Missing authorization checks in the MultiversX 'multisig-improved' reference smart contract (mx-multisig-and-modules) allow an account holding the Proposer role to unilaterally move funds, draining 100% of a deployed contract's EGLD/ESDT balance in as few as two transactions with zero board signatures. The flaw is a CWE-306 missing-authentication issue in the fund-moving execution path; exploitation requires the attacker to already hold the Proposer role on a specific vulnerable deployment (assessed as PR:L, authenticated), not fully anonymous access, and publicly available exploit code exists, though there is no confirmed active exploitation (no CISA KEV) and EPSS is only 0.15% (3rd percentile). Deployments built from the affected commit are fully exposed once a Proposer-role account is compromised or malicious.
Prototype pollution in Payload CMS's @payloadcms/plugin-import-export module lets an unauthenticated remote attacker submit prototype-sensitive field paths to the plugin's endpoints, corrupting object prototypes and triggering unintended application behavior that can escalate to remote code execution. The flaw affects Payload 3.0.0 through versions before 3.88.0 and 4.0.0-canary.0 through versions before 4.0.0-canary.27, but only when the Import Export plugin is installed and enabled - sites without that plugin are unaffected. No public exploit code has been identified at time of analysis, and exploitation is gated by the presence of a reachable prototype-pollution gadget in the target application, so real-world impact is conditional even though the vendor advisory and a 9.3 CVSS 4.0 score (independent assessment: CVSS 3.1 8.1-range with AC:H) both flag it as high severity.
Field-level access control can be bypassed in Payload CMS's document duplicate operation, letting a caller with access to the duplicate endpoint copy hidden or read/create-restricted values from a source document into a newly created document - potentially exposing secrets such as tokens or credentials stored in access-controlled fields. The issue affects the npm `payload` package from 3.0.0 up to (but not including) 3.90.0, and 4.0.0 canary releases before 4.0.0-canary.34; the `disableDuplicate` setting, which is on by default for auth collections, did not actually block the operation before the fix. Exploitation requires an authenticated account that can reach the duplicate endpoint on a collection containing protected fields, and is a field-level authorization bypass rather than an unauthenticated remote compromise; vendor patches 3.90.0 and 4.0.0-canary.34 are released, and no public exploit code or active exploitation was identified at time of analysis.
Duplicate order processing in @payloadcms/plugin-ecommerce allows remote, unauthenticated attackers to have a single Stripe order confirmation processed more than once, producing duplicate orders and repeated cart, inventory, and transaction side effects in affected Payload CMS deployments. The flaw affects @payloadcms/plugin-ecommerce versions before 3.90.0 and 4.x canary builds before 4.0.0-canary.34, and only installations that configure the Stripe payment adapter are exposed - deployments that do not use the Stripe payment flow are explicitly unaffected. No public exploit code has been identified at time of analysis, and the vendor has shipped patched releases plus guidance requiring order finalization to be idempotent.
Malformed multipart request bodies sent to Payload CMS versions 3.0.0 through 3.89.x and 4.0.0-canary.0 through 4.0.0-canary.33 trigger a ReDoS-style catastrophic backtracking path in multipart Content-Type validation, causing the parser to consume CPU/resources for an extremely long time and effectively hanging the affected endpoint. The flaw is reachable by remote attackers without authentication (CVSS 4.0 vector PR:N/UI:N, AV:N, VA:H), but exposure is limited to deployments that parse multipart bodies - i.e., upload-enabled collections or any route invoking Payload's Busboy-based request processing - and instances that place those endpoints behind access controls or that lack upload collections substantially reduce their attack surface. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; vendor-released patches are available in 3.90.0 and 4.0.0-canary.34.
Stack-based buffer overflow in the Tenda AC5 router's web management interface allows an authenticated remote attacker to corrupt memory and potentially execute code by submitting an oversized wifiPwd argument to /goform/setWifi on firmware 02.03.01.111_multi. Exploitation requires network reachability to the device's HTTP management interface plus a valid low-privilege administrative session (CVSS vector PR:L), meaning fully unauthenticated attackers cannot trigger it against a hardened default configuration unless the management port is openly exposed. Publicly available exploit code exists (a detailed write-up has been published on GitHub), and the vulnerability carries a CVSS 4.0 base score of 8.6 with high confidentiality, integrity and availability impact; there is no CISA KEV listing indicating confirmed active exploitation, and no vendor patch has been identified from the available references.
