Authorization bypass in the MediaWiki WikiLambda (Wikifunctions) extension version 1.46 lets an authenticated wiki user reference and operate on objects belonging to another user or scope, because the extension resolves a client-supplied object key without re-authorizing it against the requesting account. Exploitation is gated: the independently assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) requires a valid account, high attack complexity, an attack precondition that must be present, and some victim-side interaction, and only wikis that explicitly install WikiLambda rather than plain MediaWiki are exposed. No confirmed active exploitation is reported (not listed in CISA KEV); the advisory's CVSS 4.0 vector carries an E:P exploit-maturity metric and a Gerrit change is linked, indicating an upstream fix and proof-of-concept-level maturity rather than confirmed in-the-wild attacks, with no EPSS data supplied.
An authenticated administrator of Kiteworks Email Protection Gateway can exploit a path-traversal weakness to write a file outside its intended location and have the application execute it, resulting in remote code execution as the gateway's underlying service account. The issue is rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H): it is network reachable and low complexity, but gated behind high-privilege administrator credentials, which substantially constrains real-world exposure and makes this a moderate, not urgent, priority. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Arbitrary command execution on Kiteworks Email Protection Gateway is possible in all versions before 9.5.0: an authenticated administrator can import a crafted configuration file whose contents are insufficiently validated, allowing commands to run on the appliance with the privileges of the gateway service (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector requires PR:H, this is not a remote unauthenticated attack - it is realistically an insider, malicious-admin, or post-credential-compromise escalation from administrative access to full code execution on the gateway. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fix is version 9.5.0.
Privilege escalation in the WP User Frontend WordPress plugin before 4.3.12 lets unauthenticated visitors tamper with the role value submitted by the plugin's front-end registration form and create an account with elevated privileges such as Editor (the administrator role cannot be obtained this way). The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms unauthenticated remote exploitation with no user interaction, but the AC:H reflects a narrow environmental precondition: the site must run on a PHP build where the sodium (libsodium) extension is unavailable, and a public registration page must be configured through the plugin. No public exploit code has been identified at time of analysis, and the SSVC assessment records Exploitation: none; impact is scored High for confidentiality and integrity with no availability effect.
Arbitrary file write in Kiteworks Core before 9.5.0 lets a holder of an existing administrative account steer the platform's administrative export feature to write files to any path on the underlying host, which can be chained into command execution on the appliance. The root cause is an improper restriction of a user-supplied file path (CWE-22), scored CVSS v3.1 7.2 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, so the flaw is not reachable by unauthenticated or standard users and command execution is a downstream consequence of the write rather than a guaranteed outcome. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis; the primary constraint on real-world risk is the high-privilege prerequisite.
OS command execution in Kiteworks Core is possible when the remote-support capability is licensed and enabled and an authenticated System Administrator also possesses the key protecting submitted data, allowing that administrator to redirect the outbound support connection to an attacker-chosen destination that can then execute OS commands with local service account privileges. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, so exploitation requires high application privileges plus the additional key-possession condition, and deployments without remote support enabled are not exposed; there is no public exploit identified at time of analysis and no CISA KEV indication. The independent assessment rates real-world priority low-to-medium despite the 7.2 High base score.
Path traversal (CWE-22) in Kiteworks Email Protection Gateway allows an authenticated administrator to move files to locations outside the designated directory of an optional, non-default administrative file-move feature, which can potentially be leveraged to execute arbitrary code on the underlying host. The vulnerability is network-reachable with no user interaction (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but exploitation requires high-privileged administrator credentials and that the optional feature be enabled - environments running default configurations without this feature are not exposed. Only the CVE.org advisory and a CISA CSAF record are available at time of analysis, and no public exploit code has been identified; the admin-privilege prerequisite and non-default feature gate are the primary factors limiting real-world exploitation.
Path traversal in the administrative import function of Kiteworks Email Protection Gateway allows an authenticated administrator to write files to arbitrary filesystem locations, which can potentially be escalated to arbitrary code execution on the underlying server. All versions prior to 9.5.0 are affected; exploitation requires a high-privileged admin account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) and the impact on confidentiality, integrity, and availability is rated High. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the EPSS score was not provided in the available intelligence.
