OS command injection in Foreman's foreman-rake db:dump and db:import_dump tasks lets an attacker who already holds permission to execute those rake tasks - for example through a restricted sudo delegation - append arbitrary shell commands to the destination (backup) or file (import) parameter, achieving command execution with the privileges of the rake process and scoring CVSS 8.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The bug affects Foreman as shipped in Red Hat Satellite 6.19 for RHEL 9 and the broader Red Hat Satellite 6 line, and is tracked under CVE-2026-12541. This is a genuine but access-gated privilege-escalation risk rather than a mass-exploitable remote threat: it is local-only, demands pre-existing delegated or privileged access to the rake tasks, and environments where only root invokes foreman-rake with no restricted sudo delegation are effectively not exposed; no public exploit code has been identified at time of analysis.
Command injection in the Foreman foreman-rake errors:fetch_log task shipped with Red Hat Satellite 6 allows a local user who already holds a sudo grant for that specific rake task to break out of the intended grep invocation and run arbitrary commands with the privileges of the task. The request_id parameter reaches the underlying shell command without adequate metacharacter neutralization, so an attacker can inject ';', '"', or '|' and achieve command execution on the Satellite/Foreman host. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) confirms this is a local, high-privilege-context privilege escalation rather than a remotely reachable flaw, and no public exploit code or CISA KEV entry was identified at time of analysis.
Improper neutralization of query syntax in djehuty, the 4TU.ResearchData research data repository, lets an authenticated depositor supply a crafted session name that is concatenated into a state-modifying SPARQL DELETE/INSERT query, giving them arbitrary write and delete access to triples anywhere in the RDF metadata store. Because that store is shared across every account and dataset in a normal deployment, the result is a repository-wide metadata integrity and availability compromise rather than a self-contained tenant issue (assessed CVSS 3.1 8.1, vendor CVSS 4.0 8.4). The prerequisite is a low barrier: authentication requirements confirmed from the CVSS vector as authenticated (PR:L), but djehuty permits self-registration through ORCID/SAML, so in typical deployments almost anyone can obtain the account needed; no public exploit identified at time of analysis and vendor-released patch: 26.3.2.
Out-of-bounds write in PeaZip's PEA archive extractor allows an attacker to execute arbitrary code with the privileges of the user who opens or extracts a crafted .pea file in PeaZip 11.2.0 and earlier, on Windows, Linux, macOS and BSD. The defect is in the first PCOMPRESS1 block: an attacker-controlled 32-bit compsize value is taken straight from the archive and used as both the blockread length and the copy-loop bound into fixed 1,114,112-byte global buffers, with no archive password, integrity tag or non-default configuration required. Exploitation is local and requires the victim to open or extract the archive (CVSS 3.1 AV:L/AC:L/PR:N/UI:R, C:H/I:H/A:H; CVSS 4.0 base 8.4), and no public exploit was identified at time of analysis, although the reporting researchers demonstrated code execution against the official Linux x86-64 and Windows x64 builds.
Stored cross-site scripting in Pandora FMS (version 777 and later) lets an authenticated, highly privileged user inject persistent JavaScript through the File Manager's 'Create Directory' function, which then executes automatically when the crafted directory name is rendered in a listing or browser context. The flaw stems from missing input validation of the directory-name parameter combined with absent output encoding, so the payload is stored server-side rather than reflected (CWE-79). Exploitation requires an account with access to Pandora FMS's administrative File Manager area - the assessed severity is driven by privileged access (PR:H) rather than remote anonymity - and no public exploit code has been identified at time of analysis; the vendor's own CVSS 4.0 score of 8.4 reflects high confidentiality and integrity impact within the component's security scope.
