Unauthenticated Insecure Direct Object Reference (IDOR) in the REST API Log WordPress plugin through version 1.7.2 allows remote attackers to read arbitrary log entries by manipulating object identifiers, exposing potentially sensitive REST API request data. The vulnerability is network-reachable with low complexity and requires no privileges or user interaction (CVSS 3.1 7.5 HIGH), and impact is limited to confidentiality with no integrity or availability effect. No public exploit identified at time of analysis; no CISA KEV listing; EPSS risk not provided.
n8n deployments running in queue mode can have arbitrary npm packages installed across every cluster worker by an attacker who holds write access to the deployment's Redis instance, bypassing package name validation, permission checks, checksum verification, and npm safety checks in the community-package installation handler. Affected builds are n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0; vendor fixes ship in 1.123.80, 2.39.6, and 2.40.1. No public exploit code has been identified at time of analysis, and practical risk is gated by the network-position prerequisite - the attacker must already be inside the Redis trust boundary - with single-instance 'main' mode deployments unaffected.
Arbitrary PHP code execution is achievable in Pandora FMS version 777 and later by chaining a CSRF-protection bypass with an unrestricted file upload in the Plugin File Manager, allowing an attacker to place and execute a malicious PHP payload on the server. Attackers do not need credentials of their own (CVSS PR:N), but exploitation is not a fire-and-forget network attack: it requires a specific attack condition to hold (AT:P) and a logged-in Pandora FMS administrator to interact with the forged request (UI:A), meaning the victim must be socially engineered into triggering it from an authenticated console session. Successful exploitation yields full confidentiality, integrity, and availability impact on the affected instance; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated disclosure of payment gateway API credentials affects WordPress sites running the Payments for Hubtel plugin at versions before 1.0.2, because the plugin writes raw payment requests - including the store's Hubtel API keys in plain text - into a debug log that is reachable over the public web. Any remote attacker who knows the log's location can read those credentials without authentication, user interaction, or privileges (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, score 7.5), and because the path is fixed the retrieval is automatable, though CISA's SSVC assessment rates current exploitation as none and no public exploit has been identified at time of analysis; the practical prerequisite is that the site must have processed at least one payment so credentials were actually logged. Impact is confined to confidentiality (C:H with I:N/A:N) - the exposed keys could let an attacker interact with the merchant's Hubtel payment gateway - and the vendor has released a fix in 1.0.2.
Unauthenticated SQL injection in the Paytm Payment Gateway WordPress plugin (versions before 2.8.9) lets remote attackers inject arbitrary SQL through payment callback data that the plugin fails to escape before building a database query. Exploitation is conditional: the gateway must be enabled on the WordPress site without payment credentials configured, a specific deployment state in which the plugin's callback integrity/signature check can be forged, so an attacker can supply a crafted, seemingly valid callback. No authentication or user interaction is required once those conditions hold, and the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N, 7.5 HIGH) reflects high attack complexity and database-scope impact; no public exploit code has been identified and the flaw is not listed as confirmed actively exploited (CISA KEV), though the pre-2.8.9 install base and internet-facing nature of WordPress sites warrant prompt patching.
Stored cross-site scripting in the Paytm Payment Gateway WordPress plugin (all versions before 2.8.9) allows unauthenticated attackers to inject script that later executes in a store administrator's browser session. The plugin fails to sanitize or escape payment callback data before rendering it on an admin page, and the callback integrity check can be forged whenever the gateway is enabled in a credential-less configuration, which is the core non-default prerequisite; exploitation is remote and unauthenticated (PR:N) but requires low attack complexity prerequisites plus user interaction, since a store administrator must subsequently open the affected admin page (UI:R). No public exploit code was identified and there is no confirmed active exploitation (CISA KEV) at time of analysis, and a vendor patch is available. Successful exploitation yields script execution in an administrator session, which can lead to full site compromise given the high confidentiality and integrity impact.