Authenticated administrators holding a specific queue-management privilege on Kiteworks Email Protection Gateway (versions before 9.5.0) can submit a crafted serialized object to the cluster management interface that is deserialized without sufficient validation, resulting in arbitrary code execution in the context of the gateway service account. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) makes clear this is not reachable by unauthenticated users, standard users, or admins lacking the queue-management entitlement, and no user interaction is required once a suitably privileged account exists. No public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) has been reported, and vendor-patched versions are available.
Remote code execution in Kiteworks Email Protection Gateway allows an authenticated administrator to upload a crafted backup file that the product fails to sufficiently validate, then influence how the application loads it so that attacker-supplied code executes under the gateway's underlying service account. The flaw is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-94 code injection; exploitation is gated by high-privilege authentication, making it a realistic post-compromise, insider, or credential-chaining vector rather than an unauthenticated internet-wide threat. No public exploit code and no confirmed active exploitation (CISA KEV) were identified for this CVE at time of analysis, and no EPSS score was supplied in the available intelligence.
Remote code execution on the Kiteworks Email Protection Gateway is achievable by an authenticated administrator who supplies a configuration setting in a form the gateway's input validation does not recognize, allowing an otherwise-rejected value to be written to the appliance as a file and executed under the gateway service account. The vendor rates this 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and our independent assessment concurs: the flaw is network-reachable, low-complexity, and requires no user interaction, but it is gated behind high administrative privileges (PR:H), so it is not exploitable by unauthenticated or low-privileged users. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV; realistic risk therefore hinges on admin-credential compromise, insider misuse, or chaining from a separate privilege-escalation flaw rather than opportunistic mass exploitation.
Unsafe reflection in Kiteworks Email Protection Gateway (all versions before 9.5.0) allows an authenticated administrator holding mail-rule configuration privileges to import a crafted rule configuration that causes the mail-processing pipeline to load and execute code outside the approved set of mail-processing components, resulting in code execution in the context of the mail-gateway service account (CVSS 3.1 base 7.2, High; vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is gated behind a high-privilege account (PR:H) with mail-rule import rights and requires no victim interaction, so the practical exposure is insider abuse or lateral movement after an attacker has already compromised such an administrative account; there is no unauthenticated or anonymous path. No public exploit code has been identified and the issue is not listed in CISA KEV; the vendor-supplied fix is version 9.5.0.
Server-side template injection in the Kiteworks Core appliance allows an authenticated System Administrator to store a crafted system-notification template whose embedded template-engine expressions are evaluated when the notification is next rendered, resulting in operating-system command execution on the appliance. Exploitation requires a high-privileged admin account (CVSS vector PR:H, UI:N) and has a timing dependency because the payload only fires when the affected notification is triggered, making this a malicious-insider or compromised-admin scenario rather than a perimeter-reachable RCE. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor-assigned CVSS 3.1 score of 7.2 (C:H/I:H/A:H) reflects full compromise of confidentiality, integrity, and availability once the template is rendered.
Out-of-bounds write in the NVIDIA Virtual GPU Manager (vGPU plugin) lets an unprivileged user inside an assigned guest VM corrupt host-side memory by sending a specially crafted RPC call across the virtualization channel, resulting in privilege escalation, data tampering, and denial of service on the host. Rated CVSS 7.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H), the bug is only reachable in vGPU/VDI/cloud-GPU deployments where the host runs the vGPU plugin and has at least one guest assigned; it is not a network-facing flaw and does not affect standard bare-metal Linux GPU driver installs, and no public exploit code has been identified at time of analysis. Real-world risk is therefore defined by the attack surface rather than by mass exploitability, since a successful attack requires an attacker to already hold an unprivileged local account inside a hosted guest VM.
Information disclosure and data tampering can be achieved by a local low-privileged attacker exploiting a missing authorization check in the NVIDIA GPU Display Driver for Windows kernel module. Affected products include the GeForce, RTX/Quadro/NVS, and Tesla driver branches on Windows; exploitation requires local authenticated access (PR:L) and no user interaction (UI:N). No public exploit code or active exploitation has been identified at time of analysis; the CVSS score is 7.3 with scope change (S:C) that amplifies risk in multi-user or cloud-GPU environments.
Arbitrary file write in oc-mirror allows an attacker who controls or tampers with an operator catalog image to write files outside the intended extraction directory when a user mirrors that catalog using the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature). The issue is a path traversal (CWE-22) in tar entry extraction, assessed as local (AV:L), no privileges required (PR:N), but requiring user interaction (UI:R) because an administrator must run the mirror command; impact is high integrity and low availability, with no confidentiality impact per the independent assessment. No public exploit or active exploitation is identified at time of analysis, and the independent assessment characterizes this as a moderate, defender-actionable issue rather than an urgent internet-facing emergency.