OS command injection in Genian SSL PNS (Xenics Auther) lets a remote attacker execute arbitrary operating-system commands on the host, with the only documented prerequisite being knowledge of a valid client access ID rather than the matching password. The flaw is tracked as CVE-2026-76146 (CWE-78) and carries a CVSS 4.0 base score of 8.4, where the AT:P attack-requirement metric encodes that access-ID precondition while PR:N/UI:N confirm no credentials and no user interaction are needed. Public reporting so far is limited to the vendor's own security-research advisory (GHSA-2597-v98f-frhj) issued via KR-CERT, there is no CISA KEV entry, and no public exploit code has been identified at time of analysis, so this is a genuine high-impact exposure without confirmed active exploitation.
n8n automation instances running versions before 2.39.6 or 2.40.0 before 2.40.1 permit an authenticated attacker with low privileges to decrypt and exfiltrate stored plaintext credentials by referencing arbitrary credential IDs during inline AI agent node-tool introspection, which fails to verify credential ownership (CWE-639). Successful exploitation yields high confidentiality impact with a scope change (CVSS 3.1 base 8.3, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); the attacker must hold a valid account able to build or edit workflows, know or enumerate internal credential IDs, and operate an attacker-controlled host to receive the secrets. No public exploit identified at time of analysis, and vendor patches are available as 2.39.6 and 2.40.1.
Information disclosure in Johnson Controls Easy IO Neo versions before 3.3b63 allows an authenticated high-privileged attacker to read sensitive data from predictable common resource locations, but requires passive user interaction and yields low confidentiality impact per the independent assessment. This medium-severity flaw (CVSS 4.0 base 6.3, CWE-200) has no public exploit identified at time of analysis. Exploitation depends on the attacker already holding high-privilege access to the controller and on a victim performing passive user interaction, substantially limiting opportunistic exploitation.
Credential disclosure in Eclipse BaSyx AAS Web UI (v2-241220 through releases before v2-260924) lets an attacker harvest a victim's infrastructure credentials - Basic Authentication, Bearer token, or OAuth2 access token - by inducing an authenticated user to open a crafted Web UI link whose `aas` or `path` query parameter resolves to an attacker-controlled origin, causing the shared request handler to attach the Authorization header to that cross-origin request. The stolen credential is valid against the victim's protected AAS services, so the attacker can reuse it with the victim's privileges to read or modify the same Asset Administration Shell data. Exploitation requires a deployment configured with authentication plus user interaction (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), no attacker account or privileges are needed, and the flaw is fixed in v2-260924; no public exploit code has been identified at time of analysis and there is no CISA KEV entry.
Server-side request forgery in Budibase through 3.41.0 allows an authenticated builder-level user to make the server fetch arbitrary internal URLs and read the response back through the AI table generation endpoint (POST /api/ai/tables). The uploadUrl helper in packages/server/src/utilities/fileUtils.ts calls raw node-fetch instead of the project's fetchWithBlacklist wrapper, so a crafted prompt that places an internal address (for example the cloud metadata endpoint at 169.254.169.254) into an attachment column causes the server to retrieve that URL and surface the fetched content via a presigned object-storage URL - potentially exposing cloud instance credentials. Exploitation requires a valid builder account and that the AI table generation feature be reachable; no public exploit code or confirmed active exploitation was identified at time of analysis, and the highest-impact outcome (credential theft) depends on the Budibase host running in a cloud environment with an exposed metadata service and configured object storage.
Unbounded CPU and memory consumption in figlet.js versions prior to 1.11.3 allows remote, unauthenticated attackers to exhaust server resources by driving text() or textSync() into a non-terminating loop. Exploitation requires two conditions in the consuming application: the non-default whitespaceBreak option must be enabled, and the attacker must control or influence the width parameter and set it narrower than the rendered width of a single FIGlet character - the root cause is CWE-835, where breakWord() cannot find a valid break point, returns without consuming any character, and generateFigTextLines() reprocesses the same input indefinitely. Impact is availability-only (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 base 8.2 with VA:H and VC/VI:N), with no code execution, file access, or data exposure; exploitability is limited because whitespaceBreak is off by default and width is often hardcoded server-side. No public exploit code has been identified at time of analysis, and there is no evidence of active exploitation (no CISA KEV listing).
Denial of service in Mooncake Transfer Engine through 0.3.13.post1 allows unauthenticated remote attackers to permanently stall the P2P handshake daemon by sending a Metadata request to the handshake RPC port and then never reading the server's reply, which blocks the single listener thread inside writeFully(). This prevents all subsequent handshakes, metadata fetches, notify, and probe operations, causing an availability loss only (no code execution or data compromise). No public exploit identified at time of analysis; exploitation requires network reachability to the exposed handshake RPC port, and deployments that bind it to a trusted internal network or loopback are not remotely exploitable. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) and independent assessment agree the stall depends on hitting the blocking-write state, so it is a genuine but not automatic denial of service.
