Unauthenticated remote attackers can gain elevated privileges against Dell Container Storage Modules deployments because the CSM Authorization component ships with hard-coded credentials, as described in CWE-798 and scored CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Every CSM release prior to 1.18.0 is affected per the vendor advisory DSA-2026-448, and exploitation requires only that the CSM Authorization service be deployed and reachable over the network - no account, token, or user interaction is needed. Exposure is bounded by deployment footprint: only Kubernetes clusters using CSM Authorization to front Dell storage arrays are at risk, and network segmentation that keeps the authorization service off untrusted networks materially reduces reachability. No public exploit code and no confirmed active exploitation were identified at the time of analysis, but the unauthenticated, no-interaction exploit profile makes this a high-priority patch candidate.
Unauthenticated PHP Object Injection in the GDPR Framework By Data443 WordPress plugin through version 2.5.0 allows remote attackers to pass crafted serialized data to a PHP unserialize() path, potentially achieving full confidentiality, integrity, and availability impact if a usable gadget chain is reachable. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) confirms network-reachable, low-complexity, unauthenticated exploitation with no user interaction; the only prerequisite is an active vulnerable plugin installation. No public exploit code or CISA KEV entry was identified at time of analysis, though reliable code execution depends on the presence of a gadget chain in the plugin, WordPress core, or other loaded components.
Privilege elevation on Dell client endpoints that have Dell Command | Configure (DCC) installed at a version below 5.2.3.35, driven by improper handling of mixed encoding (CWE-175) that allows crafted, ambiguously encoded input to be processed in a way that yields elevated rights. Dell labels the flaw 9.8 with an AV:N/AC:L/PR:N/UI:N vector, but our independent assessment treats it as a local, low-privilege-triggered defect (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) because DCC is an optional local client-configuration utility rather than a network service and the advisory never identifies a remotely reachable interface - the input signals are sharply conflicting and must not be reconciled uncritically. There is no public exploit identified at time of analysis, EPSS is low at 0.27% (18th percentile), CISA SSVC records exploitation as none, and a vendor patch is available.
An out-of-bounds write in the Linux kernel's siw (Soft-iWARP) RDMA driver lets a connected iWARP peer corrupt kernel memory by delivering an extended DDP/RDMAP header split across more than one TCP receive callback; the miscalculated copy length (hdrlen - MIN_DDP_HDR instead of the number of missing bytes) pushes the destination past the header, overwrites the receive state including fpdu_part_rcvd, and a later callback reuses that corrupted value as a copy offset. The upstream CVSS 3.1 vector scores this 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates it AV:N/AC:H (8.1) because exploitation requires the siw driver to be loaded - it is not enabled in default Linux configurations - and requires the attacker to control TCP segmentation so the header spans multiple callbacks; no authentication is needed once an RDMA session exists. Exploitation status: no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and the issue is not listed in CISA KEV, though a vendor patch is available for the stable branches.
Out-of-bounds read and write in the Linux kernel's RDMA Soft-RoCE (rxe) driver (CVE-2026-98365) lets an unauthenticated peer on an already-established RDMA queue pair send a crafted RDMA-Write or RDMA-Read RETH whose iova+length wraps to zero, bypassing the mr_check_range() bounds check and causing a kernel oops (and possible memory corruption) in rxe_mr_copy_xarray(). No public exploit code was identified at time of analysis and EPSS is low at 0.17% (5th percentile), but realistic exposure is gated by configuration: the rdma_rxe module must be loaded and the host must expose Soft-RoCE on a reachable interface, which is not the default Linux setup. Vendor-released patches are available in stable kernels 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.
Denial of service in the Dbit WIFI4 N300 1.0.0 router allows an attacker who is already associated with the device's local Wi-Fi network to crash its management interface by sending an HTTP request to the /api/login endpoint that omits the username or password field, which the device's JSON parser cannot handle. No authentication is required (CVSS PR:N), but exploitation demands Wi-Fi adjacency/association rather than internet reachability, and the realized effect is limited to loss of availability of the web management interface - there is no described path to data disclosure or code execution. The input CVSS 3.1 base score of 9.8 (AV:N/.../C:H/I:H/A:H) substantially overstates real-world risk; our independent assessment scores it CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and EPSS is very low at 0.15% (4th percentile), with no public exploit and no CISA KEV listing identified at time of analysis.
