Unauthenticated spacecraft command injection and telemetry exfiltration in NASA-AMMOS AIT-Core through 3.1.1: the ait-server ZeroMQ telemetry and command broker binds its XSUB (TCP 5559) and XPUB (TCP 5560) sockets to all network interfaces by default with no authentication or transport security, so any unauthenticated remote attacker with a network path to the ground bus can publish onto internal topics including __commands__, push forged commands through command_stream onto the command-uplink UDP path, subscribe to live command and telemetry traffic, or disrupt the bus outright. The assessed CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting unauthenticated, low-complexity remote exploitation that fully compromises confidentiality, integrity, and availability of the command and telemetry path; no public exploit code has been identified at time of analysis, and this CVE is not in CISA KEV. The exposure is conditional on the shipped default configuration - exploitation requires network reachability to ports 5559 and/or 5560, which is typically an isolated or segmented mission network rather than the public internet - and the fix is AIT-Core 3.1.2, which rebinds these ZeroMQ sockets to loopback by default.
Authenticated low-privileged users of ConvertX before 0.19.0 can execute arbitrary Python code on the server by submitting a crafted Calibre recipe file to the conversion workflow. The flaw resides in converters/calibre.ts, which passes .recipe and .downloaded_recipe files to Calibre's ebook-convert without blocking executable recipe code (CWE-829), leading to high confidentiality, integrity, and availability impact; severity depends on the account running the conversion (root before 0.19.0, reducible with the new PUID/PGID setting). No public exploit was identified at time of analysis, and the vendor has released a fix in v0.19.0 as documented in advisory GHSA-m4hh-rqmf-c8hw.
Unauthenticated arbitrary file deletion in the VikAppointments Services Booking Calendar WordPress plugin (all versions up to and including 1.2.21) lets a remote attacker specify a server file path that the plugin will remove without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, 9.1), which can escalate to full site takeover when a critical file such as wp-config.php is deleted. Exploitation is conditional: the site must have published at least one File-type custom field on the confirmation-page shortcode, a configuration that is not created by default during plugin installation, so stock deployments are not directly reachable. No public exploit code was identified and the issue is not listed in CISA KEV at time of analysis, but the low complexity and unauthenticated reachability make prompt patching important on any site that uses custom File-type booking fields. Reported by Wordfence via the CVE program.
Bouncy Castle for Java's Messaging Layer Security (MLS, RFC 9420) implementation before 1.86 fails to bind an X.509 credential to a LeafNode's signature_key, allowing an unauthenticated remote attacker to present a victim's certificate while signing the LeafNode and KeyPackage with an unrelated key and be accepted under the victim's identity. In an MLS deployment that uses X.509 credentials and admits external commits without an independent credential-admission check, the attacker can be admitted as the victim, evict the victim via resynchronization (which compares whole credentials rather than signing keys), derive the current epoch, decrypt subsequent group messages, and send messages accepted as the victim. The flaw is rated CVSS 9.2 (CVSS:4.0) / 9.2-equivalent high impact with the vendor patch available in 1.86; no public exploit code or confirmed active exploitation was identified at time of analysis, and deployments using only basic credentials are explicitly unaffected. Note the assessed attack complexity is High because the MLS/X.509 path must be in use and the application must lack its own credential-admission validation.
Arbitrary shortcode execution in the Beaver Builder Page Builder - Drag and Drop Website Builder plugin for WordPress (all versions up to and including 2.11.0.5) lets unauthenticated attackers run attacker-chosen shortcodes on a target site, which in a typical WordPress install with shortcode-extending plugins can escalate to code injection and full site compromise (CWE-94). Exploitation is not automatic: it is gated on the site publishing a Beaver Builder page whose Sidebar module contains a widget rendering attacker-controllable text - the advisory names the core Recent Comments widget - and on either comments being auto-approved (moderation disabled) or the attacker's comment having been approved by a moderator, which makes this a content- and configuration-dependent attack rather than a universally reachable one; the flaws assessed vector therefore carries AC:H rather than the initial AC:L. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor advisory (Wordfence threat ID 794e6d9b-ac07-4261-a60d-81c474973005, mirrored as ENISA EUVD-2026-91966) is the authoritative source for patch rollout.