Privilege escalation in Kiteworks Core allows a delegated administrator whose scope includes role changes to promote an account to full system-administrator through the user-provisioning interface, which fails to verify that the requester is entitled to grant the role being assigned (CWE-266). The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2 High) confirms the flaw is network-reachable but requires high-privileged, delegated-admin credentials and no user interaction, so anonymous or ordinary-user accounts cannot exploit it and environments without scoped admin roles have no trust boundary to cross. No public exploit identified at time of analysis and no KEV listing; independent assessment rates this a genuine but low-to-medium operational priority rather than a high-urgency issue.
Privilege escalation in Kiteworks Core versions before 9.5.1 allows an authenticated delegated administrator holding only a single narrowly scoped administrative permission to obtain full system administrator privileges by abusing the administrative import function for integration credentials, which fails to verify that the requesting administrator is entitled to create the privileged credential being imported (CVE-2026-102132, CVSS 7.2 High). The attacker must already possess a valid delegated-admin account (PR:H), so this is an insider or lateral privilege-escalation issue rather than an unauthenticated internet-facing takeover, and no action by an existing system administrator is required for the escalation to succeed (UI:N). A vendor patch is available in Kiteworks Core 9.5.1; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Improper privilege management in Kiteworks Core before 9.5.0 allows an authenticated administrative user who holds only limited, non-Sysadmin role-management permissions to grant another account full system-administrator (Sysadmin) rights that the grantor was never authorized to confer. The flaw sits in the role-assignment logic, which fails to constrain grantable privileges to the subset the granting administrator actually possesses, so a single delegated-admin session is enough to escalate a chosen account to the highest privilege level. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) the attack is network-reachable with no user interaction but requires an already-authenticated high-privilege session; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV). This is best characterized as a genuine but access-gated integrity risk whose real-world exposure depends on how many delegated administrators exist in a deployment and how tightly their role scopes are managed.
Stored SQL injection in Kiteworks Core before 9.5.0 allows an authenticated administrator to read sensitive data from the underlying database and to degrade availability of the service. Exploitation is only reachable through the affected administrative reporting feature and requires an existing, authenticated administrative account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), so the flaw is not exposed to unauthenticated or low-privileged users; no public exploit code has been identified at time of analysis, and no CISA KEV entry or EPSS score accompanies this CVE. Our independent assessment rates the issue at moderate priority: confidentiality and availability impact are high, but integrity impact is limited (C:H/I:L/A:H), and the mandatory full administrative privilege sharply narrows the realistic attack surface to trusted insiders or attackers who have already compromised an admin session.
Unauthenticated access to an internal service function in the Kiteworks Advanced Forms / Secure Data Forms component allows remote attackers who can reach the exposed endpoint to invoke a limited set of backend service operations on the Kiteworks platform. The flaw requires no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) and is bounded by design: the vendor states the reachable function cannot access user accounts, stored files, or form submissions, and exploitation is impossible if the component is not network-exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS/KEV signals were not provided; overall this represents a moderate real-world risk concentrated on internet-facing Kiteworks deployments that have the Advanced Forms functionality enabled.
PHP object injection in the ThemeHigh 'Extra Product Options For WooCommerce | Custom Product Addons and Fields' plugin through version 3.3.8 allows an authenticated user holding the WooCommerce shop_manager role or higher to pass a crafted serialized payload into a deserialization sink, enabling arbitrary PHP object instantiation that can escalate to code execution or data tampering if a usable gadget chain exists in the surrounding WordPress/WooCommerce stack. The issue is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting high impact but a high-privilege, backend-only prerequisite rather than unauthenticated exposure. There is no public exploit identified at time of analysis, and the plugin has not been confirmed as exploited in the wild; exploitation additionally requires WooCommerce to be installed and active and the plugin to remain at a vulnerable version.