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript or EPS document, chaining memory corruption in document parsing with a runtime bypass of the -dSAFER sandbox. The flaw affects Ghostscript as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10, and the assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning no privileges are required but a victim or automated pipeline must render the malicious file, with the malicious document first reaching the processing system. Publicly available exploit code exists, including a GitHub proof-of-concept, but the provided data does not confirm CISA KEV active exploitation, so -dSAFER should not be treated as a protective mitigation for affected versions.
API key disclosure in Payload CMS lets an authenticated user with ordinary read access to other users' authentication documents retrieve those users' active API keys and then act with the victim accounts' full permissions until the keys are rotated or disabled. Affected deployments are the npm `payload` package from 3.0.0 before 3.90.0 and canary releases from 4.0.0-canary.0 before 4.0.0-canary.34, but only where an authentication collection has `useAPIKey` enabled and users can read authentication documents they do not own - configurations restricted to self-read, or with `useAPIKey` disabled, are not exploitable. The CVSS 4.0 score is 7.7 (AV:N/AC:L/AT:P/PR:L) and our independent review assesses it as a credible upper-medium priority issue for environments that actually use the feature rather than an internet-wide emergency; no CISA KEV entry or public exploit code was identified at time of analysis.
Authenticated users who can update an auth collection document in Payload CMS can change the password field on that document even when the collection explicitly defines a field-level access.update restriction intended to deny it, allowing account takeover of the affected user. The flaw affects the npm `payload` package before 3.90.0 and canary releases from 4.0.0-canary.0 through 4.0.0-canary.34, and exploitation is conditional: the deployment must have configured a field-level password update restriction, local auth must be active, and the write must not be a draft save. It is a genuine but conditional integrity flaw rather than an internet-scale emergency - the attacker must already hold valid credentials with document update rights on the target collection, so there is no unauthenticated path; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Silent argument dropping in Coraza WAF v3 (>= 3.0.0, < 3.8.1) lets unauthenticated remote attackers evade every SecRule that inspects ARGS, ARGS_GET, ARGS_NAMES, ARGS_GET_NAMES or ARGS_PATH - including the OWASP CRS SQLi, XSS, RCE and LFI families - by padding a request past SecArgumentsLimit (default 1000) so the malicious parameter is discarded before phase 2 evaluation; roughly 10,000 GET parameters yields about a 94% per-request bypass, and the failure is completely silent (no audit-log entry, no transaction flag). The same advisory covers unbounded ARGS_POST growth because Coraza's urlencoded and JSON body processors ignored the argument cap entirely, which is also a per-request memory-exhaustion DoS surface. No public exploit identified at time of analysis and no confirmed active exploitation; vendor-released patch: 3.8.1 (the 3.8.0 fix was incomplete and 3.8.0 remains listed as affected), and the advisory/report is credited to the corazawaf project with AI-assisted analysis disclosed. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L (7.2 High), a CWE-693 protection-mechanism failure whose impact lands on the protected application rather than Coraza itself.
Authenticated users with query access to a Payload CMS collection can infer hidden or read-restricted field values - including password-reset tokens - by abusing polymorphic join 'where' filters that were not validated against unknown field paths. The flaw affects the npm package 'payload' in the ranges >=3.0.0 <3.90.0 and >=4.0.0-canary.0 <4.0.0-canary.34, requires a valid account holding query access (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and is a moderate-priority confidentiality-only issue (CWE-200); there is no public exploit identified at time of analysis, and vendor patches exist in 3.90.0 and 4.0.0-canary.34.
Payload CMS versions before 3.90.0 and canary versions before 4.0.0-canary.34 contain an authorization bypass in relationship queries that can expose protected document data. The vulnerability affects deployments where a readable collection has a relationship, upload, or join field pointing to a second collection whose read access is restricted via access.read where constraints; an unauthenticated attacker can use the 'contains' query operator to retrieve information about related documents that should be hidden. No public exploit identified at time of analysis. The vendor has released patches in 3.90.0 and 4.0.0-canary.34, and there is no complete workaround other than upgrading.