Improper privilege management in Genian SSL PNS (the Frodo-Core and Watchcat-UI components) lets an authenticated administrator who can run CSV bulk user registration escalate to super administrator and then force the creation of an operating-system-level account by manipulating the permission column of the uploaded CSV. The issue is classified as CWE-269 and scored 7.5 by the reporting CNA under CVSS 4.0 (AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L), which shows the attack is network-reachable but requires a pre-existing high-privileged account and a non-default attack precondition (AT:P) tied to deployments that actually expose the bulk-registration import workflow. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; the vendor has published an advisory (GHSA-8mjh-295r-5hf2) covering both affected components.
TLS certificate validation is disabled by default in @graphql-tools/executor-legacy-ws prior to 1.1.35, where buildWSLegacyExecutor() hardcoded rejectUnauthorized: false, so Node.js applications using that executor directly or url-loader configured with SubscriptionProtocol.LEGACY_WS will blindly accept any certificate presented over wss://. An unauthenticated attacker who already holds a man-in-the-middle position on the network path can impersonate the GraphQL subscription endpoint, disclose authentication material carried in connectionParams or headers, and modify subscription data; the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, with the MITM prerequisite driving the High attack complexity. No public exploit code and no CISA KEV entry were identified at time of analysis, and browser WebSocket clients are unaffected because browsers independently enforce certificate validation.
Improper TLS certificate validation in the Confluent Kafka Python client's HashiCorp Vault KMS integration (confluent-kafka versions 0 through 2.14.2) allows a man-in-the-middle attacker to obtain sensitive information when the integration is used with its default configuration, which disables certificate verification. Successful exploitation requires the application to use the Vault KMS integration and the attacker to achieve a MITM position on the TLS connection to Vault, making this a conditional but significant risk (CVSS 7.4). No public exploit has been identified at the time of analysis.
Interception of unencrypted HTTP traffic between backend services in HCL BigFix Service Management lets an on-path attacker extract sensitive data and enables man-in-the-middle manipulation of that inter-service communication. Exploitation requires the attacker to already hold internal network access and an on-path position on the segment carrying that traffic; no authentication to the product and no user interaction are required once positioned, and the high attack complexity reflects the difficulty of establishing and holding that position. The vendor rates this HIGH (CVSS 3.1 7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), while our independent assessment re-scores the attack vector as adjacent (AV:A) because practical exploitation is bounded by the internal-segment requirement; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Stored cross-site scripting in Pandora FMS (version 777 and later) is reachable through a chained attack in the File Manager module: an attacker abuses missing CSRF protection on the file-upload endpoint to plant an SVG file containing embedded JavaScript, which then executes in the browser context of any user who renders it. Because the affected session cookie is accessible to script, successful rendering lets the attacker exfiltrate an authenticated administrator's session and effectively take over the admin account; the vendor rates this 7.4 (High) under CVSS 4.0 while an independent assessment scores it 7.4-equivalent under CVSS 3.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impact with no direct availability impact. The attacker needs no credentials (PR:N) but the chain requires an active administrator to be lured into triggering the forged request (UI:A) and the prerequisite condition of an unrestricted SVG upload path being present (AT:P); there is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this should be treated as a high-priority patching item rather than an emergency incident.
OS command injection in Johnson Controls EasyIO FS32 building-automation controller firmware before 3.0b63 allows an attacker who holds high-privilege credentials and can reach the device from an adjacent network segment to execute arbitrary operating-system commands, resulting in full compromise of the controller (CVSS 7.2; the vendor-assigned CVSS 4.0 vector carries an E:P exploit-maturity metric, i.e. proof-of-concept level). No confirmed active exploitation is indicated and no public exploit is identified at time of analysis - the CVE is not in CISA KEV - so the principal real-world gating factors are the PR:H authentication requirement and the AV:A adjacent-network position rather than weaponized, internet-facing exploitation. Defenders should treat the device as high-value OT infrastructure, since a compromised building-automation controller can be pivoted into the wider BAS/BMS network.