PHP object injection in Page Builder by SiteOrigin (siteorigin-panels) version 2.36.0 and earlier allows an authenticated WordPress user holding high privileges - an Administrator or the Editor-level role implied by the advisory - to supply crafted, serialized content through the page-builder editor that the plugin then deserializes, yielding high confidentiality, integrity and availability impact (CVSS 3.1 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the flaw is a CWE-502 deserialization issue, weaponization into full remote code execution depends on a usable PHP POP gadget chain being present in the plugin, WordPress core, or another installed component, so the practical worst case is conditional rather than guaranteed. There is currently no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the high-privilege authentication prerequisite is the main barrier to mass abuse, not the technical difficulty - low-privilege or anonymous users cannot reach it.
Code injection in the MediaWiki CentralAuth extension (versions 1.43, 1.45 and 1.46) lets an already highly privileged operator who controls a CentralAuth configuration or system setting push attacker-influenced values into executable code paths, with the impact crossing into other federated wikis because the vulnerable component changes scope. Exploitation is not reachable by anonymous users: the assessed vector requires high privileges (PR:H), high attack complexity (AC:H), a present attack requirement (AT:P) and a passive user-interaction step (UI:P), so a victim session or request must traverse the vulnerable code path. There is no CISA KEV listing confirming active exploitation, and the vendor's CVSS 4.0 vector carries only an E:P (proof-of-concept) exploit-maturity metric; the overall picture is a real but conditions-gated, lower-urgency issue affecting multi-wiki/wiki-farm SSO deployments rather than standalone MediaWiki installs.
Authenticated low-privilege users can exploit a deserialization flaw in the MediaWiki Wikibase extension (versions 1.43, 1.45, and 1.46) to potentially execute arbitrary code, but exploitation is gated by high attack complexity, a specific precondition, and victim interaction. The vulnerability (CWE-502) allows untrusted serialized data to be processed, leading to code execution in non-executable files. A proof-of-concept exploit may exist (CVSS 4.0 E:P), but there is no confirmed active exploitation (not in CISA KEV).
Privilege escalation in the SureCart WordPress plugin through version 4.7.2 allows an authenticated user who holds the limited 'Shop Worker' store-staff role to elevate to full administrator-level control of the WordPress site. The flaw is a case of incorrect privilege assignment (CWE-266) inside a SureCart operation, and because the assessed vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, no user interaction or special conditions are needed once the Shop Worker role is held - making it a straightforward path for a malicious insider or anyone who has compromised a shop-staff credential. Anonymous or self-registering visitors cannot reach the flaw; there is no public exploit identified at time of analysis.
PHP object injection in the Themefic Ultimate Addons for Contact Form 7 WordPress plugin (versions through 3.5.51) allows an authenticated user holding the Editor role to feed crafted serialized data into a plugin code path that calls PHP's unserialize, which can lead to code execution, file operations, or data tampering if a viable POP gadget chain exists in the plugin or elsewhere on the site. The issue is network-reachable and needs no user interaction, but exploitation is access-gated by the Editor-privilege prerequisite, and no public exploit code has been identified at time of analysis; EPSS data was not provided.
PHP object injection in the WordPress plugin Content Egg through version 6.3.1 allows an attacker who holds the Shop manager role to trigger unsafe deserialization of attacker-controlled data, potentially leading to full site compromise. The vulnerability is network-reachable with low attack complexity and requires no user interaction, but the PR:H rating in the CVSS vector means a valid authenticated account at the Shop manager privilege level is a prerequisite, and meaningful code-execution impact further depends on the presence of a usable PHP POP gadget chain in Content Egg or another loaded plugin or theme. No public exploit code has been identified at time of analysis, and there is no indication that the flaw is being actively exploited in the wild.
Privilege escalation in the Vitepos WordPress point-of-sale plugin through version 3.5.0 lets an authenticated account that already holds a custom or elevated Vitepos role - such as POS staff or manager - raise its own privileges to a higher level on the affected site, rated CVSS 7.2 (High). Exploitation is remote and low-complexity with no user interaction required once such an account exists, but the high-privilege prerequisite (PR:H) means anonymous visitors and ordinary subscriber-level users cannot trigger it, and only WordPress sites with the Vitepos plugin installed and active are exposed. No public exploit code has been identified at time of analysis, and the issue is reported by Patchstack as an improper privilege assignment (CWE-266) defect in the plugin's custom role handling.
