installation a potential target; however, the overall real-world priority is moderate due to the product's footprint.
Unauthenticated OS command injection in the WatchGuard AP internal API service lets any host that can reach the access point's management-facing API execute arbitrary shell commands on the device's underlying operating system, yielding full compromise of confidentiality, integrity, and availability of the AP itself. Per the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no credentials or user interaction are required, but exploitation is gated by network reachability - an attacker must be able to route to the internal API endpoint, which in practice points to the same network or management segment as the AP rather than arbitrary internet-wide exposure. No public exploit code has been identified and there is no CISA KEV entry at time of analysis, though the 9.3 severity and the absence of authentication make this a genuine high-priority issue where management-plane exposure exists; no EPSS score was included in the available data. A vendor PSIRT advisory is published at https://psirt.watchguard.com/CVE-2026-86102.
Authentication bypass in the internal API service of WatchGuard Access Points lets unauthenticated attackers who can reach the AP's management or internal API network obtain a valid API session. The issue is rated CVSS 9.3 by the vendor and assessed as high priority, with high confidentiality, integrity, and availability impact on the AP; exploitation requires network adjacency or Wi-Fi range rather than guaranteed internet exposure. No public exploit or confirmed active exploitation was identified at time of analysis.
Unauthenticated attackers can mark any order in a WordPress site running the Verge3D Publishing and E-Commerce plugin (versions 4.1.0 through 4.13.0) as paid without any payment ever being made. The plugin fails to confirm the transaction with the payment provider and fails to verify that the order belongs to the requesting party, so a fully remote, low-complexity request (CVSS 3.1: AV:N/AC:L/PR:N/UI:N) is enough to flip order status; the resulting impact is integrity-only and limited (C:N/I:L/A:N, score 5.3 MEDIUM), meaning goods or services may be released on unpaid orders rather than data being exposed or the site taken down. Publicly available exploit code exists - the WPScan advisory documents the flaw - and exploitation is confirmed only against sites that actually sell through this plugin's order workflow; no CISA KEV entry indicates confirmed active exploitation.
An unauthenticated payment-verification bypass in the Paymattic WordPress plugin (versions 4.6.20 through 4.6.25) lets attackers mark arbitrary pending orders as paid without actually paying the order's amount. The plugin fails to confirm that a Stripe payment belongs to the order it is being applied to, so an attacker can complete a small, genuine Stripe payment of their own and redirect that confirmation at a victim's pending order, obtaining goods or services for a fraction of the price. Publicly available exploit code exists and the flaw is remotely exploitable with no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3), though real-world applicability is constrained by the requirement that Stripe be the active gateway and that a pending order be available to hijack.
Unauthenticated attackers can zero out the price of paid appointments in the Bookly WordPress plugin before 28.3 by manipulating the client-supplied booking quantity that the plugin uses to compute the appointment total, allowing them to book paid services for free and skip the payment step entirely. The issue is a server-side validation gap in the booking total calculation, and publicly available exploit code exists, so any publicly reachable WordPress site running an affected version with a paid service exposed on the front-end booking form is remotely exploitable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Impact is confined to integrity - fraudulent or underpriced bookings - with no confidentiality or availability effect, and there is no CISA KEV confirmation of active exploitation at time of analysis.
Missing authorization on a REST route in the WP Verify API WordPress plugin (versions through 1.0.0) allows unauthenticated remote attackers to insert arbitrary data into the plugin's own database table and to make the affected site dispatch templated verification emails to any email address they choose. Because the route has no permission callback and no rate limiting, it can be driven repeatedly and at scale, though impact is limited to integrity (CVSS 5.3, C:N/I:L/A:N) rather than data disclosure or denial of service. Publicly available exploit code exists and the issue was reported via WPScan, but there is no confirmation of active exploitation (CISA SSVC exploitation: none) and the practical exposure is constrained by the plugin's low adoption rate.