Fork-originated Gitea Actions workflows can run on a base repository's registered runners without the required approval when a repository maintainer performs ordinary pull request triage, such as adding a label, because the approval decision was keyed to the user who triggered the event rather than the fork pull request author, allowing fork-controlled workflow code to execute in the base repository's CI context. Gitea versions up to and including 1.27.3 are affected when Actions is enabled and a matching runner is registered; the issue is fixed in Gitea 28.0.0. No public exploit code was identified at time of analysis and EPSS is low (0.15%, 3rd percentile), but exploitation is not autonomous: the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) requires an attacker-submitted fork pull request plus a privileged maintainer action, and CISA SSVC rates the technical impact as total, so the outcome when the prerequisite chain is met is full compromise of confidentiality, integrity, and availability of the workflow execution environment.
Mitigation bypass in Mozilla Firefox's File Handling component affects Firefox builds prior to 157.0.1 and lets an attacker defeat a protection mechanism that Firefox relies on when a user opens, downloads, or otherwise processes an attacker-supplied file. The input CVSS 3.1 vector rates this 9.8 CRITICAL, but the supporting evidence contradicts that: the vulnerability is a CWE-693 protection-mechanism failure whose practical impact depends on chaining it with a second attack rather than achieving standalone compromise, it is client-side and requires user interaction with malicious content, and the independent assessment scores it AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. Exploitation is unauthenticated per the vector (PR:N), exploitation is not automatable against a server, EPSS is a low 0.14% (3rd percentile), SSVC records Exploitation: none, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. A vendor patch is available in Firefox 157.0.1, so patched users are not exposed.
A use-after-free in the Android Bluetooth stack (bluetooth_ccc.cc, function BluetoothCccHandlerCallbackImpl) lets an attacker within Bluetooth radio range execute arbitrary code on unpatched Android devices, with no user interaction and no additional execution privileges required. The flaw is rated CVSS 9.8 under the vendor's AV:N vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); our independent assessment re-scores it AV:A because exploitation realistically requires the device's Bluetooth to be enabled and the attacker to be within radio range to deliver crafted CCC/GATT traffic, while agreeing that no authentication or victim action limits the attack. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and a fix is published in the Android/Pixel security bulletin dated 2026-10-01.
SQL injection in Payload CMS 3.0.0 through before 3.88.0 (and 4.0.0-canary builds before 4.0.0-canary.27) allows remote attackers to inject arbitrary SQL when the instance runs the SQLite (@payloadcms/db-sqlite) or Postgres (@payloadcms/db-postgres) adapter and untrusted users can query readable collections while supplying dynamic filters or join parameters. MongoDB-backed deployments are explicitly not affected, and the practical blast radius is bounded by which collections are readable to the attacker - if access control blocks those queries or dynamic filter/join input is not accepted, exploitation is blocked (the vendor-documented workaround). Vendor patches ship in 3.88.0 and 4.0.0-canary.27; no public exploit code was identified at time of analysis, and our independent assessment rates this a genuine high-priority issue with read-confidentiality impact dominating (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) rather than the vendor-published 9.8.
Path traversal in Dell System Update (DSU) versions prior to 2.3.0.0 allows an unauthenticated remote attacker to escape the intended restricted directory when the DSU client processes crafted pathnames in update content, resulting in filesystem access. Because DSU operates with elevated privileges, exploited path traversal can escalate to arbitrary code execution as root, potentially compromising both the application and the underlying operating system. Exploitation is not automatic: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) shows remote, unauthenticated reach but a mandatory user interaction step, and no public exploit code was identified at time of analysis. Dell has published a fixed release, and this is a genuinely high-priority flaw rather than merely a high-CVSS outlier.
Payload CMS (npm package `payload`) versions 3.0.0 through 3.89.x and 4.0.0-canary builds before canary.34 hash account passwords with a PBKDF2 work factor below current recommendations, so anyone who obtains a database dump or backup can test candidate passwords against the stored hashes at materially lower computational cost. The weakness sits behind stored credentials rather than in the request path: it cannot be triggered against a live instance, grants no authentication bypass, and requires the attacker to already have read access to the hash store. No public exploit code has been identified at time of analysis and there is no indication of active exploitation. Payload 3.90.0 and 4.0.0-canary.34 correct the parameters and transparently re-hash legacy credentials on the next successful login.