PHP object injection in the Implecode eCommerce Product Catalog plugin for WordPress (3.6.0 and earlier) allows an authenticated attacker holding a high-privilege custom role to feed crafted serialized data into PHP's unserialize(), enabling arbitrary object instantiation that can escalate to remote code execution where a usable POP gadget chain exists in loaded code. Rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), it carries full confidentiality, integrity and availability impact, but is access-gated: the high-privilege custom role requirement (PR:H) means anonymous and low-privileged users cannot reach the vulnerable path, so this is a genuine but access-gated risk rather than an internet-wide exposure. No public exploit identified at time of analysis.
PHP object injection in WP ERP 1.17.9 and earlier allows an authenticated high-privilege user to execute arbitrary code or otherwise compromise a WordPress site via deserialization of untrusted input in the plugin's custom role functionality. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting network reachability, no user interaction, and high confidentiality, integrity, and availability impact, but the flaw is gated behind a high-privilege prerequisite (PR:H). No public exploit identified at time of analysis; exploitation also requires a reachable POP gadget chain.
PHP object injection in Kadence WooCommerce Email Designer (versions up to and including 1.5.19.1) lets an authenticated account holding the WooCommerce 'Shop manager' role pass attacker-controlled serialized data into a PHP unserialize() path, potentially leading to arbitrary file manipulation, data disclosure, or remote code execution if a suitable property-oriented programming gadget chain exists in the loaded codebase. The flaw carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so it is network-reachable without user interaction but is firmly privilege-gated behind high-privilege store management access rather than anonymous exploitation. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical ceiling of impact depends on which gadget chains are present alongside the plugin.
PHP object injection in the Responsive Slider Gallery WordPress plugin (versions up to and including 1.5.5) lets an authenticated Editor-level user pass crafted serialized data into an unsafe unserialize() call, potentially triggering arbitrary object instantiation and, given a usable POP gadget chain, file manipulation or remote code execution. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) confirms network reachability and full confidentiality, integrity, and availability impact, but the high-privilege prerequisite excludes anonymous or subscriber-level attackers. No public exploit code has been identified at time of analysis and the vulnerability is not reported as actively exploited (no CISA KEV entry); the plugin's limited deployment footprint further narrows the exposed population.
PHP object injection in Cost of Goods for WooCommerce versions up to 3.5.2 allows an authenticated attacker with the WooCommerce Shop Manager role to submit crafted data that is unsafely deserialized, potentially achieving full confidentiality, integrity, and availability impact. The issue is rated CVSS 7.2 (High) and requires PR:H, so exploitation is limited to trusted staff or attackers who already control a Shop Manager account; no public exploit code or CISA KEV entry is present in the provided data. Successful exploitation further depends on a reachable POP gadget chain in the plugin, WooCommerce, WordPress core, or another installed plugin.
PHP object injection in the Minimum and Maximum Quantity for WooCommerce plugin (versions up to and including 2.1.2) lets an authenticated user holding Author-level privileges or higher feed attacker-controlled serialized data into an unsafe PHP deserialization path on WordPress sites that also run WooCommerce. Per the assessed CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2), impact is rated full across confidentiality, integrity and availability, but the high-privilege prerequisite (PR:H) excludes anonymous visitors and typical subscriber/customer accounts, and meaningful impact additionally depends on a usable PHP object-injection gadget chain being present in the plugin, WooCommerce, or WordPress core. No public exploit identified at time of analysis, and the issue is not confirmed actively exploited (not in CISA KEV).
PHP object injection in the Music Player for WooCommerce WordPress plugin (versions 1.9.1 and earlier) lets an authenticated user who holds the WooCommerce 'Shop manager' capability pass attacker-controlled serialized data into PHP's object deserialization path, which under the right conditions can lead to full compromise of the site's confidentiality, integrity, and availability. The issue requires WooCommerce to be installed and active, and the CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) is driven by the complete C/I/A impact typical of exploitable object injection but is tempered by the elevated PR:H role requirement and by the practical need for a reachable PHP gadget chain. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not listed in CISA KEV), so real-world risk is concentrated on sites where shop-manager accounts are broadly distributed or not tightly controlled.
Concurrent monitoring requests against CODESYS control runtimes are not synchronized, letting an authenticated remote client that already holds monitoring rights corrupt internal memory structures and produce incorrect data processing or a denial-of-service condition. Affected components span the CODESYS soft-PLC family - Control RTE (SL) and Control RTE (for Beckhoff CX) SL, Control Win (SL), Runtime Toolkit, Safety SIL2, HMI (SL), Development System 3, and the Control for Linux, Linux ARM, Raspberry Pi, BeagleBone, PFC100, PFC200, PLCnext, IOT2000, emPC-A/iMX6, WAGO Touch Panels 600 and Virtual Control SL variants. Network reachable with only low privileges (PR:L), no user interaction and no non-default configuration, the race yields high integrity and availability impact but no confidentiality exposure (CVSS 4.0 base 7.2; CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H); no publicly available exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available.