Multi-factor authentication bypass in Genian SSL PNS (Frodo-Core) lets an attacker who already holds valid first-factor credentials reach an authenticated session without completing the MFA step by manipulating a login request parameter, as the login handler fails to enforce authorization checks on that parameter (CWE-862). The vendor's CVSS 4.0 score is 7.3 (AV:N/AC:L/AT:P/PR:L/UI:N), while an independent assessment rates it CVSS 3.1 7.3 with a high attack complexity (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L), reflecting that the bypass requires a present attack-requirement condition and a working password or low-privilege account rather than being unauthenticated; no public exploit code has been identified at time of analysis, and no CISA KEV entry exists, so the practical risk is concentrated in organizations that actually operate Genian SSL PNS with MFA enforced.
Privilege escalation in JetBrains YouTrack lets an authenticated holder of an already-high-privilege (non-admin) account raise their effective permissions by abusing the user group links functionality, where a required authorization check is missing (CWE-862). All YouTrack releases before 2026.2.19422 are affected, and the issue is scored CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) with high confidentiality, integrity, and availability impact once triggered, requiring no user interaction. The PR:H prerequisite meaningfully bounds exposure - anonymous or fully unprivileged users cannot exploit it - and there is no public exploit identified at time of analysis, making this a real but gated finding rather than an urgent fire-drill.
Unauthenticated stored cross-site scripting in the Extendify plugin for WordPress (all versions up to and including 3.1.6) allows any remote attacker to plant arbitrary JavaScript into pages via the 'styles.blocks' Block Type Key, with no authentication or victim interaction required at injection time. The flaw exists because the plugin's registerIncoming() handler is bound to rest_request_before_callbacks and therefore executes before WordPress evaluates the target route's permission_callback, so a plain POST, PUT, or PATCH to a /wp/v2/global-styles endpoint reaches the vulnerable sanitization path on a default site with the REST API reachable. Impact is browser-side script execution when a victim later loads the injected page, not direct server compromise; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) for this CVE. Upgrading to version 3.2.0 removes the condition.
Stored cross-site scripting in the 10Web Form Maker WordPress plugin through version 1.15.47 lets unauthenticated attackers plant arbitrary JavaScript in a site by submitting crafted Longitude/Latitude values into a 'Mark on Map' form field. The injected script is stored and later rendered without adequate escaping, most practically firing when an administrator opens the submission or map-edit views referenced in the source (Submissions_fm.php, FMMapEditinPopup.php). Wordfence rates it CVSS 3.1 7.2 (High) with a PR:N vector, so no account is needed to inject on a site that publishes a form containing the map field; no public exploit code or confirmed active exploitation has been identified at time of analysis.
An improperly access-controlled on-chip debug interface in Johnson Controls Neo Series MVP2 controllers running firmware before 3.3b63 allows an attacker with physical or local access to extract sensitive data from common resource locations. The independent assessment rates the attack vector as physical (AV:P) with high complexity (AC:H) and no authentication required, contradicting the vendor's network-oriented CVSS 4.0 vector; no public exploit identified at time of analysis, and the real-world priority is considered lower than the 7.2 base score suggests.
Information disclosure and availability impact in Johnson Controls EasyIO FS32 building-automation controllers (firmware before 3.3b63) arise from an improperly protected on-chip debug/test interface (CWE-1191), enabling an attacker with access to that interface to collect sensitive data from common resource locations and cause high availability impact. Exploitation requires user interaction and high attack complexity, and although the CVSS 4.0 vector lists AV:N, the independent assessment notes the hardware debug-interface dependency typically implies local or physical reachability. No public exploit identified at time of analysis; upgrading to firmware 3.3b63 or later removes the exposure.
Stored cross-site scripting in HCL BigFix Service Management lets an attacker persist malicious script inside the application that executes in a victim's browser when the affected page is viewed, enabling session hijacking and theft of the data that victim can access. The CPE record (cpe:2.3:a:hcl_software:hcl_bigfix_service_management:*) does not enumerate a version range, so all deployments should be treated as potentially affected until the vendor advisory is reviewed. Impact is bounded to the victim's browser and session rather than server compromise, and exploitation depends on a victim subsequently rendering the stored payload; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Authenticated path traversal in Vvveb CMS prior to version 1.0.8.6 allows an admin-panel user with backup access (default role site_admin or higher) to read and delete arbitrary files on the server, enabling database credential theft from config/db.php, disclosure of host files such as /etc/passwd, and site takeover by deleting the database configuration to force the installer back into setup mode. The vulnerability sits in the central path sanitizer used by the backup/file functionality and is reachable only with the high privilege level reflected in its CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H); no public exploit code has been identified at time of analysis. The vendor released a patch in 1.0.8.6 that adds recursive filtering to sanitizeFileName(), so unpatched instances below that version remain exposed.