PictShare versions before 3.7.1 generate the per-file delete_code authorization token using PHP's non-cryptographic rand() PRNG, allowing an attacker who knows a hosted file's hash to predict or infer valid delete codes and delete other users' uploads without authorization. The vulnerability is remotely reachable and requires no authentication or user interaction (CVSS:4.0 AV:N/PR:N/UI:N), but exploitation is constrained by HIGH attack complexity (AC:H) because the attacker must reconstruct the PRNG state; the resulting impact is availability-only (VA:H) and grants no data disclosure. No public exploit code was identified at time of analysis and there is no CISA KEV listing; vendor-released patch: 3.7.1.
Authenticated WordPress users with only Subscriber-level access can recursively delete arbitrary files and directories - up to and including the entire WordPress installation - on any site running the Super Forms - Drag & Drop Form Builder plugin version 6.3.316 or earlier. Because the super_save_form AJAX handler performs no capability check, a low-privileged attacker can first enable the file_upload_submission_delete setting for the form and then pass an unsanitized subdir value through super_submit_form into SUPER_Common::delete_dir(), with a trivially bypassed ABSPATH guard allowing deletion of wp-config.php and other critical files at the site root. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); however, the low privilege bar (sites with open registration are effectively exposed to anyone) and the destructive, site-wide impact make this a genuinely high-priority vulnerability rather than a CVSS-inflated paper risk.
Unauthenticated remote denial of service in Apache APISIX 1.3.0 through 3.18.0 allows an attacker to exhaust gateway worker memory and trigger an out-of-memory condition by sending requests to a publicly exposed batch endpoint while the batch-requests plugin is enabled on a route. Exploitation requires that specific deployment condition-routes without the plugin or with the batch endpoint restricted are not affected-and the impact is limited to availability with no loss of confidentiality or integrity. No public exploit code or active exploitation has been identified at time of analysis, and upgrading to 3.19.0 remediates the flaw.
Unauthenticated local file disclosure in Tornado before 6.5.9 lets remote attackers read files outside a configured static root by requesting a symbolic link that lives inside that root but resolves elsewhere, exposing configuration files, private keys, and application secrets readable by the Tornado process user. Exploitation is a single GET request requiring no authentication and no user interaction (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), but it depends on a precondition rather than being turnkey: an out-of-root symlink must already exist inside the static directory, a situation the upstream advisory says arises in applications serving user-uploadable content or where build/deploy pipelines (npm link, webpack, Docker volume mounts, CDN sync tools) create symlinks. The issue is fixed in 6.5.9, public reproduction steps are published in the upstream GitHub Security Advisory, and there is no CISA KEV listing.
Processing a crafted TNEF file with uncompressed RTF data through tnef can trigger an out-of-bounds read in get_rtf_data_from_buf(), causing a crash (denial of service) or opportunistic leakage of adjacent memory into extracted output. The affected product is the tnef Project’s tnef utility, matched by CPE cpe:2.3:a:tnef_project:tnef:*:*:*:*:*:*:*:*, with no version restriction in that CPE and no fixed version provided. Exploitation requires user interaction or an automated mail/attachment-extraction pipeline that feeds untrusted winmail.dat files to tnef; no public exploit has been identified at time of analysis, EPSS is low at 0.21% (9th percentile), and SSVC records exploitation as none, so this is a moderate rather than urgent priority consistent with the independent assessment.
Heap-based buffer overflow in Fortra Core Privileged Access Manager (BoKS) allows remote attackers to corrupt heap memory when the product builds a human-readable failure reason for a revoked key, because the heap buffer allocated for that message is too small for the final sprintf() output. Per the vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) the flaw is network-reachable and does not require authentication, but it does require user interaction and the revoked-key error path must actually be entered with a failure string long enough to overrun the allocation; our independent assessment keeps the same confidentiality and integrity impact while raising attack complexity and adding availability impact. No public exploit code has been identified at time of analysis, and no confirmed active exploitation is known.