Stored cross-site scripting in the Post Views Stats Counter WordPress plugin (all versions up to and including 1.1.7) allows unauthenticated remote attackers to inject arbitrary JavaScript into a site by placing a payload in the User-Agent request header, which the plugin records without sanitization and later renders without escaping. The plugin's only defense is a substring blacklist for common bot signatures such as 'bot', 'spider' and 'crawler', which is trivially bypassed by omitting those strings, so any site with the plugin active and reachable is exposed with no authentication, user interaction, or non-default configuration needed for the injection step. Execution of the stored script is deferred until a user - typically an administrator loading the plugin's statistics page - views the affected page; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Stored DOM-based cross-site scripting in FPSM Lite through 1.3.4 lets unauthenticated attackers inject arbitrary scripts via the post_content parameter when the site has enabled guest post submission through the [fpsm] shortcode. The flaw is rooted in insufficient input sanitization and output escaping reaching a client-side data-label DOM sink, so the injected script executes when a victim views the affected page. No public exploit code has been identified, but exploitation is conditional on the shortcode-driven guest submission path being active; upgrading to 1.3.5 fixes the issue.
Silent capture of screen contents, webcam images, and device geolocation is possible in OpenClaw Windows Node before 2026.7.1-3 because the NodeService capture handlers performed these operations without the one-time consent gate that screen.record and camera.clip already enforced. An attacker who is, or who controls, a gateway or agent already connected to the node's WebSocket interface can invoke screen.snapshot, camera.snap, and location.get to covertly screenshot the desktop, photograph the user, and read physical location - for camera.snap and location.get without even a user-visible indicator - requiring no interaction from the victim. This is a genuine but moderate-severity privacy vulnerability affecting only pre-2026.7.1-3 builds; authentication is required in the sense that the attacker must already hold node-agent/gateway connectivity (CVSS:4.0 PR:L), and no public exploit code was identified at time of analysis.
Second-order SQL injection in Kiteworks Secure Data Forms (versions below 9.5.1) allows an authenticated, low-privilege user to influence a value derived from their stored account data that is later concatenated into a database query without sanitization, potentially exposing or manipulating data behind the application. Exploitation is condition-gated: the attacker needs a valid session, and only deployments where a specific optional feature is enabled are affected, so installs without that feature are not exploitable. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), which keeps this a mid-severity, moderate-priority issue; the vendor has released a fix in 9.5.1.
Incorrect authorization in JetBrains YouTrack before 2026.2.18991 lets a user who holds only read-only access to a project overwrite that project's notification templates, an action that should require higher project privileges. The attack is network-reachable and needs no user interaction, but it does require an authenticated account (CVSS PR:L) that already has visibility into the target project, and the effect is scoped to a single project's notification configuration. Severity is moderate (vendor score 7.1; independently assessed impact limited to integrity, with no confidentiality or availability effect), EPSS is low at 0.31% (22nd percentile), CISA SSVC rates exploitation as none and non-automatable, and no public exploit code has been identified at time of analysis. JetBrains has released a fix.
Unauthenticated cross-site scripting in the CURCY (Woo Multi Currency) plugin for WordPress, affecting all versions up to and including 2.2.16, allows remote attackers to inject and execute arbitrary script in the context of a victim's browsing session. Exploitation is network-reachable and low-complexity and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 7.1), but it does require victim user interaction - the target must click a crafted link or otherwise render attacker-controlled content - and it only affects WordPress sites where the vulnerable plugin is installed and active. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the practical exposure is therefore driven by user interaction and by how many sites still run CURCY at or below 2.2.16.
Reflected cross-site scripting in the If-So Dynamic Content Personalization plugin for WordPress (versions up to and including 1.10.1) lets unauthenticated remote attackers inject and execute arbitrary JavaScript in a victim's browser session. Exploitation is conditional on victim interaction - an administrator or site visitor must click a crafted link or load an attacker-influenced page - so there is no server-side compromise without that step; the assessed CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a moderate-severity, broadly applicable WordPress plugin risk rather than a confirmed active campaign.
