A use-after-free in the Linux kernel's RDMA/rxe (Soft-RoCE) memory-region re-registration path lets a local attacker who can reach the RDMA user-verbs character device corrupt kernel memory and potentially achieve privilege escalation, scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The bug is reachable only when rxe_rereg_user_mr() is called with both IB_MR_REREG_PD and IB_MR_REREG_ACCESS set while supplying an access bit outside RXE_ACCESS_SUPPORTED_MR, causing the protection domain to be reassigned without the core's use-count being rolled back and leading to a protection domain (and a memory window still referencing it) being freed while in use. Exploitation is realistically narrow: the rdma_rxe module must be loaded and an rxe device configured (not a default configuration), the attacker needs local device access, and an existing memory window must reference the PD; no public exploit code was identified at time of analysis and EPSS is low at 0.16% (4th percentile).
A missing hardware memory-ordering barrier in the Linux kernel's MIPS EYEQ support lets a local, authenticated user crash the kernel on Mobileye EyeQ5 / MIPS I6500 systems. On I6500 cores the lld/scd (LL/SC) instructions provide no ordering guarantees, so arch_cmpxchg() - documented and relied upon as fully ordered - can be reordered and read freed or uninitialized memory, producing a kernel paging fault and oops (observed in anon_pipe_read while stressing an anonymous pipe, whose mutex uses cmpxchg). Exploitation requires CONFIG_EYEQ hardware, local access, and winning a timing/race window; there is no network vector and no impact on x86, ARM, or other MIPS configurations. The fix commit is public and includes a userspace reproducer (pipe_race.c), so publicly available exploit code exists, but no confirmed active exploitation (not in CISA KEV); EPSS is 0.15% (4th percentile), and the observed outcome is a kernel oops rather than a controlled compromise.
A race-condition use-after-free in the Linux kernel's xfrm (IPsec) bundle-creation path allows a local attacker with low privileges to trigger a stale net_device pointer dereference, yielding kernel memory corruption with high confidentiality, integrity, and availability impact. The flaw is reachable when an IPv6 UDP send traverses xfrm_lookup_with_ifid()/bundle creation while a concurrent RTM_DELLINK tears down the underlying net_device - a capability typically obtained by an unprivileged user inside a user+network namespace on kernels that permit unprivileged namespaces. Exploitation is local-only and probabilistic (it depends on winning an inherent timing race and on xfrm/IPsec policies being active), so realistic risk is below the vendor CVSS of 7.8; EPSS is low at 0.15% (4th percentile), no public exploit code was identified at time of analysis, and the issue is not in CISA KEV.
Heap-based buffer overflow in GIMP's DirectDraw Surface (DDS) loader allows attackers to corrupt memory and potentially execute arbitrary code by convincing a user to open a crafted .dds image. The flaw affects GIMP as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10, and requires local file access plus user interaction (opening the malicious file) with no authentication required per the CVSS vector (PR:N). No public exploit code has been identified at time of analysis, and exploitation is limited to the privileges of the user running GIMP.
Memory corruption in Qualcomm Snapdragon graphics command-list processing allows a local low-privileged attacker to corrupt GPU driver memory by submitting draw objects of an incorrect type, scored CVSS 7.8. Exploitation requires the ability to execute code locally on a Snapdragon device and submit graphics command lists to the GPU driver, typically achievable by any installed application or a compromised process with access to the graphics/rendering stack; no user interaction is required. There is no remote network path, and no public exploit identified at time of analysis, though exact affected Snapdragon chipset and driver versions should be confirmed against the Qualcomm October 2026 bulletin.
Buffer overflow in the HPE Aruba ClearPass Policy Manager OnGuard agent lets an authenticated local user execute arbitrary code with elevated privileges or crash the agent, disrupting endpoint posture enforcement. Exploitation requires an existing low-privileged session on the endpoint where the agent is installed and running and cannot be triggered remotely, since the attack vector is local (AV:L, PR:L) while the privilege gain is High across confidentiality, integrity, and availability. HPE has published a vendor advisory, but no public exploit code has been identified at time of analysis; at CVSS 7.8 this is a credible but not emergency-level priority, most relevant to hosts where unprivileged local users and the OnGuard agent coexist.
Local privilege escalation in the HPE Aruba ClearPass Policy Manager Windows client software (CVSS 7.8, High) allows an attacker who already holds a low-privileged account on an affected Windows host to run attacker-supplied code with elevated privileges. The flaw is a missing integrity verification weakness: a file or component consumed by the client is loaded or executed with high privileges without being validated first, so an authenticated local user (PR:L, AV:L, UI:N per the assessed vector) can substitute a crafted component and gain SYSTEM-level execution. No remote path exists, the host must have the ClearPass Windows client installed, and no public exploit code or active exploitation has been identified at time of analysis; HPE's bulletin hpesbnw05158en_us is the authoritative source for fixed releases and affected version detail.