Path traversal in the n8n node of the n8n workflow automation platform lets an attacker supply a crafted resource identifier that redirects the node's authenticated API calls to unintended resources, exposing workflows, execution data, and stored credential secrets that fall inside the scope of the API key in use. Affected deployments are n8n before 1.123.80, 2.0.0 through 2.39.6, and 2.40.0 through 2.40.1; patched builds (1.123.80, 2.39.6, 2.40.1) remove the exposure. The CVSS 4.0 vector scores it 8.1 (AV:N/AC:L/AT:P/PR:N/UI:N with high confidentiality and integrity impact and low availability impact), and because exploitation presupposes an n8n node configured with an n8n API key credential (AT:P), impact is bounded by that key's authorization scope; no confirmed active exploitation (CISA KEV) was identified, though the vector's E:P metric indicates proof-of-concept-level exploit maturity and the EPSS-style risk picture is driven by the high confidentiality/integrity weighting.
Stored XSS in JetBrains YouTrack before 2026.2.19422 allows an authenticated user with content-creation rights to inject malicious Mermaid or LaTeX markup that executes in the browser of any user who views the affected issue, comment, or similar content. The vendor CVSS is 8.1, but the independent assessment lowers this to CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, reflecting required authentication (unless anonymous/guest issue reporting is enabled), victim interaction, and low confidentiality/integrity impact; signals lean toward moderate real-world priority. No public exploit code or CISA KEV active exploitation was identified at time of analysis.
Cross-site request forgery in the Memberful - Membership Plugin for WordPress (memberful-wp, all versions through 1.81.0) allows an attacker to lure a logged-in privileged user to an attacker-controlled page or crafted link and cause that user's browser to submit forged requests to a vulnerable Memberful endpoint, potentially changing membership or account state that the victim is authorized to modify. The attacker needs no authentication to the target site, but success depends entirely on the victim holding an active privileged session (a WordPress administrator or a logged-in member with Memberful management rights) and on the victim's own browser action, so exploitation cannot occur against a logged-out user and impact is bounded to state changes the victim could legitimately perform. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; Patchstack reports this at CVSS 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), while independent assessment rates it lower as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N given the mandatory user interaction and session prerequisites.
OS command injection in the Foreman foreman-tail helper utility shipped with Red Hat Satellite 6.19 for RHEL 9 allows a local, authenticated user to execute arbitrary system commands with the privileges of whoever runs the tool, because unsanitized arguments are fed into an eval-based path-expansion string and shell metacharacters such as ;, & and | are interpreted as commands. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is strictly local-scope, so it only matters where a lower-privileged account on a Satellite/Foreman host can reach the utility and thereby escalate its privileges. There is no network-facing attack path, no public exploit code has been identified at time of analysis, and EPSS is low (0.55%, 44th percentile), though Red Hat has issued patched packages (for example 0:3.18.0.14-1.el9sat for Satellite 6.19 on RHEL 9) via several RHSA advisories.
Command injection in the TDDPv2 service (/usr/bin/tddp) on TP-Link Archer AX90 V1 routers allows an unauthenticated attacker who is already positioned on the same adjacent network layer - wired LAN, Wi-Fi, or guest network - to inject operating system commands through the setProductVer command handler, which then run as root. The injected payload is executed during device boot, so the attacker must wait for or induce a reboot, and the device is not exploitable over the internet; a fixed firmware release is available from the vendor. Analysis found no public exploit code (no public exploit identified at time of analysis) and the issue is not in CISA KEV, so this is assessed as a credible but above-average-priority fleet risk rather than an internet-wide emergency.
Fortra BoKS Manager's bccgethostcert utility writes predictably named temporary files under the BOKS_tmp directory without first setting a restrictive umask, so a local, authenticated low-privileged user on a BoKS Master host can capture CA secret or host private-key material - either by reading the files during the window in which a privileged operator runs the utility, or by recovering CA secret material left behind after a successful certificate creation. The issue is scored 7.9 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, CWE-377), and its confidentiality and integrity impact is high precisely because the leaked material is CA-level keying material rather than ordinary application data. Exploitation is access-gated rather than remote: it requires a Master-local account, read access to files under BOKS_tmp, and the utility actually being invoked by a privileged user. No public exploit code has been identified at time of analysis, and KEV/EPSS signals were not provided in the source data.