Reflected cross-site scripting in the WordPress plugin Quiz And Survey Master (slug quiz-master-next) through version 11.2.6 allows unauthenticated attackers to inject script that executes in a victim's browser after the victim clicks a crafted link or submits attacker-controlled input that the plugin then reflects. The issue is scored CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and independent assessment characterizes it as a genuine but moderate-priority web vulnerability: per the assessed vector, no authentication is required but successful exploitation depends on user interaction, and impact stays within the victim's browser/site security context rather than yielding direct server compromise. Risk is elevated when the lured victim is an authenticated administrator, because the injected script then runs with that user's privileges; no public exploit identified at time of analysis, and no KEV listing or product-specific EPSS estimate was supplied.
Unauthenticated cross-site scripting in the JetEngine WordPress plugin (versions 3.8.14.3 and earlier) allows a remote attacker to have attacker-controlled script execute in a victim's browser context once that victim loads an attacker-influenced page or crafted URL. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, CVSS 7.1), no authentication is needed to deliver the payload, but exploitation requires victim interaction and the exact vulnerable feature or parameter is not disclosed in the advisory summary; impact scales with the privilege of the user who triggers it, making an administrator the highest-value target. Reported by Patchstack, this flaw has no public exploit code and no CISA KEV entry identified at time of analysis, and no EPSS signal was supplied.
Heap-based buffer overflow in RPM's package-header parsing lets a crafted, unsigned RPM overwrite memory when a victim merely inspects it with rpm2cpio, rpm2archive, or 'rpm -qlvp', giving an attacker-controlled heap write past a one-byte allocation (CWE-122, assessed CVSS 3.1 7.1). Affected code ships with RPM as distributed in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat Hardened Images, so build farms, CI pipelines, package mirrors, and malware-analysis hosts that routinely open untrusted packages are the realistic exposure surface. Exploitation is local (AV:L), low complexity (AC:L), and unauthenticated (PR:N) but requires user interaction (UI:R) to invoke an rpm tool against the malicious file; signature verification is no barrier because the overflow happens during header decoding. No public exploit identified at time of analysis.
Memory exhaustion in OpenClaw Windows Node versions before 2026.7.1 lets a connected gateway peer crash the node process by streaming an unbounded sequence of WebSocket continuation frames that never set the EndOfMessage flag, driving limitless growth of the inbound message accumulation buffer until the process dies. The vulnerability is authenticated (CVSS PR:L) because the attacker must already hold a gateway session on the node's gateway WebSocket transport rather than merely reach an exposed port, and the impact is confined to availability - a process crash with no code execution, privilege escalation, or data exposure. No public exploit code has been identified at time of analysis, and the vendor has shipped 2026.7.1, which caps accumulated inbound messages at 32M UTF-16 characters and closes offending sockets with a MessageTooBig status.
Cross-site scripting in the JetFormBuilder WordPress plugin through version 3.6.5.4 allows unauthenticated attackers to supply crafted JavaScript that executes in the browser of any user who views or interacts with the affected page or link; the reported vector (PR:N/UI:R/S:C, CWE-79) means no login is needed to deliver the payload, but a victim must still be lured into triggering it, and the scope change indicates the script runs with the authority of the host WordPress site rather than an isolated context. This is a moderate-severity web vulnerability rather than a critical, mass-exploitable one: the attacker gains no server-side code execution, only the ability to act within the victim's browser session, and there is no public exploit code and no confirmed active exploitation (CISA KEV) identified at time of analysis. The limiting factors are the mandatory user interaction and the low-impact, browser-context nature of the flaw.
Cross-site scripting in the Branda WordPress white-labeling plugin (versions up to and including 3.4.32) allows a low-privileged Subscriber-level account to plant JavaScript that then executes in the browser of a higher-privileged user, such as an administrator, who views the affected content - potentially enabling session or administrative actions in that victim's context. The flaw is tracked as CVE-2026-102376 (EUVD-2026-90222), reported by Patchstack, with a published CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); our assessment revises the privilege requirement to PR:L because the 'Subscriber' attack path assumes at least an authenticated low-privileged account, while impact remains confined to the browser JavaScript context (low confidentiality, integrity and availability). No public exploit identified at time of analysis, and there is no CISA KEV entry confirming active exploitation.