Unauthenticated remote attackers can bypass authentication in the web management interface of HPE AOS-S (ArubaOS-Switch), gaining full administrative control of the switch, as reflected in the 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Any device with the HTTP/HTTPS management service reachable from an untrusted network is exposed, and because the vector requires no credentials and no user interaction, network reachability of that interface is the primary limiting factor. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation; this is a genuine high-priority issue whose exact affected firmware versions and fixed releases are not detailed in the available data and must be confirmed against the HPE advisory.
Authentication bypass in the Aruba AOS-S (HPE Aruba Networking switch) management interface could allow an unauthenticated remote attacker to gain unauthorized access to the affected system, but exploitation is constrained by high attack complexity (AC:H) and specific preconditions outside the attacker's control that HPE has not publicly detailed. No public exploit code or CISA KEV active exploitation has been identified at time of analysis. Although the nominal CVSS 3.1 base score is 9.8 CRITICAL, the assessed vector emphasizes that successful attacks are not reliable against an arbitrary default deployment, and HPE advisory hpesbnw05156en_us should be consulted for exposure details.
Unauthenticated remote code execution affects the AOS-S switch firmware line from HPE Aruba, where a buffer overflow in a network-facing interface can be triggered by a remote attacker without credentials, user interaction, or a privileged network position (CVSS 9.8, AV:N/AC:L/PR:N/UI:N, full confidentiality, integrity, and availability impact). The practical barrier to exploitation is reachability of the specific affected interface on the switch rather than any authentication control, so switches whose management or service interfaces are exposed beyond a segmented management network carry the highest risk. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the advisory does not name the vulnerable service, port, protocol, or the affected and fixed firmware versions, so defenders must confirm exposure against HPE bulletin hpesbnw05156en_us.
Memory corruption flaws in HPE Aruba Networking AOS-S switch firmware allow an unauthenticated attacker who is positioned on the same Layer-2/adjacent network segment to corrupt memory and potentially execute arbitrary code on the switch (CVSS 9.6, AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Exploitation requires network adjacency - a directly connected device, a compromised host on the same VLAN/broadcast domain, or an attacker already inside the local network - but within that position no credentials and no user interaction are needed, and attack complexity is low, so default-configured, unpatched switches are exposed by sending crafted traffic to the vulnerable handler. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the primary exposure limiter is physical/logical access to the switch segment rather than remote internet reachability.
Unauthenticated attackers can forge payment-notification callbacks to the elegro Crypto Payment WordPress plugin (versions through 1.0.1) and arbitrarily change the status of orders on any installation where the shared secret has been left at its default empty value. No credentials, user interaction, or special network position are required against a vulnerable default-config site, and publicly available exploit code exists; however, the attack is fully neutralized once an administrator sets a non-empty shared secret, so only sites that never completed that configuration step are exposed. The independently assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) limits impact to integrity of order/payment state, with no confidentiality or availability effect, making this a moderate, conditional risk.
Insufficient access control in the @payloadcms/plugin-stripe package allows an authenticated Payload user to invoke unintended Stripe REST API operations through the optional /api/stripe/rest proxy, which in vulnerable releases was registered by default (rest defaulted to true). Only deployments that use the plugin, have the REST proxy reachable, and grant the attacker a valid authenticated account are affected; the impact is confined to Stripe API operations rather than host-level compromise, though it crosses a trust boundary into the connected Stripe account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but a vendor patch and a public GitHub advisory exist, so upgrading is the straightforward path. The vendor fix replaces the boolean toggle with an explicit allowlist of exact Stripe method names plus an optional access callback.
OS command injection in the TOTOLINK X6000R wireless router (firmware 9.4.0cu.652_B20230116) allows remote attackers to execute arbitrary shell commands on the device by supplying a crafted file_name argument that is processed by the firmware_check routine behind the /cgi-bin/cstecgi.cgi endpoint. The vendor-derived CVSS 4.0 vector scores this 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity and availability impact on both the vulnerable and subsequent systems), and our independent assessment is consistent: CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating low-complexity, unauthenticated remote exploitation with scope change and full device compromise. No public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis, and real-world exposure is limited to units whose web management interface is reachable from the attacker's position - a WAN-exposed admin interface or an attacker already positioned on the LAN.