Privileged local attackers who can control Foreman configuration data can chain server-side template injection with insecure deserialization through the foreman-rake initialization logic in /usr/share/foreman/config/settings.rb to execute arbitrary code on Red Hat Satellite 6.19 for RHEL 9 hosts, resulting in full host compromise and downstream supply chain risk. The assessed CVSS 3.1 vector (7.7, AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) confirms the attack is local and authenticated with high privileges plus a user-interaction component, so it is not remotely or unauthenticated reachable against a default deployment and real exposure is largely confined to compromised or malicious privileged operators. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; Red Hat has published errata RHSA-2026:74503 addressing it.
Stack-based buffer overflow in the TDDPv2 service (/usr/bin/tddp) on TP-Link Deco M9 Plus v2 mesh units lets a network-adjacent, unauthenticated attacker crash the device or potentially execute arbitrary code, but only while the unit is in its setup/provisioning phase. A crafted TDDP request whose decrypted payload is longer than the fixed-size stack buffer used by the subtype 0x91 handler (CWE-121) triggers the overflow with no user interaction. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; TP-Link has published fixed firmware. The risk is genuine but conditionally gated: the attacker must already sit on the same Wi-Fi/link-local segment during onboarding, which substantially narrows realistic exposure.
Terminal escape-sequence injection in colmux, the multi-host aggregation front-end shipped with collectl before 4.3.20.2, lets an attacker who already holds an unprivileged local account on a monitored host embed crafted ANSI/VT100 control sequences - delivered via a fake process name (argv[0]) in the host's collected process data - into the terminal of an operator running colmux and viewing that host. Because colmux renders remote data without neutralizing escape, meta, or control characters (CWE-150), the injected sequences can rewrite displayed output or invoke terminal-emulator features, giving high integrity and confidentiality impact on the operator's session (CVSS 3.1 7.7, AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N). Exploitation is constrained by stacked prerequisites: attacker foothold on a monitored node, an operator actively viewing that host in colmux, and a terminal emulator that still honors the more dangerous escape sequences, which many modern emulators disable by default; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV.
Server-side request forgery in Vvveb CMS builds prior to 1.0.8.6 allows an authenticated admin-panel user (default role site_admin or higher) to make the editor's oEmbed proxy fetch attacker-chosen URLs server-side and read the reflected response body, exposing internal-only HTTP services and cloud metadata endpoints including IAM credentials. The bypass works because Vvveb's SSRF guard resolves hosts with an IPv4-only function, so a bare IPv6 literal or a domain publishing only an AAAA record never matches the private-range check, while hosts with an A record remain blocked. Exploitation is access-gated by the PR:H requirement and by whether the deployment actually exposes reachable internal services or a metadata endpoint; no public exploit identified at time of analysis. The issue is patched in 1.0.8.6.
Path traversal in PowerPoint MCP Server through version 2.0.7 allows unauthenticated attackers who can steer an AI agent via prompt injection to read and write files outside the working directory. The attack abuses unsanitized file path parameters in save_presentation, open_presentation, and manage_image's output_path, enabling overwrite of any server-writable file or loading of external files; impact is bounded by the OS privileges of the MCP server process. No public exploit identified at time of analysis, but an upstream fix (PR #33) is available; exploitation requires successful prompt injection and the agent invoking the affected tool.
Session invalidation bypass in Ghost 3.10.0 up to but not including 6.34.0 allows an attacker who already possesses a stolen session cookie to retain authenticated access after the legitimate user changes their password. The flaw is CWE-613 (insufficient session expiration); the assessed vector requires a pre-existing session (PR:L, AT:P, AC:H) and leads to high confidentiality and integrity impact once that prerequisite is met. No public exploit identified at time of analysis and no CISA KEV entry was provided, while the vendor has released a patch in Ghost 6.34.0 and later.
Memory-exhaustion denial of service in FasterXML jackson-dataformats-binary affects the Smile binary parser on 2.16.0-and-later releases, where SmileParser buffers an entire JSON object property name in memory through an unconstrained _growArrayTo() call inside _handleLongFieldName() and never calls StreamReadConstraints.validateNameLength(), so the configured maxNameLength is silently ignored for this format. Any remote, unauthenticated attacker whose bytes reach SmileFactory parsing - directly or through an ObjectMapper configured with the Smile module - can embed a single unbounded property name and force heap exhaustion, because maxDocumentLength is also disabled by default (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact), leaving upload capacity and available heap as the only practical limits. No public exploit identified at time of analysis, and applications that parse only standard JSON are unaffected since jackson-core's JSON parsers enforce maxNameLength incrementally during name decoding.