PHP object injection in the Hide Shipping Method For WooCommerce plugin (versions up to and including 1.5.4) allows an authenticated user with Editor-level or higher privileges to trigger deserialization of untrusted data on WordPress sites that also run WooCommerce, potentially leading to remote code execution, arbitrary file access, or data manipulation if a suitable gadget chain exists in the plugin, core, or other installed components. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) confirms the attack is network-reachable and requires no user interaction, but the high privilege prerequisite substantially limits exposure. No public exploit identified at time of analysis, no confirmed in-the-wild exploitation, and no fixed plugin version is listed in the available Patchstack advisory.
Server-side request forgery (SSRF) in LA-Studio Element Kit for Elementor through version 1.6.2 allows remote unauthenticated attackers to make the WordPress server issue arbitrary HTTP(S) requests to internal or external resources. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), no authentication or user interaction is required, and the scope change (S:C) with low confidentiality and integrity impact reflects that the attacker can pivot through the server to reach otherwise inaccessible services. No public exploit code or active exploitation is identified at time of analysis; risk is elevated for sites that expose cloud metadata endpoints or internal services to the WordPress host.
Blind SQL injection in the Grafana datasource endpoint of Pandora FMS 777 and later lets an authenticated console user inject arbitrary SQL through the unsanitized 'module' request parameter and read database contents. Because the endpoint does not return query results directly, exfiltration requires inference-based (boolean or time-based) techniques, and the CVSS 4.0 base score of 7.2 reflects a network-reachable, low-complexity attack with high confidentiality impact (database read) but only limited integrity and availability effects. Exploitation is gated by a valid Pandora FMS session with access to the Grafana datasource integration, so unauthenticated internet attackers cannot exploit a default login-protected deployment directly; no public exploit identified at time of analysis, and this CVE is not in CISA KEV.
Stored cross-site scripting in the Forminator Forms plugin for WordPress (all versions up to and including 1.57.2) lets unauthenticated attackers inject arbitrary JavaScript into pages through the 'postdata-1[post-custom]' input of a Post Data form field, because the plugin neither sanitizes the submitted value on input nor escapes it on output. The attack chain is fully unauthenticated: the submission nonce normally required by the plugin is freely retrievable by anyone through the publicly reachable wp_ajax_nopriv_forminator_get_nonce AJAX endpoint, so an attacker needs no account and no prior access. Impact is deferred rather than immediate - the injected script only fires when a victim subsequently views the poisoned page or form submission (for example an administrator reviewing entries, or a visitor loading a post the plugin created), and only sites exposing a published form that contains a Post Data field are reachable. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), though the assessed CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (reported base score 7.2, with the scope change and low confidentiality/integrity impact reflecting script injection into a trusted origin).
Unauthenticated stored cross-site scripting (XSS) in the WordPress plugin Business Essentials for Contact Form 7 (versions ≤1.2.1) allows remote attackers to inject arbitrary web scripts via the 'gateway' form field, which execute when a user views the injected page. Exploitation requires a non-default configuration-the plugin's Payments module must be enabled and a form must be set to accept both PayPal and Stripe as payment gateways-substantially narrowing the affected population. No public exploit code has been identified at time of analysis, and while the CVSS score is 7.2 (High), the specific prerequisites and limited browser-context impact (C:L/I:L, no availability impact) result in a low net real-world priority. A fix is available in plugin changeset 3713721 (versions after 1.2.1).