An unauthenticated buffer overflow in HPE Aruba AOS-S switch software lets an attacker who already sits on an adjacent Layer 2 network segment read out sensitive memory contents and crash the device, producing a denial of service. The flaw carries a CVSS 3.1 base score of 9.3 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H), meaning no credentials or user interaction are needed, but the attacker must be able to reach the switch from an adjacent network rather than across the internet. No public exploit code or confirmed active exploitation was identified at time of analysis, so risk is real and high-severity for organizations running Aruba/HPE switching infrastructure yet bounded by the adjacent-network attack vector. The HPE security advisory (hpesbnw05156en_us) is the authoritative source for affected builds and fixed firmware.
Unauthenticated remote attackers can trigger buffer overflows in an interface of HPE Aruba AOS-S (ArubaOS-Switch) that is not named in the advisory, allowing them to expose sensitive memory contents and crash the device for a denial of service. The flaw is rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), so no credentials or user interaction are required, although realistic attacker reach is heavily conditioned on whether the specific vulnerable interface is exposed to untrusted networks. No public exploit code has been identified and the CVE is not in CISA KEV, so it is not confirmed actively exploited at time of analysis.
Unauthenticated remote credential theft in the Dell Container Storage Modules (CSM) Authorization component before v1.18.0 allows any attacker who can reach the csm-authorization-storage gRPC service to retrieve the storage-backend administrator credentials for every registered storage array, turning a single unauthenticated request path into full administrative control of the underlying storage infrastructure. The defect is a missing-authentication error (CWE-306) in a critical function and carries a CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), with the scope change reflecting the pivot from the CSM authorization service into the storage arrays themselves. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the principal gating factors are environmental - the optional Authorization module must be deployed, its gRPC endpoint must be reachable from the attacker's network position, and at least one array must already be onboarded so that credentials exist to steal - which is why Dell's DSA-2026-448 advisory and the availability of a fixed release make this a genuine top-priority item rather than a theoretical high-CVSS score.
Open redirect in Payload CMS authentication flows lets an attacker craft a link that, once a guest user authenticates, forwards that user to an untrusted external destination. Affected packages are npm/payload from 3.40.0 up to (but excluding) 3.88.0 and the 4.0.0 canary line below 4.0.0-canary.27, plus the companion @payloadcms/next package (>= 3.31.0, < 3.88.0 and >= 4.0.0-canary.0, < 4.0.0-canary.27). Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) exploitation is unauthenticated but requires victim interaction, and it only succeeds on deployments that actually pass a user-controlled redirect value through their login or account-creation flow; there is no confirmed active exploitation and no public exploit identified at time of analysis.
Unauthenticated remote attackers can exploit Dell Container Storage Modules (CSM) deployments running versions prior to 1.18.0 to elevate privileges, because a critical function is reachable without any authentication check (CWE-306); the vendor scores this CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and our independent assessment concurs that this is a genuine top-priority issue rather than a high-score/low-risk artifact. Per the provided CVSS vector the attack is unauthenticated, requires no user interaction, and involves no special difficulty (AC:L), so any party who can route traffic to the vulnerable CSM endpoint can trigger it. The decisive limiting factor is network exposure of that endpoint - CSM components frequently run inside a Kubernetes cluster, so realistic blast radius depends on whether the deployed service is reachable from an attacker-controlled network segment. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated arbitrary file upload in Kognetiks Chatbot for WordPress 2.4.9 and earlier allows remote attackers to upload files to the WordPress site without authentication, potentially leading to code execution if the uploaded file is placed in a web-executable location. The independent assessment confirms a high-priority, genuine vulnerability with remote unauthenticated exploitation, no user interaction, and only the vulnerable plugin being installed and active as a prerequisite. No CISA KEV entry or public exploit code is identified in the provided data, and EPSS is not provided.