Memory-exhaustion denial of service in the FasterXML jackson-dataformats-binary CBOR parser allows an unauthenticated remote attacker to force unbounded heap allocation by submitting a CBOR document containing a single property name of arbitrary length; the parser buffers the entire name in memory before returning it because maxNameLength is never validated for this binary format. The defect affects jackson-dataformats-binary running against jackson-core 2.16.0 or later (releases before 2.16.0 never contained the constraint that is left unenforced), and is reachable under default configuration because StreamReadConstraints.maxDocumentLength is disabled by default, leaving no built-in bound on the name. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) there is no confidentiality or integrity impact, and the practical damage ceiling is set by the attacker's upload capacity versus the victim's available heap; no public exploit code was identified at time of analysis, and exploitation requires only that attacker-controlled bytes actually reach CBORFactory or an ObjectMapper configured with the CBOR module.
Stack-based buffer overflow in the mod_vhost_alias module of Apache HTTP Server through 2.4.68 allows a remote, unauthenticated client to crash the server or potentially execute arbitrary code by sending an HTTP request whose Host header exceeds 8192 bytes. The flaw is not reachable in default deployments: the operator must have configured VirtualDocumentRoot (or VirtualScriptAlias) with a hostname format specifier such as %0 or %1 and must have raised LimitRequestFieldSize above its 8192-byte default, a non-default and uncommon combination that is reflected in the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No KEV listing, EPSS score, or public exploit code was available at time of analysis, so there is no public exploit identified at time of analysis; the dominant uncertainty is the absence of any quantitative exploitation signal, while the real-world exploitability is sharply constrained by the required operator-set configuration. Users are advised to upgrade to 2.4.69, which fixes the issue.
Missing authorization checks in the Gratisfaction WordPress plugin (versions up to and including 4.6.3) allow authenticated Subscriber-level attackers to bypass access controls, potentially leading to high confidentiality impact and limited integrity/availability impact. The flaw is network-reachable with low complexity (CVSS 7.6 HIGH, PR:L) and requires only a low-privileged account, which may be obtainable via open registration on sites using the plugin. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Social Boost WordPress plugin through version 3.6.2 allows an authenticated subscriber-level user to reach plugin functionality that should be reserved for higher-privileged roles, resulting in unauthorized data exposure and limited modification of site content or configuration. The flaw is a classic missing-authorization issue (CWE-862) reachable over the network with no user interaction, so sites that allow open or self-service registration are the most exposed: any visitor who can obtain a subscriber account meets the only real prerequisite. Independent assessment rates the impact as comparatively contained (confidentiality and integrity low, availability none) and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; a vendor advisory from Patchstack is available.
Blind SQL injection in the Ultimate Member WordPress plugin (versions through 2.13.1) lets an authenticated high-privilege account - an administrator or an equivalently trusted Ultimate Member role - inject SQL into plugin-supplied input and read database contents one inference at a time. The flaw is network-reachable with low attack complexity and no user interaction, but the CVSS vector (PR:H) means it is realistically an insider-abuse or post-account-compromise scenario rather than an unauthenticated remote attack. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; confidentiality impact is high, while integrity and availability impact are limited to none/low.
Blind SQL injection in the WordPress plugin Captivate Sync (all versions through 3.3.2) allows an authenticated administrator-level user to inject crafted SQL into a plugin parameter and extract database contents through boolean- or time-based inference. The vendor-published score is 7.6, but our independent assessment rates the true impact lower: exploitation requires a high-privilege (PR:H) WordPress account, the injection is blind so no direct query output is returned, and the demonstrated consequence is read-only disclosure of backend data rather than data modification or code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this should be triaged as a moderate-priority, access-gated issue despite the headline CVSS number. It is most relevant to multi-author or managed WordPress installations where untrusted or over-privileged accounts hold administrator rights.
Second-factor authentication bypass in MISP versions before 2.5.48 lets an attacker who already holds a session past the password step and a copy of the HOTP paper-token list replay a previously consumed HOTP token, because the OTP check compared the submitted token against a counter cached in the user's session rather than the authoritative database counter; the stale cached value still matches the burned token, yielding a second successful login and rewinding the counter state. Exploitation is not anonymous: it requires an authenticated session (PR:L per the assessed vector, implying prior password compromise), HOTP paper-token 2FA explicitly enabled on the target account, and knowledge of at least one valid token value, per the assessed CVSS:3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (vendor CVSS 4.0 score 7.6, High). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in MISP 2.5.48 by commit f34aee2c7.