Authenticated Backstage users can retrieve the internal execution data of other users' Scaffolder tasks - notably the SerializedTask secrets field (including __initiatorCredentials) and state.checkpoints - through the scaffolder-backend task API in versions prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0. Where scaffolder tasks or templates place credentials for an external service into those fields, the disclosure can extend to unauthorized changes in that external system, which is reflected in the assigned CRITICAL 9.6 score (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) and its scope change. Exploitation requires a valid authenticated account with permission to read the target task, and no public exploit has been identified at time of analysis.
Memory corruption in Google Chrome's Navigation component - a use-after-free (CWE-416) - allows a remote attacker to execute arbitrary code outside the browser sandbox on any Chrome installation prior to 155.0.8059.39 by getting a user to load a crafted HTML page. The flaw is rated Critical by Chromium with a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H): no authentication is required and delivery is network-based, but exploitation still depends on the victim rendering attacker-controlled content, and the scope change (S:C) reflects that successful exploitation escapes the renderer sandbox to affect the host system. No public exploit has been identified at time of analysis (CISA SSVC Exploitation: none, Automatable: no), and this is a genuine high-priority issue rather than an inflated high-CVSS score.
Server-side template injection in Dell Container Storage Modules (CSM) releases prior to 1.18.0 allows a low-privileged authenticated remote user to escalate privileges within and beyond the affected component, with a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). The flaw is rated Scope:Changed with high confidentiality and integrity impact and no availability impact, meaning a compromise of the template-evaluating component can cross a security boundary and affect resources the attacker would not normally control. At time of analysis there is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit identified; the practical barrier is that a valid low-privilege account with network access to CSM is required before the injection can be delivered.
Out-of-sandbox code execution is achievable in Google Chrome desktop builds prior to 155.0.8059.39 by exploiting a use-after-free in the browser-process TabStrip component, reached when a victim is socially engineered into opening an attacker-crafted HTML page. The flaw carries a 9.6 CVSS (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) because the corrupted component sits outside the renderer sandbox, so a successful exploit escapes Chrome's primary containment boundary; however, it is not a zero-click bug and no public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with Automatable 'no'. A vendor-released patch (155.0.8059.39) is available, making this a high-priority but currently non-weaponized patch-now item rather than an active incident.
Use-after-free in the browser-process component of Google Chrome before 155.0.8059.39 lets a remote attacker execute arbitrary code outside the sandbox when a victim opens a crafted HTML page. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N) but requires the user to navigate to attacker-controlled content (UI:R); the scope change and high confidentiality, integrity, and availability ratings reflect that a successful page load escapes the renderer sandbox to reach host-level code execution, which pushes the base score to 9.6 and earns a Chromium security severity of Critical. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, so the practical near-term risk comes from the low complexity of the trigger (phishing, malvertising, or a compromised site) rather than from observed attacks. Vendor-released patch: Chrome 155.0.8059.39.
Incorrect authorization (CWE-863) in Google Chrome's SiteIsolation component allows an unauthenticated remote attacker to execute arbitrary code in the browser when a victim loads a crafted HTML page, a flaw Google rates High and that carries a CVSS base score of 9.6. Exploitation is limited by the required user interaction (UI:R) - the victim must visit attacker-controlled or compromised web content on a build older than 155.0.8059.39 - so delivery hinges on drive-by browsing or social engineering rather than unattended compromise, consistent with CISA's SSVC rating of non-automatable. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in Chrome 155.0.8059.39.
Remote code execution outside the browser sandbox in Google Chrome prior to 155.0.8059.39 allows a remote attacker to execute arbitrary code on a victim's system via a crafted HTML page. The flaw is a use-after-free in the browser's Core component, and exploitation requires the victim to open attacker-controlled web content (UI:R) while no authentication or special privileges are needed (PR:N); the CVSS score is 9.6 with scope change (S:C) reflecting sandbox escape. Despite the high impact, there are no exploitation signals: no public exploit identified at time of analysis and the SSVC assessment lists exploitation as none, though the total technical impact and wide deployment make timely patching a priority.