Unauthorized read access to stored form submissions and form email configuration in Payload CMS deployments running the @payloadcms/plugin-form-builder plugin before 3.90.0 (and 4.0.0-canary versions before 4.0.0-canary.34) is achievable by an authenticated non-admin user, based on the vendor patch, which replaces a permissive 'any logged-in user' read rule with a check that the requester belongs to the configured admin user collection. The published CVE record characterizes the flaw as remote code execution (CWE-94, CVSS 10.0), but the actual shipped fix is an access-control tightening on the Forms and FormSubmissions collections plus tests asserting that users from unrelated collections are denied, so the verifiable impact is a confidentiality breach of form data rather than code execution; these conflicting signals should be reconciled with the vendor advisory before prioritization. There is no public exploit identified at time of analysis and no indication of confirmed active exploitation, but the authorization requirements (the CVSS vector claims unauthenticated, while the patch implies a logged-in non-admin account is needed) should be confirmed against the vendor before assuming unauthenticated exposure.
Unauthenticated arbitrary file upload in the Doctreat WordPress theme (versions up to and including 1.7.0) allows remote attackers to upload and execute malicious files, potentially leading to complete site takeover. The flaw requires no authentication or user interaction and affects only sites running this specific commercial Amentotech theme. No public exploit code was identified at the time of analysis, but the critical severity warrants immediate remediation.
Unauthenticated privilege escalation in the Doctreat Core WordPress plugin (versions 1.7.0 and earlier, vendor namespace amentotech) lets a remote visitor gain administrator-level rights on any affected site without logging in, supplying credentials, or interacting with a victim. The input assigns a maximal CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting a low-complexity, unauthenticated, network-reachable flaw with scope change and full loss of confidentiality, integrity, and availability; only sites with this specific plugin installed and un-updated are in scope. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
Sandbox escape in JetBrains TeamCity's Kotlin DSL configuration mechanism allows an attacker who can supply or modify versioned-settings build configuration code to run arbitrary code on the TeamCity server, breaking out of the DSL evaluation sandbox. The vendor advisory covers TeamCity releases before 2026.1.3 and before 2025.11.7; the CVSS 3.1 vector published with the CVE is a full 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), while our independent assessment scores it lower at PR:L because practical exploitation requires the ability to inject Kotlin DSL - realistically project-administration/edit rights in the TeamCity UI or write/commit access to the VCS repository holding the project's versioned settings - and the Kotlin DSL / versioned settings feature must actually be enabled. Risk signals here are genuinely conflicting and should be read carefully: a maximum-severity scope-changing RCE sits alongside a low EPSS of 0.27% (18th percentile), CISA SSVC 'Exploitation: none' and 'Automatable: no', and no public exploit identified at time of analysis, so this looks more like a high-impact but privilege-gated flaw than a broadly wormable one.
Remote code execution in WooCommerce Designer Pro (versions up to 1.9.33) allows authenticated attackers with Subscriber-level access or higher to execute arbitrary code on the server. The flaw is a code injection (CWE-94) with a CVSS score of 9.9 (Critical), requiring no user interaction and resulting in complete loss of confidentiality, integrity, and availability (scope change). Exploitation is most realistic on WooCommerce storefronts that permit open customer self-registration; no public exploit identified at time of analysis. The independent assessment confirms this is a genuine high-priority issue rather than a theoretical risk.
Privilege escalation in Dell Container Storage Modules (CSM) Operator versions prior to 1.18.0 allows an authenticated, low-privileged attacker who can create or modify the ContainerStorageModule Custom Resource to obtain root-level access on Kubernetes cluster nodes. The flaw is an improper privilege management weakness (CWE-269) in the ContainerStorageModule Custom Resource reconciler, rated CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) because the impact crosses a security scope boundary and delivers total confidentiality, integrity, and availability impact against the underlying nodes. Exploitation is not unrestricted: it requires a low-privileged cluster credential with rights to submit or alter the CSM Custom Resource (PR:L, no user interaction), so multi-tenant clusters that grant this permission broadly are the highest-risk deployments. No public exploit code has been identified at time of analysis and no CISA KEV entry exists; EPSS data was not provided.