Unauthenticated attackers can harvest customer PII (names, email addresses, phone numbers, custom form field data) and per-appointment public_token values from any WordPress site running the Simply Schedule Appointments plugin through version 1.6.12.32 by supplying a crafted 'recursive' parameter to the plugin's appointment REST endpoints. Because the leaked public_token is the sole authorization credential for DELETE /wp-json/ssa/v1/appointments/{id}, the same flaw lets those attackers destroy arbitrary appointment records, which is why the assessed impact includes a low integrity component (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N; 7.5 base). No authentication, user interaction, or non-default configuration is required, and no public exploit code or confirmed active exploitation was identified at time of analysis - nevertheless this should be treated as a high-priority issue because it combines bulk PII disclosure with a trivial destructive follow-on against default installs.
Perl's Imager image-manipulation module before version 1.037 exits the process when it reads a RAW-format image containing an out-of-range raw_datachannels value, because the line-buffer size is computed as image width multiplied by the channel count with no range or overflow validation and the module's allocator calls exit(3) when the resulting allocation fails. The flaw is reachable only where an application uses Imager->read() on RAW data and permits the raw_datachannels parameter to come from untrusted input; a hard-coded or non-exposed value makes it unreachable. Impact is limited to denial of service - process termination with no confidentiality or integrity effect - and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; CISA's SSVC assessment rates exploitation as none, with the defect automatable but technically partial.
Unauthenticated attackers can read and download course-material files - including uploaded file paths and external URLs - belonging to lessons in paid or enrollment-required LearnPress courses by exploiting an insecure direct object reference in the plugin's CourseMaterialTemplate::render_material_items() handler (CVE-2026-93882, CVSS 7.5, AV:N/AC:L/PR:N/UI:N). The handler validates authorization against one attacker-supplied identifier (course_id) but fetches material rows using a second, independently attacker-supplied identifier (item_id), with no check that the lesson actually belongs to the authorized course; the call is reachable through the public lp-ajax-handle (load_content_via_ajax) action, which sits on the AbstractAjax no-nonce allowlist and performs no capability check. Exploitation is conditional: at least one course on the target site must have 'No Required Enroll' enabled and own at least one material file, so that a valid course_id exists to satisfy the authorization branch while item_id is pointed at a restricted lesson. Impact is read-only confidentiality loss; no public exploit identified at time of analysis.
The Comelit Multi-User Gateway for the VIP System (model 1456B) running firmware 2.9.1 or 2.10.0 exposes a network-reachable management interface that performs no authentication, allowing a remote attacker to read sensitive device configuration in cleartext - including the Remote Configuration Password. With CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N), the exposure is fully remote, low-complexity and requires no credentials or user interaction; the only practical preconditions are network reachability to the interface and the device running an affected firmware build. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided, so no exploitation-probability estimate is available.
Unauthenticated remote attackers can pull the kickstart provisioning template from Red Hat Satellite 6's /unattended/provision endpoint without supplying any token, provided a host is currently mid-provisioning and therefore has an unexpired token recorded in the Satellite database. The flaw is a semantic logic error in Foreman's host_verifier.rb: valid_host_token? validates database state rather than the token presented in the HTTP request, so the check passes even when the request carries no token. Rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), the exposure is gated by the provisioning window and yields information disclosure of the rendered template, not code execution; no public exploit code or active exploitation has been identified at time of analysis.
Denial of service in 389-ds-base (the LDAP engine shipped with Red Hat Directory Server 11/12/13 and Red Hat Enterprise Linux 6 through 10) lets an unauthenticated remote attacker stall the server's worker-thread pool by sending a complete LDAP operation followed by the opening bytes of an incomplete LDAPMessage on the same connection. The server then hands the connection to a second worker thread before the first worker's result is flushed; the second worker blocks on the connection mutex until nsslapd-ioblocktimeout, so the finished operation's response is never delivered. Repeating this over a handful of connections proportional to the configured worker-thread count exhausts the entire pool under default configuration, denying LDAP service to anonymous and authenticated clients over both plaintext and TLS for as long as the attacker holds the connections; no public exploit code has been identified at time of analysis, and no EPSS or KEV signal accompanies the CVE, though the availability-only impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is genuine for any internet- or broad-network-reachable directory server.