An integer overflow in the WebGL implementation of Google Chrome on Android lets a remote attacker potentially execute arbitrary code outside the browser sandbox on devices running any build prior to 155.0.8059.39. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), meaning exploitation is unauthenticated but requires the victim to open an attacker-controlled HTML page that exercises the vulnerable WebGL code path; the scope change (S:C) reflects the potential escape from Chrome's renderer sandbox rather than a mere renderer crash. At time of analysis there is no public exploit identified, CISA's SSVC assessment records Exploitation: none and Automatable: no, and a vendor patch exists, so the issue is high priority on impact and patch urgency rather than on observed exploitation. Because WebGL is enabled by default on Android Chrome, no special configuration is needed on the victim side beyond navigation to the malicious page.
Incomplete cleanup in Dawn, Chrome's WebGPU implementation, allows a crafted HTML page to potentially corrupt GPU-process state and achieve code execution outside the browser sandbox in Google Chrome builds prior to 155.0.8059.39. Exploitation requires the victim to render attacker-controlled content that reaches the affected WebGPU/Dawn code path (CVSS UI:R with PR:N - unauthenticated remote attackers, but user interaction required), and the outcome is probabilistic rather than a guaranteed silent drive-by; the published base score is 9.6 while Google rates the issue Medium, and our assessed vector raises attack complexity to AC:H to reflect the difficulty of chaining a cleanup flaw into a reliable sandbox escape. No public exploit code has been identified at time of analysis, and Google has released Chrome 155.0.8059.39 as the fix.
Remote code execution outside the browser sandbox is possible in Google Chrome builds prior to 155.0.8059.39 through a use-after-free flaw in the built-in Chromecast (Cast) component: an attacker who gets a victim to render a crafted HTML page can corrupt freed memory and run arbitrary code with the browser's privileges (CVSS 9.6, Chromium severity Critical). The sole hard prerequisite is user interaction - no credentials or elevated privileges are required per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) - and because Cast ships with standard desktop Chrome rather than as an optional extension, the exposed population is essentially every unpatched Chrome installation. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.
Incorrect authorization in the Google Chrome user-interface layer allows a crafted HTML page to escape the renderer sandbox and execute arbitrary code outside it on all Chrome builds prior to 155.0.8059.39. Exploitation requires the victim to open an attacker-supplied page (UI:R in the assessed vector) and, while no authentication is required (PR:N) and no unusual configuration is needed, the attack is not fully remote - it depends on that user action, which is the main limiting factor. Severity signals are mixed: the assessed CVSS vector scores 9.6 with scope change (S:C) and high confidentiality, integrity and availability impact, yet Google rates the underlying Chromium issue as Medium, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Incorrect authorization in Google Chrome's FileSystem component allows a remote attacker to break out of the browser sandbox and potentially execute arbitrary code at the operating system level on desktop builds prior to 155.0.8059.39. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6), no authentication or prior privileges are required, but exploitation is not automatic: the attacker must use social engineering to convince the victim to open a crafted HTML page, which aligns with CISA's SSVC rating of "not automatable" and a technical impact of "total" given the scope change across the sandbox boundary. There is no CISA KEV listing and no public exploit code identified at time of analysis, and a vendor patch is available, so this should be treated as a high-severity, patch-now issue rather than an actively exploited emergency.
Integer overflow in the Media component of Google Chrome (all versions prior to 155.0.8059.39) allows a remote, unauthenticated attacker to corrupt memory via a crafted HTML page containing specially formed media content, with the potential to execute arbitrary code outside the browser sandbox. Exploitation is not automatic: the CVSS vector (UI:R) confirms the victim must actively load the attacker-controlled or compromised page, and Google rated this a Chromium severity of 'Low', indicating the sandbox-escape outcome is not reliably achievable and probably depends on specific memory conditions or combining this primitive with others. No public exploit code and no CISA KEV entry were identified at time of analysis; the 9.6 score reflects the scope-change metric (S:C) and high C/I/A impact rather than proven real-world exploitation, so the practical risk is lower than the headline score suggests.