Server-side cross-site scripting in Quasar Framework's SSR meta plugin (versions prior to 2.22.0) allows remote attackers who can influence dynamic page metadata - such as a post title, product name, excerpt, or display name - to inject executable markup into the server-rendered HTML before hydration. The flaw is in the getHead() serializer, which interpolates values supplied through useMeta() into title, meta, link, and script tags without HTML text or quoted-attribute encoding, while the client-side apply() path is unaffected because it relies on DOM APIs that encode attributes. Exploitation requires the target application to run Quasar in SSR mode and to feed attacker-influenceable data into useMeta() without prior sanitization, and a victim must load the affected page for the injected script to run; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the 10.0 CVSS base score overstates the universal real-world risk given these preconditions. The issue is fixed in version 2.22.0.
Arbitrary file upload in the Amentotech Workreap Core WordPress plugin (all versions through 3.4.5) lets an authenticated attacker who holds an Employer or Sales Representative role push attacker-controlled files onto the server, which on a standard WordPress/LAMP stack typically escalates to remote code execution and full site takeover. The issue is scored CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and the scope-change metric reflects that the impact crosses out of the plugin into the underlying host, while the low complexity and lack of user interaction mean an attacker only needs a valid low-privileged account. There is no CISA KEV listing and no public exploit identified at time of analysis, but the practical barrier collapses on sites that allow open self-registration of employer or vendor accounts, making this a genuine high-priority vulnerability that should be patched promptly.
Arbitrary file upload in the WordPress plugin Taskbot (versions 6.6 and earlier) lets an authenticated attacker with only a subscriber-level account upload executable files to the server, which can be leveraged to run code and take full control of the hosting site. The vulnerability is rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and stems from missing file type/extension validation in the plugin's upload handler (CWE-434); the scope-change metric reflects that compromising the plugin escalates into compromise of the whole WordPress installation. Exploitation requires a valid account at the subscriber role or higher - on sites that allow self-registration, that role is trivially obtainable by anyone, lowering the effective barrier close to unauthenticated. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so sites running Taskbot 6.6 or earlier should treat this as high priority.
WP Duplicate, a WordPress plugin maintained by Revmakx, fails to validate uploaded files in versions up to and including 1.1.11, letting a user holding only a Subscriber-level account push an arbitrary file (for example a PHP script) onto the server. The published CVSS 3.1 score is 9.9 (AV:N/AC:L/PR:L/UI:N, with S:C in the vendor/registry vector while the independent assessment scores S:U with C:H/I:H/A:H); exploitation is remote, low-complexity and needs no user interaction, and the practical barrier is simply that the target site must allow the attacker to hold a Subscriber account, which self-service registration makes trivial. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, so impact is potential rather than observed, but the low privilege requirement keeps the risk high for any site with open registration.
SQL injection in the web-based management interface of ClearPass Policy Manager lets a low-privileged authenticated remote attacker inject arbitrary SQL and run database commands against the underlying ClearPass instance, yielding high confidentiality, integrity and availability impact with a scope change (CVSS 3.1 base 9.9). The flaw is not pre-authentication: the attacker must already hold a valid low-privilege operator account or session on the management UI (PR:L), and no non-default feature or special configuration is needed beyond that (AC:L, UI:N). There is no public exploit identified at time of analysis and no known active exploitation, but the severity plus the sensitivity of the data held by a network access control policy store make this a genuine high-priority remediation item rather than a high-CVSS outlier.
The Bitbucket pull-request Scaffolder actions in Backstage can be abused by an authenticated user with template-execution rights and influence over the target Bitbucket repository to copy files outside the intended temporary workspace, potentially affecting backend confidentiality, integrity or availability. Deployments running @backstage/plugin-scaffolder-backend-module-bitbucket-cloud before 0.3.10 or @backstage/plugin-scaffolder-backend-module-bitbucket-server before 0.2.25 (Backstage before 1.54.6) are affected; the vendor rates the issue CVSS 9.9 (scope changed, PR:L). No public exploit identified at time of analysis (EPSS 0.33%, CISA SSVC exploitation: none), but vendor-released fixed versions exist and the issue carries an act_now priority.