Stored DOM-based cross-site scripting in the Appointment Hour Booking - Booking Calendar WordPress plugin (all versions up to and including 1.5.97) allows unauthenticated remote attackers to inject arbitrary web scripts via a Booking Form single-line field, which execute when a victim loads the affected Schedule Calendar list page. Exploitation requires the non-default 'list_readmore_numberofwords' Other Parameters setting to be a positive integer; the default value of 0 bypasses the vulnerable decode-and-truncate branch and is not exploitable through this sink. The assessed CVSS is 7.2 with Low confidentiality and Low integrity impact, and no public exploit was identified at time of analysis; overall this is a moderate, conditional web risk rather than an urgent priority.
Stored cross-site scripting in the Forminator Forms WordPress plugin (all versions up to and including 1.57.2) allows unauthenticated attackers to plant a script payload in a form submission by abusing insufficient sanitization of a Rich-Text Textarea field. The payload is stored as entry data and only fires when a logged-in administrator opens that specific submission in the Forminator Entries view and clicks the attacker-planted link, at which point WordPress core's jQuery handler on `.contextual-help-tabs a` evaluates the entity-decoded href as HTML inside the administrator's authenticated wp-admin session. The assessed CVSS 3.1 score is 7.2 (HIGH), driven primarily by the scope change and the vendor's PR:N/UI:N vector, though the independent assessment rates user interaction as required (UI:R) because the exploit is not automatic: it demands a public form containing a rich-text textarea field, a high-privilege victim, and a deliberate click. No public exploit code has been identified at time of analysis, and the plugin is not listed in CISA KEV, so the issue is not confirmed as actively exploited.
Stored cross-site scripting in the PDF Invoices & Packing Slips for WooCommerce plugin (all versions up to and including 5.16.1) allows an unauthenticated attacker to inject arbitrary JavaScript into a WooCommerce order by way of the Billing First Name, Last Name, or Company fields, which are insufficiently sanitized on input and unescaped on output. Because guest checkout is enabled by default on most storefronts, no account or authentication is required to plant the payload; however, the injected script only executes when a privileged user later views the affected order, invoice, or plugin settings page in the WordPress admin context, so a victim must interact with the poisoned record. There is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor fix ships in version 5.16.2.
Stored cross-site scripting in the Autoptimize WordPress plugin (all versions up to and including 3.1.15.1) lets an unauthenticated attacker plant arbitrary JavaScript in the Critical CSS settings queue by supplying a malicious REQUEST_URI path that the plugin stores without sanitization and later renders without escaping. The injection path is only reachable when the non-default Critical CSS feature is active and a valid Critical CSS API key is configured, which is what allows unauthenticated frontend requests to create queue entries through ao_ccss_enqueue(); the payload then fires when a privileged user opens the affected admin queue view, giving a scope change and low-integrity/confidentiality impact rather than full site takeover. Assessment notes the effective CVSS vector as AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, requiring victim interaction (a user viewing the injected page) despite the vendor's UI:N rating, and no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Stored cross-site scripting in the AI Engine - The Chatbot, AI Framework & MCP for WordPress plugin (versions up to and including 3.8.0) lets an unauthenticated attacker plant script payloads that execute in a WordPress site's admin dashboard. The attack chains a denylist bypass on the /mwai-ui/v1/chats/submit REST endpoint into the plugin's own PHP error-log parser, which returns the forged log line as recent PHP-error content that the Advisor task then feeds verbatim into the AI prompt (CWE-1427 indirect prompt injection); the unvalidated AI response is saved to the mwai_advisor_data option and rendered by the Advisor dashboard widget without escaping. Exploitation is conditional - the Advisor task, its error-log ingestion, and the non-streaming/non-admin catch branch must all be in play, and the payload only fires when an authenticated administrator opens the dashboard and the Advisor widget renders - which is why the independent assessment scores it UI:R despite the PR:N injection path; no public exploit code has been identified at time of analysis and there is no CISA KEV listing.