Remote, unauthenticated attackers can retrieve arbitrary local files from Dayforce Payroll by calling its file-download functionality with an absolute path or directory-traversal sequence in the file path parameter, with the server returning the file contents directly in the response. The issue is scored CVSS 4.0 9.2 (vendor/NVD) - network-reachable, low complexity, no privileges or user interaction required, high confidentiality impact, and a scope change to subsequent systems - making payroll data, PII, credentials and configuration secrets the realistic target set. Because vendor contact attempts were unsuccessful, only version R2026.2.0 is confirmed affected and the full version range remains unknown; no public exploit code has been identified at time of analysis.
Missing rate limiting on the authentication API of Nginx Proxy Manager through 2.16.0 allows unauthenticated remote attackers to submit unlimited password guesses to POST /api/tokens and then unlimited TOTP guesses to POST /api/tokens/2fa, ultimately obtaining a valid session and full administrative control of the instance. No public exploit code was identified at time of analysis and the CVE is not in CISA KEV, but the weakness is directly reachable by anyone who can talk to the admin interface, which is commonly internet-exposed on self-hosted deployments. Successful compromise is probabilistic rather than certain: it depends on the target account using a weak or previously-breached password and, where 2FA is enabled, on additionally guessing a rotating six-digit code, which is why our assessed CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) is more conservative than the published 9.1 CVSS 4.0 score.
Authenticated low-privilege attackers can achieve remote code execution on ManageEngine DDI Central deployments before build 6201 by uploading arbitrary files through the High Availability failover configuration-sync endpoint, which writes attacker-controlled content to the filesystem and enables code execution. The flaw is network-reachable with low complexity and no user interaction, but requires valid credentials and that the HA feature be reachable; no public exploit code or active exploitation is currently confirmed. With a CVSS base score of 8.8, the issue carries high confidentiality, integrity, and availability impact for affected infrastructure-management instances.
Unauthenticated access to Bluehood's /api/* endpoints in releases before 0.7.1 lets any network attacker who can reach the dashboard HTTP port read Bluetooth tracking data and rewrite application state - the heartbeat URL, prune retention, device groups and per-device notes - whenever the operator has enabled the opt-in auth_enabled setting. The root cause is a missing authorization check: only the HTML page handlers called the session-validation routine, while the settings, devices, groups and /api/device/{mac}/notes handlers performed no check at all, allowing requests carrying no session cookie to succeed (CWE-306, CVSS 3.1 9.1 with PR:N/AC:L). Real-world urgency is tempered by the niche deployment and the fact that the dashboard must be reachable over the network rather than bound to localhost; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Signature forgery in PyJWT before 2.14.0 allows an attacker who knows a target's asymmetric public key to forge HMAC-authenticated JWTs when the application mixes HMAC and asymmetric algorithms and passes asymmetric public-key PEM bytes into HMAC verification. The flaw is in is_pem_format in jwt/utils.py, which fails to recognize all PEM formatting variants accepted by the cryptography loader, causing HMACAlgorithm.prepare_key to treat a mutated public-key PEM as an HMAC secret. Exploitation requires a specific non-default deployment pattern-mixed algorithm verification with raw PEM key bytes-and the assessed CVSS vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N; no public exploit identified at time of analysis, and no CISA KEV status was provided.
JWKS trust-boundary bypass in PyJWT's PyJWKClient allows a configured trusted JWKS endpoint that returns an HTTP 3xx redirect to steer the client to an attacker-chosen host, which is then consumed as authoritative key material; the same mechanism can forward caller-supplied request headers such as Authorization to that destination. Only PyJWT 2.13.0 and earlier are affected (fixed in 2.14.0), and exploitation is not unconditional: it requires the application to actually use PyJWKClient for remote JWKS fetching, attacker influence over the trusted endpoint's redirect response, and - for credential leakage - caller-supplied headers passed into the client, or - for forged-JWT acceptance - a mixed-configuration deployment. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is low at 0.16% (4th percentile), and CISA SSVC rates Exploitation as 'none' and Automatable as 'no', so the practical risk sits well below the headline 9.1 base score.