Code execution in Handlebars.js versions 4.0.0 through 4.7.9 occurs when an application hands an attacker-controllable, pre-parsed AST object - rather than a template string - to Handlebars.compile() or Handlebars.precompile(); the compiler writes JavaScript expressions carried in unchecked AST fields straight into the generated code, which then executes in the server process wherever the compiled output runs. The flaw is an incomplete fix: the AST validation added in 4.7.9 for CVE-2026-33937 covered only PathExpression, NumberLiteral and BooleanLiteral values, leaving fields such as Program.blockParams.length, a non-PathExpression parameter depth, a non-string StringLiteral.value and a non-string PathExpression.original unvalidated. The published CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H (9.8) and treats this as trivially remote and unauthenticated, but that materially overstates real-world exposure: the vulnerable path is a non-default application design pattern that the vendor explicitly warns against, so applications that compile only template strings - the standard, documented usage - are completely unaffected, and no public exploit code has been identified at time of analysis. Vendor-released patch: 4.7.10.
Missing integrity verification in the HPE Networking ClearPass Policy Manager client agent allows remote unauthenticated attackers to introduce untrusted code that the agent then executes on the enrolled client system, giving full code execution on that endpoint. Only systems running the vulnerable client agent (for example OnGuard deployments) are exposed; the ClearPass server itself is not the target of this flaw, and organizations that do not deploy the agent are unaffected. The input CVSS of 9.8 reflects the worst case, but the authoritative independent assessment scores it AV:N/AC:H, because the attacker must first be able to supply or substitute the code the agent consumes - typically a man-in-the-middle position on the agent's communication or update channel, or control of a source the agent implicitly trusts. There is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so the practical risk is conditional on the attacker obtaining that network positioning or trusted-source access.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.12.2 allows attackers to execute arbitrary code via improper control of code generation (CWE-94). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicates remote, unauthenticated, low-complexity exploitation with full confidentiality, integrity, and availability impact, though the independent assessment notes the pre-auth condition is not independently confirmed by the description. A vendor patch is available, and no public exploit code has been identified at time of analysis; risk is highest for internet-exposed instances within the affected version range.
Unauthenticated remote code execution is the exposure created by a format string flaw in a service interface of HPE Networking ClearPass Policy Manager: an attacker who can reach the vulnerable interface can supply crafted input that corrupts process memory and, on successful exploitation, execute arbitrary code in the context of the affected service, with high confidentiality, integrity and availability impact (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code or confirmed active exploitation is identified at the time of analysis, and the report originates from HPE's own security-alert address, but the absence of authentication, user interaction or attack complexity means exploitation is straightforward for any attacker with network reachability to the interface. The practical limiting factor is exposure: ClearPass management and service interfaces are normally confined to segmented management networks, so internet-facing or user-network-reachable deployments carry the greatest immediate risk.
Missing integrity verification in the HPE ClearPass Policy Manager OnGuard agent allows an unauthenticated, remote attacker to execute arbitrary code with the agent's elevated privileges on managed endpoints. In practice, exploitation requires the attacker to intercept, modify, or impersonate the data/update channel the agent trusts (e.g., adversary-in-the-middle or rogue server), meaning the vendor's low-complexity rating (CVSS 9.8) is tempered by this positioning requirement. No public exploit code has been identified at time of analysis, and there is no indication of active exploitation (not in CISA KEV).
Unauthenticated remote code execution in the web interface of HPE Networking ClearPass Policy Manager allows an attacker who can reach that interface over the network to run arbitrary code on the appliance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms no authentication, no user interaction, and low attack complexity, with full confidentiality, integrity, and availability impact - a genuine high-priority vulnerability rather than a high-CVSS-but-low-risk artifact. No public exploit identified at time of analysis; the practical limiting factor is network exposure of the ClearPass web interface, so deployments reachable from the internet or broad internal networks are at direct risk while those restricted to isolated management networks or behind VPN/firewall controls are substantially less exposed.
Unauthenticated privilege escalation in Meta Box AIO versions 3.7.1 and earlier allows remote attackers to gain elevated privileges on WordPress sites where the plugin is installed and active. With a CVSS score of 9.8 (Critical) and a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, the flaw requires no authentication or user interaction and can be exploited over the network. No public exploit code has been identified at the time of analysis, but the vulnerability is rated critical due to its potential for full site compromise.