An out-of-bounds write in the Media component of Google Chrome before 155.0.8059.39 lets a remote attacker corrupt memory and potentially achieve arbitrary code execution outside the browser sandbox when a victim opens an attacker-crafted HTML page containing malicious media content. The attack is fully remote and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N), but it is gated by user interaction (UI:R) - the victim must visit the malicious or compromised page - and the 'outside the sandbox' outcome implies defeating Chrome's process sandbox, which is materially harder in practice than the 9.6 base score suggests. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed build.
Improper input validation in the Mobile component of Google Chrome on iOS allows a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim is socially engineered into opening a crafted HTML page, fixed in Chrome 155.0.8059.39. Successful exploitation requires user interaction (CVSS vector PR:N/UI:R with S:C), meaning the attack hinges on phishing or a malicious link rather than a zero-click path, and the scope change reflects the assessed ability to escape the sandbox boundary. No public exploit code has been identified at time of analysis and the issue is not a confirmed actively exploited (CISA KEV) vulnerability, but the 9.6 CVSS score and the RCE tag make prompt patching of older mobile Chrome installations the priority.
A use-after-free in the Chrome Tabs component of Google Chrome on macOS allows a remote attacker to potentially execute arbitrary code outside the sandbox when a victim loads a crafted HTML page, affecting all builds prior to 155.0.8059.39. Exploitation is unauthenticated (CVSS PR:N) but requires user interaction (UI:R) - the victim must navigate to or open attacker-controlled web content, with no zero-click vector indicated, and reliable code execution additionally depends on successful heap grooming of the freed object. The issue is assessed as a genuine high-priority problem rather than a high-CVSS-but-low-real-risk case (CVSS 9.6, scope-changed), and no public exploit was identified at time of analysis; a vendor patch is available in Chrome 155.0.8059.39.
Use-after-free in Chrome's Tint shader compiler lets a remote attacker achieve code execution outside the browser sandbox when a victim opens a crafted HTML page - the page drives Chrome's WebGPU pipeline so that Tint compiles a malicious WGSL shader that triggers the memory-safety flaw. The flaw affects Google Chrome builds prior to 155.0.8059.39 and is rated 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), with the scope-change sub-score reflecting that successful exploitation escapes the renderer sandbox and yields host-level impact; no authentication is needed, but the attacker must convince the user to visit the page (UI:R). No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no exploitation, so this is currently a high-priority patch-now issue rather than an actively exploited one; a vendor patch is available in the 155.0.8059.39 stable release.
Use-after-free in the ANGLE graphics layer of Google Chrome allows a remote, unauthenticated attacker to execute arbitrary code outside the browser sandbox when a victim opens a crafted HTML page; the vulnerable code path is present in Chrome builds prior to 155.0.8059.39. Exploitation is not automatic - the attacker must lure the user into rendering the malicious page (UI:R), but no credentials are required and the assessed CVSS:3.1 vector scores 9.6 with a scope change (S:C) because successful exploitation escapes Chrome's primary containment boundary rather than staying inside the renderer sandbox. Only publicly available exploit code would normally elevate this beyond an urgent patch-now item: at the time of analysis there is no indication of confirmed active exploitation (no CISA KEV listing) and no public exploit identified, while a vendor patch is available. Note that the description scopes the flaw to Chrome on Android, whereas the only vendor reference is the Desktop stable-channel release notes - the affected platform should be verified against the vendor advisory before relying on a platform-specific assumption.
Incorrect authorization in the Search component of Google Chrome for Android before 155.0.8059.39 can allow a remote, unauthenticated attacker to execute arbitrary code outside the browser sandbox when a victim is socially engineered into opening a crafted HTML page. The vendor-rated Chromium severity is Medium, yet the assessed CVSS is 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) because the flaw crosses a security boundary (scope changed) with high confidentiality, integrity and availability impact. The risk signals conflict and must be weighed carefully: the impact score is severe, but exploitation requires a click of user interaction, is confined to Android builds (desktop Chrome is unaffected), and no public exploit code or confirmed active exploitation has been identified at the time of analysis. Vendor patches are available.