Unauthenticated SPARQL injection in djehuty, the 4TU.ResearchData research data repository, before version 26.3.2 lets remote attackers manipulate the SELECT queries behind the search and listing endpoints through three separate request parameters, enabling cross-graph data exfiltration and resource-exhaustion denial of service. Because no account, credentials, or user interaction are required, any instance exposing its search/listing functionality to the network is at risk; the injected queries are read-only, so no data can be written or altered, but triples held in graphs outside the request's intended scope (drafts, private, or internal RDF data) can be pulled in via UNION-style constructs, and deliberately expensive or malformed queries can tie up the SPARQL backend and web workers. A vendor-released patch exists in 26.3.2 and has been published as advisory GHSA-7gp2-rxw9-vw6p, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote attackers can abuse the Stripe Checkout flow in Ghost CMS versions 5.2.0 through those prior to 6.62.0 to attach a paid subscription to an existing member account, change that member's stored name, and inject attacker-controlled markup into newsletters subsequently sent to that member. Depending on the recipient's email client, the injected content may render, degrading into HTML injection/content spoofing and, in clients that execute embedded script, cross-site scripting (XSS). Exploitation requires a Ghost instance with Stripe-backed paid memberships enabled and the newsletter feature in active use, plus a newsletter recipient opening the message (UI:P), so impact is conditional rather than immediate; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
NULL pointer dereference in RT-Labs AB C-Open (CANopen protocol stack, all versions before 1.1.1) lets an unauthenticated attacker who already has access to the CAN bus crash an affected device by starting the LSS (Layer Setting Services) protocol against a node whose user application defined identity object 0x1018 without all of its required subindexes. Impact is availability-only (CVSS 4.0 base 7.1; independently assessed as CVSS 3.1 AV:A/AC:L/PR:N/UI:N/A:H), meaning a device reset/denial of service rather than data disclosure or code execution, and exploitation is bounded by three prerequisites: bus-local (adjacent) access - reachable, for example, through a compromised node, not from the internet - a misconfigured, non-default identity object, and the ability to send LSS frames. No public exploit code was identified at time of analysis, and the issue is not confirmed as actively exploited (not in CISA KEV). Fixed in C-Open 1.1.1, the same release that also addresses CVE-2026-82358.
Broken access control in JetBrains YouTrack before 2026.2.19422 allows any authenticated user to add themselves to a project team, gaining unauthorized access to restricted issues. This CVE-2026-103488 has a CVSS score of 7.1 and requires a low-privileged account (PR:L); no public exploit code has been identified at time of analysis. The flaw is classified as CWE-863 (Incorrect Authorization) and affects all YouTrack versions prior to the fixed release 2026.2.19422.
Unauthenticated denial of service against Teledyne FLIR PackBot robots running the Aware2 web interface, where the reboot endpoint is exposed without any authentication control. Attackers who already hold a position on the local or adjacent network segment (CVSS AV:A) can trigger a robot reboot with no credentials (PR:N) and no user interaction (UI:N), disrupting operational availability of the platform. According to our independent assessment, this is a genuine but bounded operational-availability issue rather than a top-tier emergency: exposure is confined to field/operational networks rather than the open internet, impact is limited to denial of service with no data exposure or code execution, and no public exploit had been identified at the time of analysis (Mandiant disclosure MNDT-2026-0027; EUVD-2026-91048).
A write-protection bypass in the CANopen SDO server of RT-Labs AB C-Open (all versions before 1.1.1) allows any device on the same CAN bus to overwrite read-only Object Dictionary entries, corrupting protected configuration and process data on affected nodes. No authentication is required - the CANopen protocol has no built-in authentication (CVSS vector PR:N) - but the attacker must be able to send SDO frames to the target node's SDO server, meaning they need a presence on the same CAN segment; this adjacent-access requirement (AV:A) is the primary limiting factor. Impact is integrity-only (C:N/I:H/A:N): an attacker can point the data pointer at a read-only OD entry via an SDO upload for that entry, then send download-segment frames that the handler processes without verifying that a download session is active, overwriting the protected object in as few as two SDO frames. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis.