An out-of-bounds write in Apache HTTP Server 2.4.0 through 2.4.68 on Windows can corrupt memory when the server processes request paths containing MS-DOS 8.3 short filenames that expand to longer names, giving a remote attacker a route to service disruption (assessed availability impact High) with limited confidentiality and integrity impact. Exploitation is Windows-only and conditional: 8.3 short-name generation must be enabled on the underlying NTFS volume (the historical default unless NtfsDisable8dot3NameCreation has been set) and the crafted path must actually reach the expanding-path code path, which is reflected in the assessed vector's AC:H. Apache published no CVSS score, and the supplied intelligence contains no CISA KEV listing, no public exploit code, and no EPSS probability, so there is no public exploit identified at time of analysis.
Apache HTTP Server 2.4.0 through 2.4.68 can be crashed by a remote unauthenticated attacker via a NULL pointer dereference in the mod_heartmonitor module when it is configured with a unicast listener. The module is non-default, limiting exposure to specific deployments; no public exploit code or active exploitation has been identified, though the attack is automatable per CISA SSVC. The impact is limited to denial of service (availability), with no confidentiality or integrity loss.
Apache HTTP Server 2.4.0 through 2.4.68 can leak a client's session cookie to an upstream backend server through the mod_session_cookie module when the effective value of the SessionCookieRemove directive changes as a request passes through an internal redirect (for example via mod_rewrite or mod_proxy rewrites). The exposure is unauthenticated from the network perspective (PR:N in both the NVD vector and our independent vector), but it is strictly conditional: it requires httpd to be deployed as a proxy/front end in front of a backend, mod_session_cookie to be loaded, SessionCookieRemove to be configured, and that configuration to differ between the pre- and post-redirect contexts - our assessment therefore rates it AC:H with C:L rather than the NVD's AC:L/C:H, since the consequence is a trust-boundary leak of the cookie to the backend rather than direct confidentiality loss to an external attacker. CISA SSVC records Exploitation: none, and no public exploit code has been identified at time of analysis, so this is a genuine-but-conditional hardening issue rather than an urgent, actively exploited priority.
Missing authorization in the WP Full Stripe Free WordPress plugin (versions 8.5.6 and earlier) lets remote attackers perform privileged state-changing actions without logging in, because the plugin fails to verify that a request comes from an authorized user. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (7.5 HIGH), meaning the flaw is network-reachable and exploitable without authentication, privileges, or user interaction, and its impact is limited to integrity - an attacker can alter data or configuration but, per the vector, cannot read data or cause denial of service. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; risk is tempered mainly by the plugin's niche deployment footprint and the integrity-only impact.
Absolute path traversal in langflow-ai Langflow through v1.8.4 lets a remote attacker write or overwrite files anywhere the Langflow process can reach by supplying an attacker-controlled absolute path or filename to the knowledge-base creation endpoint (HTTP POST /api/v1/knowledge_bases, handler at src/backend/base/langflow/api/v1/knowledge_bases.py:51), which forwards that input into host file creation without enforcing a workspace or storage boundary. The CVSS 3.1 vector (7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) rates it unauthenticated with high integrity impact, although the independent assessment notes that installations enforcing API login make a valid session the practical prerequisite and that the blast radius is capped by the OS privileges of the Langflow service account. Exploitation pressure is currently low per EPSS (0.23%, 13th percentile), and no public exploit has been identified at time of analysis.
Path traversal in Devika v1.0's Patcher Agent allows remote attackers to write files outside the intended project workspace by supplying paths containing ../ traversal sequences to the save_code_to_project routine. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (7.5), indicating high integrity impact with no confidentiality or availability effect, and publicly available exploit code exists (SSVC Exploitation: poc) - but there is no CISA KEV entry confirming active exploitation. EPSS is very low at 0.15% (4th percentile), and real-world urgency is bounded by deployment reality: Devika is typically self-hosted by an individual developer, so the practical risk depends on whether the instance is network-reachable and whether its agent actually processes attacker-influenceable tasks or repository content.