Code execution outside the Chrome sandbox is possible in Google Chrome desktop builds prior to 155.0.8059.39, where a use-after-free in the network component (CVE-2026-106234, CWE-416) can be triggered by a crafted Chrome extension that a remote, unauthenticated attacker convinces a victim to install. The UI:R prerequisite - social engineering the user into installing the extension - is the primary limiting factor, which is why the vendor assigned a Chromium security severity of Low even though the assessed CVSS is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and technical impact is rated total in the CISA SSVC framework; the high CVSS and the Low vendor severity are sharply conflicting signals. No public exploit identified at time of analysis (SSVC exploitation: none), and a vendor patch is available.
Information disclosure in the Permissions component of Google Chrome before 155.0.8059.39 allows a remote, unauthenticated attacker to bypass the browser's site-isolation boundary by luring a victim into loading a crafted HTML page. Exploitation requires user interaction (UI:R) - the target must visit attacker-controlled content - and the resulting impact is limited to leaking information across origins rather than code execution, data modification, or denial of service. A vendor fix is already available in 155.0.8059.39, there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, and EPSS is 0.18% (7th percentile), indicating a low near-term exploitation likelihood.
Out-of-sandbox code execution in Google Chrome for iOS (versions prior to 155.0.8059.39) stems from a missing authorization check that lets a remote, unauthenticated attacker who socially engineers a victim into opening a crafted HTML page run arbitrary code outside the browser sandbox (CVSS 3.1 base 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, CWE-862). Exploitation is not possible without user interaction - the victim must navigate to or open attacker-controlled content on a vulnerable iOS Chrome build - and no public exploit code was identified at time of analysis, with no KEV confirmation of active exploitation. The combination of a scope-changing sandbox escape with high confidentiality, integrity, and availability impact makes this a high-priority browser flaw, but the mandatory user interaction and the narrow affected population (only unpatched iOS Chrome builds) keep it short of an emergency-patch situation.
OS command injection in Progress Software's Autonomous REST Connector GenAI Agents ARCGenAI-Generator 2.0 allows attacker-controlled shell metacharacters embedded in a Swagger/OpenAPI schema name to run as arbitrary OS commands on a developer's workstation, because the derived {fileName} value is interpolated unquoted into the agent's shell-based temporary-file cleanup commands (rm -f / del /Q / rmdir). Exploitation is unauthenticated from a network perspective (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction: a developer must load the attacker-supplied API specification into the generator, which is reflected in the UI:R metric and the 9.6 score with Scope:Changed. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but a vendor patch (upstream commit 7ede6d96eb033d647ffdcabf8d8069c098293575 plus the Progress DataDirect Critical Security Alert Bulletin, September 2026) is available.
Missing authentication in the OSSRS SRS proxy System API (internal/proxy/api.go, function systemAPI.Run) lets remote unauthenticated attackers reach management/registration endpoints of the proxy component without presenting any credentials. The affected component is the newer SRS proxy mode in versions up to 7.0-a1; deployments that do not run the proxy component, or that keep its System API port off the network, are not exposed. Exploitation is practical - publicly available exploit code exists (CVSS 4.0 E:P) and the referenced issue #4690 documents the exposure - but this is a moderate-priority finding, not an inflated critical one, with limited per-CVSS confidentiality, integrity and availability impact (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 6.9 under CVSS 4.0). No CISA KEV entry or confirmed active exploitation is associated with this CVE at time of analysis.
Authentication bypass in SourceCodester Drug Recommendation System 1.0 lets remote, unauthenticated attackers impersonate arbitrary accounts by manipulating the user_id argument processed by the application's Auth Guard component. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no credentials, user interaction, or special configuration are required, so any network-reachable default installation is exposed; impact is bounded to LOW confidentiality, integrity, and availability (VC:L/VI:L/VA:L), limiting the attacker to unauthorized read/limited modification rather than full system compromise. Publicly available exploit code exists, including a detailed GitHub write-up of the broken access control issue, so exploitation is trivial for anyone who can reach the instance; the practical risk is tempered mainly by the product's very small real-world deployment footprint and the capped impact ratings.
Unauthenticated remote attackers can obtain sensitive information from Uptrace by triggering detailed error messages in the Login function of pkg/org/user_handler.go, a CWE-209 information-exposure flaw affecting builds up to and including 2.1.0-beta.8. Per the CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:L with no integrity or availability impact) and our independent assessment (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), exploitation requires only network reachability to the exposed login interface, with no authentication and no user interaction, and the resulting impact is limited to low-severity disclosure. Publicly available exploit code exists, and the vendor was reportedly notified through an issue report but has not yet responded, so no vendor-released patch has been identified at time of analysis; this is a genuine but modest-priority issue rather than a high-severity emergency, and the beta/pre-release nature of the affected versions narrows the exposed population.