Cross-site scripting in the WordPress plugin Premmerce Wishlist for WooCommerce (versions up to and including 1.1.13) allows an unauthenticated remote attacker to inject script that executes in a victim's browser, with a CVSS 3.1 base score of 7.1 and a scope change (S:C) reflecting that the injected code can affect resources beyond the vulnerable plugin itself. Because the vector is PR:N, no credentials are needed to craft the payload, but the CVSS vector's UI:R means exploitation only succeeds when a victim with an active browser session is lured into opening a crafted link or supplying malicious input; the site must have the vulnerable plugin installed and the targeted page or parameter reachable. No public exploit identified at time of analysis, the plugin has not been reported in CISA KEV, and no EPSS data was supplied, so the practical risk leans moderate rather than urgent.
Unauthenticated container image tampering in oc-mirror, the mirroring utility shipped with Red Hat OpenShift Container Platform 4 and the Assisted Installer for Red Hat OpenShift Container Platform 2, lets any host on the same adjacent network segment push attacker-controlled images, delete cached images, or read mirrored content while a mirroring operation is running. The embedded local cache registry binds to all network interfaces (0.0.0.0) with neither authentication nor TLS, matching CWE-306, and carries a CVSS 3.1 score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N). No public exploit code has been identified at time of analysis, and the exposure window is transient because the vulnerable registry only exists during an active mirroring run.
Denial of service affecting TP-Link Tapo C120 v1 and C200 v5 security cameras, where a malformed HTTPS onboarding connect request that omits the password field for certain authentication and encryption parameter combinations triggers a NULL pointer dereference (CWE-476) in the request parser and crashes the HTTPS management service. The endpoint is reachable without authentication once the device has completed initial setup, but attackers must already sit on the same local network segment (CVSS 4.0 vector AV:A/PR:N, assessed equivalent CVSS 3.1 AV:A/AC:L/PR:N/UI:N with availability-only impact), so internet-facing exposure is not the default scenario. Impact is confined to temporary loss of HTTPS management functions, with sustained outages requiring repeated malformed requests and some cases necessitating a manual device reboot; no public exploit code was identified at time of analysis and no CISA KEV entry exists, and the vendor has published firmware release notes addressing the flaw.
Stored local file inclusion in GetSimple CMS CE 3.3.22 and earlier lets any authenticated account holding page-editing rights save an arbitrary filesystem path into a page's template attribute, which the public front-end then passes unsanitized to PHP include() whenever that page is requested - including by anonymous visitors. The payoff is disclosure of any readable local file and, if the included target contains PHP (a log, an uploaded file, or attacker-planted content), code execution in the web server's context. Publicly available exploit code exists and no vendor-released patch was identified at time of analysis; the main limiting factor is that the attacker must first possess a legitimate page-editing account, which keeps this a real but conditional risk rather than an unauthenticated emergency.
Denial of service in TP-Link Tapo C120 v1 and C200 v5 cameras allows an unauthenticated attacker on an adjacent network segment to overwrite the device's wireless onboarding parameters and force it to join a different network, after which the camera becomes unreachable at its management address. The root cause is a missing-authentication condition (CWE-306) in the HTTPS onboarding 'do' method connect actions that persists after initial setup, so no credentials and no user interaction are required, although exploitation is limited to attackers on the same local or wireless segment and the outcome is availability-only with no confidentiality or integrity impact. No public exploit identified at time of analysis, and a vendor firmware update addressing the issue is available per TP-Link's advisory and download pages.
Unauthenticated cross-site scripting in the bplugins 'Parallax Section' WordPress block plugin through version 2.0.4 allows remote attackers to inject script that executes in a victim's browser when the affected block renders attacker-controlled input. The flaw requires no authentication (PR:N) but does require user interaction (UI:R) - a victim must load or interact with the page containing the injected payload - and the impact is confined to the victim's browser context rather than direct server compromise, so overall risk is moderate and heavily gated by user interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the available data does not specify a fixed plugin version.