Authentication bypass in HPE Networking ClearPass Policy Manager allows an unauthenticated remote attacker to circumvent existing authentication controls on the product's web-based management and API interfaces and obtain administrative access to the affected system. The flaw carries a vendor-assessed CVSS of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, no user interaction, and no special configuration are required - only network reachability to a management or API endpoint, which in many deployments is restricted to management VLANs or admin networks, making exposure control the primary practical limiting factor. Our assessment rates this a genuine top-priority vulnerability rather than a high-CVSS-but-low-real-risk case; no public exploit code and no confirmed active exploitation were identified at time of analysis, and ClearPass is a network access control / policy enforcement platform, so administrative compromise can extend impact well beyond the appliance itself.
Authentication bypass in HPE Aruba Networking ClearPass Policy Manager allows an unauthenticated remote attacker to circumvent existing authentication controls on the affected interface and gain unauthorized access to the system, rated CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code was identified and the vulnerability is not confirmed actively exploited (no CISA KEV), but the assessed vector shows no credentials, no user interaction and no special configuration required, implying default-configuration exploitability where the interface is reachable. Independent assessment concludes the available signals point to a genuine high-priority issue rather than a CVSS-inflated non-issue; the exact affected versions and the specific exposed service are not named in the available HPE bulletin, so exposure of the interface is the primary risk-limiting factor.
Unauthenticated privilege escalation in the Amentotech Taskbot plugin for WordPress (versions 6.6 and earlier) allows any remote attacker to elevate privileges on a vulnerable site without credentials or victim interaction, as reflected by the CVSS 3.1 vector PR:N/UI:N/AC:L and a 9.8 base score. Because the flaw sits in privilege-assignment logic that is reachable in the plugin's default configuration, a standard installation that simply has Taskbot active is exposed; the practical limiting factor is that exposure depends entirely on this relatively uncommon plugin being deployed. There is confirmed actively exploited status absent - no CISA KEV entry was provided - and no public exploit code was identified in the supplied intelligence at time of analysis, so this should be prioritized on the basis of severity and ease of exploitation rather than observed attacks, with the caveat that corroborating intelligence is sparse and comes primarily from the Patchstack report.
Unauthenticated SQL injection in HPE Aruba Networking ClearPass Policy Manager allows a remote attacker who can reach the affected interface to inject arbitrary SQL into the application's database layer, with successful exploitation enabling execution of arbitrary database commands. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials or user interaction are required and the confidentiality, integrity, and availability impact is total; any ClearPass instance whose management/web service is reachable from an untrusted network is directly at risk. No public exploit code has been identified at time of analysis and the flaw is not in CISA's KEV catalog, but the pre-authentication, network-reachable profile and the database-command execution outcome make this a high-priority item for exposure reduction and patching per the HPE advisory.
Path traversal in HPE Aruba ClearPass Policy Manager allows an authenticated attacker with access to the management interface to read and modify files on the underlying operating system. The independent assessment rates this as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, requiring a valid session and network reachability to the management plane; the vendor's stated vector with PR:N conflicts with the description's authentication prerequisite. No public exploit code or CISA KEV entry is identified at time of analysis.
Payload CMS releases before 3.90.0 (and canary builds before 4.0.0-canary.34) expose an orderable reorder endpoint that writes document order changes without evaluating collection or field-level update access control, allowing a caller who can reach that endpoint to alter the sort position of documents in any collection or join field that has the orderable option enabled. The vendor's own fix commit confirms the pre-patch endpoint accepted arbitrary orderableFieldName values and performed the underlying update with access checks bypassed (overrideAccess true), and the post-fix code now rejects unconfigured fields with HTTP 400 and re-runs executeAccess per document, so exploitation depends on the orderable feature being explicitly configured and the achievable impact is confined to the ordering field rather than arbitrary document content. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; authentication requirements are not confirmed from available data, and the input CVSS of 9.8 (triple-High impact) is inconsistent with the source-code evidence, which supports the lower assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.