SQL injection in the Employee Movement Tracking and Monitoring Website for IOCL (a PHP project published at github.com/bhagya3929) allows remote attackers to manipulate the Username argument of /admin_transaction.php and inject arbitrary SQL. Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N, E:P), no authentication or user interaction is required and publicly available exploit code exists, though the 'admin_' endpoint naming means defenders should verify whether the page is actually reachable pre-authentication. The impact is assessed as limited data confidentiality, integrity, and availability loss (VC:L/VI:L/VA:L), and practical priority is low because the project is a rolling-release hobby application with no packaged versions and a very small install base - exploitation depends on finding one of the few publicly reachable deployments. The maintainer was notified via a GitHub issue but has not responded, and no vendor-released patch has been identified.
Improper authorization in PickMall Lilishop 4.2.4 and earlier allows remote attackers to tamper with the mobile-number binding workflow at /buyer/passport/member/bindMobile by manipulating the Username argument, bypassing intended ownership checks (CWE-285). Publicly available exploit code exists but there is no confirmed active exploitation (not in CISA KEV). The vendor-assigned CVSS 4.0 base score is 5.5, while independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, noting that although the scored vector claims PR:N, the buyer/passport endpoint path strongly suggests a valid buyer session is realistically required to reach the vulnerable function, so the PR:N assumption should be verified against the application's authentication flow.
SQL injection in the KusalkaSilva Learning-Management-System's student registration endpoint (student_signup.php) allows unauthenticated remote attackers to manipulate database queries. Publicly available exploit code exists, though no active exploitation has been confirmed by CISA KEV. Affected deployments include all rolling-release versions up to commit ffeb873f8803f1e9664384ff75000c7da45466d2, and the vendor has not responded to the issue report.
On any WordPress site running the File Media Renamer plugin through version 1.3, an authenticated low-privilege user who holds file-upload capability - typically an Author, or a Contributor explicitly granted uploads - can rename media attachments that belong to other users, including administrators, because the plugin never checks whether the requester is authorised to modify the targeted attachment. Beyond the direct rename, the operation rewrites the stored file path while leaving other site data (post content and plugin metadata that referenced the original path) pointing at the old filename, producing broken images and corrupted references that persist until manually repaired. Publicly available exploit code exists, and while there is no confirmed active exploitation (no CISA KEV entry), the flaw is trivially reachable by anyone who can already upload files, with no victim interaction required. Independent assessment characterises this as a broken-access-control / IDOR problem rather than an authentication bypass: the attacker must already hold a valid account, so it is an insider or multi-author-site threat, not a remote-unauthenticated one.
Unauthenticated SQL injection in the KusalkaSilva Learning-Management-System admin login endpoint (admin/login.php) allows a remote attacker to manipulate the username and password parameters passed to mysql_query before any credential check is performed. The project is an unversioned, single-developer codebase with no packaged releases, so every deployment of the repository at or before commit ffeb873f8803f1e9664384ff75000c7da45466d2 is potentially affected, and because the injection sits in the pre-login path no authentication, user interaction, or special configuration is required (CVSS:4.0 PR:N/UI:N, assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N). A publicly available exploit code exists in the form of an issue report on the project's GitHub repository, but there is no confirmed active exploitation (CISA KEV) and the maintainer has not responded or issued a fix, so the practical risk is bounded mainly by how many instances expose this admin login to untrusted networks rather than by any technical bar to exploitation.
SQL injection in Kusalkasilva LMS permits remote, unauthenticated attackers to manipulate the username and password parameters at the login endpoint (login.php) and execute arbitrary SQL against the backend database. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the product is an obscure rolling-release GitHub project with no vendor-released patch. The project was notified via a GitHub issue but has not responded, making the practical risk modest due to very limited exposure rather than urgent.