Unauthenticated cross-site scripting in the Premmerce Wishlist for WooCommerce WordPress plugin (versions 1.1.13 and earlier) allows remote attackers to inject script that executes in the target site's own origin once a victim is induced to load attacker-influenced content or click a crafted link. Because the CVSS vector is PR:N, no account on the WordPress site is required to deliver the payload, but exploitation is gated by UI:R - the script only runs after a victim interacts with the malicious page or link - and the effect is confined to client-side script execution in the browser, with no server-side code execution, file write, or database compromise demonstrated by the available data. No public exploit code or in-the-wild exploitation is identified in the supplied intelligence, and the EPSS/KEV signals are absent; the Patchstack advisory is the sole reference, so overall confidence in the details of the injectable parameter is limited even though the affected version range is explicit.
Unauthenticated cross-site scripting (XSS) in MaxGalleria versions up to and including 6.5.3 allows remote attackers to inject malicious scripts into web pages viewed by victims, potentially leading to session hijacking, credential theft, or defacement. The plugin must be installed and active on a WordPress site, and exploitation requires a victim to interact with a crafted link (UI:R), making it a high-risk (CVSS 7.1) but interaction-dependent issue. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated Ghost members on sites running versions 5.9.0 through 6.44.0 can read comments they are not authorized to view, resulting in disclosure of restricted comment content through the native comments feature. The root cause is an input validation / query-logic authorization bypass (CWE-943), reachable over the network with low complexity and no user interaction; the vendor and VulnCheck assign a CVSS 4.0 base score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N), which our assessment maps to a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, i.e. high confidentiality impact with no integrity or availability impact. Exposure is conditional on the site having membership and the native comments feature enabled and running an affected version; exploitation requires a valid low-privilege member account (PR:L), and no public exploit code has been identified at time of analysis.
Authenticated members on Ghost sites running versions 5.9.0 through 6.44.0 can delete comment likes and dislikes that belong to other users, allowing an authorization bypass that silently corrupts other members' comment engagement data. The flaw is an IDOR-style access-control failure (CWE-639) in the comment-like feature, reachable over the network with low complexity, but it requires a valid membership account and only permits integrity tampering with non-sensitive engagement counters - it does not expose data or affect availability. Vendor patch 6.44.1 is available, and no public exploit code was identified at time of analysis; the reported CVSS 4.0 score of 7.1 overstates real-world risk given the low-value target data and authenticated prerequisite.
Credential theft in n8n before 2.39.6 and 2.40.0 before 2.40.1 allows an authenticated user with credential-update permissions to modify the host field of Wekan or Baserow username-and-password credentials, causing unencrypted passwords to be sent to an attacker-controlled destination that bypasses n8n's domain validation. Exploitation requires that the tampered credential is actually used by a workflow, and the attacker must already hold a valid account or session with rights to edit credentials. No public exploit code was identified at time of analysis, and the vendor has released fixes in versions 2.39.6 and 2.40.1.
Path traversal in the n8n Supabase node allows unauthenticated remote attackers to pivot to Supabase Auth and Storage APIs when a workflow binds the tableId parameter to untrusted input, bypassing Row Level Security and enabling unauthorized data access and modification. Affects n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0; fixed in 1.123.80, 2.39.6, and 2.40.1. No public exploit identified at time of analysis. Exploitation requires the Supabase credential to use the administrative serviceRole key and a workflow with a dynamic tableId - a victim-side configuration dependency that is the primary limiting factor, consistent with the assessed attack requirement (AT:P) and high attack complexity (AC:H).
Authorization bypass in the n8n workflow automation platform lets an authenticated, low-privileged user exfiltrate project-scoped variables by supplying an arbitrary project ID to the credential test endpoint, which resolves those variables without validating that the caller may access the referenced project. The interpolated secrets are then embedded into the outbound credential test request, which the attacker directs at a host they control, turning a legitimate diagnostics feature into a data-exfiltration channel. All deployments on versions before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0 are affected, with cross-project isolation loss being most consequential in multi-project or multi-tenant instances; no public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV.
Unauthenticated filter injection in the n8n Supabase node's 'Filters (String)' mode allows attackers to manipulate PostgREST queries and read, update, or delete all records in connected Supabase tables in a single request. The flaw affects n8n versions before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0, but only when a workflow passes untrusted input to the vulnerable node. No public exploit code has been identified at time of analysis, though a vendor patch is available.