Unauthenticated remote code execution in the SPIP Crayons plugin before 3.5.0 allows any remote attacker to take over a SPIP site by reaching crayons_store.php without the secu_ anti-forgery parameter, which causes the authorization dispatcher to select an unconditionally-true handler instead of the legitimate modification check. With authorization bypassed, the attacker can write an arbitrary .html skeleton file, read configuration files that expose the site secret, and forge a signed AJAX context that executes the planted skeleton as PHP under the web-server user. The assessed impact is high across confidentiality, integrity, and availability (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H; vendor-scored 9.3), exploitation requires only that the Crayons plugin be installed and enabled below 3.5.0, and no public exploit code was identified at time of analysis though the flaw is trivially reachable and unauthenticated.
Unauthenticated, network-adjacent attackers can crash - and potentially execute arbitrary code on - Arista Wi-Fi access points by sending a crafted packet to the wireless gateway service, provided the captive portal or application firewall feature is enabled on at least one SSID. The flaw is a stack-based buffer overflow (CWE-121) rated 9.4 under CVSS 4.0 (AV:A/AC:L/PR:N/UI:N with all impact metrics High and scope change), and because the wireless gateway service restarts automatically after a crash, an attacker can retry indefinitely. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not listed in CISA KEV); exposure is limited to devices where a vulnerable feature is actually enabled and to attackers within wireless range or on an adjacent network segment.
Unauthenticated SQL injection in the Booknetic WordPress plugin (versions 4.8.5 and earlier) lets any remote attacker inject arbitrary SQL into database queries handled by the plugin, yielding direct read access to the underlying WordPress database. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), the injection is reachable before authentication against a default plugin installation, so any internet-reachable WordPress site with Booknetic active and a publicly accessible booking page is a viable target - no account, no user interaction, and no non-default configuration required. The practical ceiling on impact is set by product presence: only sites actually running the affected plugin are exposed, and the value of exploitation scales with how much sensitive data the WordPress database holds; no public exploit code has been identified at time of analysis, and no EPSS score was supplied in the available intelligence, though the reported 9.3 CVSS score and confidentiality-heavy impact justify treating this as a high-priority patch.
Unauthenticated SQL injection in the WooCommerce Appointments WordPress plugin (versions up to and including 5.3.2) lets any remote attacker without credentials or user interaction inject arbitrary SQL through the plugin's request handling, giving high confidentiality impact with limited integrity impact and no availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N per independent assessment; the CVE record publishes a 9.3 score with a scope-changed vector). Because WooCommerce Appointments is a commercial paid booking add-on that must be licensed and activated on top of WooCommerce, exposure is confined to that subset of WooCommerce stores running a vulnerable version rather than the WordPress install base at large, which is the main factor keeping this a priority fix rather than an emergency. No public exploit identified at time of analysis.
Denial of service in LZ4 Java (lz4-java) prior to 1.11.4 allows unauthenticated remote attackers to exhaust memory and CPU by supplying a crafted LZ4 frame stream to net.jpountz.lz4.LZ4FrameInputStream in its default concatenated-frame mode; each minimal empty maximum-block-size frame forces readHeader() to allocate two 4 MiB block buffers (roughly 8 MiB per 11 input bytes) with no decompressed output, so decompressed-size limits do not mitigate the issue. The vulnerability is moderate severity (CVSS 5.3, A:L) and is fixed in 1.11.4; readSingleFrame mode is not affected, and no public exploit or KEV entry has been identified at time of analysis.
Extraction of hardcoded credentials and cryptographic keys from the Schmooze dating mobile application lets unauthenticated remote attackers bypass authentication and act as legitimate clients against the vendor's backend and cloud services, with the CPE entry indicating no version is excluded from the flaw. Because the secrets ship inside a publicly distributed client package, any party who obtains the app and decompiles it can recover them without privileges, user interaction, or special server-side conditions (CVSS 4.0 base 9.3, PR:N/UI:N), yielding high confidentiality impact on the client and high confidentiality plus integrity impact on downstream backend/cloud systems. No public exploit code has been identified at time of analysis and the issue has not been added to CISA KEV, but the low barrier to reproduction and the structural nature of CWE-321 keep the practical risk high; the independent assessment notes that impact is bounded to the resources those specific embedded secrets authorize, and that key rotation plus app re-release invalidates previously extracted material.