Local privilege escalation in the HPE/Aruba ClearPass Policy Manager OnGuard Linux agent lets a user who already holds a low-privileged account on a managed Linux endpoint elevate to root, rated CVSS 3.1 base 7.8 (HIGH). Exploitation is local only (AV:L), requires an existing foothold on the host (PR:L), needs no user interaction, and yields full confidentiality, integrity, and availability impact once root is obtained; Windows and macOS clients, and Linux hosts without the OnGuard agent, are out of scope per the vendor report. No CISA KEV listing, public proof-of-concept, or EPSS score was supplied with the available intelligence, so the current status is no public exploit identified at time of analysis, and the practical exposure is limited to environments that deploy the OnGuard Linux agent to endpoints where an attacker can first obtain a local unprivileged account.
Memory corruption - specifically a use-after-free (CWE-416) - in Qualcomm Snapdragon components lets a locally-positioned attacker holding low privileges corrupt memory while the platform processes service requests, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not remote: the attacker must already have a foothold on the device, such as a malicious or compromised application capable of reaching the affected Qualcomm service interface, and no user interaction is needed once that foothold exists. No public exploit code has been identified and the issue is not confirmed actively exploited (CISA KEV) at time of analysis, and because the available data does not name the specific service, chipset model, or configuration, the precise triggering interface should be verified against the Qualcomm October 2026 security bulletin.
Memory corruption in Qualcomm Snapdragon system service routines allows a locally installed, low-privileged application to trigger a use-after-free by supplying a malformed input buffer, potentially achieving code execution at the privilege level of the affected service and thereby compromising confidentiality, integrity, and availability. The flaw is scored CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is access-gated: the attacker must already be executing code on the device with low privileges and must be able to reach and invoke the vulnerable routine - there is no remote or network vector, and no user interaction is required once that code runs. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; reliable exploitation would generally require heap grooming of the target service, and actual exposure depends on the specific Snapdragon chipset and firmware build listed in Qualcomm's October 2026 security bulletin.
Memory corruption via a use-after-free in the FastRPC implementation on Qualcomm Snapdragon platforms allows a local attacker with low-privilege code execution to escalate privileges and compromise confidentiality, integrity, and availability of the affected device. Triggering the bug requires a pre-existing foothold - code able to open the FastRPC driver interface and drive DSP invocations - plus concurrent asynchronous threads that race shared performance counter data, so successful exploitation depends on winning a timing window rather than a deterministic primitive. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV; because the vector is local-only (AV:L) with no network reachability, this is a genuine but not emergency-grade priority.
Use-after-free memory corruption in Qualcomm Snapdragon components allows a local, low-privileged attacker who already holds code execution on the device - for example through a malicious or compromised app - to corrupt memory and potentially achieve code execution or privilege escalation in the context of the affected component, with high confidentiality, integrity, and availability impact. Triggering the flaw requires winning a race between concurrent operations that access and modify geographic mapping data without proper synchronization, a timing dependency our assessment scores as AC:H rather than the base AC:L, which makes reliable exploitation non-deterministic. No user interaction is required and there is no remote or network path to the flaw; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Use-after-free memory corruption affecting Qualcomm Snapdragon platforms lets a local, low-privileged attacker (PR:L, AV:L, UI:N) trigger concurrent operations on shared memory page lists that are not properly synchronized, potentially reusing freed memory and gaining high impact to confidentiality, integrity, and availability. Because the root cause is a race condition (CWE-416), exploitation is timing-dependent and may require repeated attempts; the attacker must already have code running on the device, so there is no remote or network attack path. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and the vendor advisory is the October 2026 Qualcomm security bulletin. Note that the independent assessment rates this as AC:H (high attack complexity; score 7.0) rather than the submitted CVSS 7.8 with AC:L, reflecting the difficulty of reliably winning the race.
Memory corruption in the Qualcomm Snapdragon boot chain allows an attacker who already controls the non-secure loader to rewrite page tables during the narrow window before secure memory is initialized, corrupting memory used by secure-world setup and bypassing an authorization boundary (CWE-862) with high confidentiality, integrity, and availability impact. Exploitation is strictly local (AV:L) and requires pre-existing privilege in the boot chain (PR:L), with no remote or unauthenticated path, which limits this to attackers who have already compromised or can influence the device boot process. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Qualcomm published the fix details in its October 2026 security bulletin.
Attacker-controlled pointer dereference in AMD's ROCm Communication Collectives Library (RCCL) can escalate to remote code execution when a compromised peer rank - or a network-adjacent attacker on the collective fabric - participates in a multi-GPU or multi-node distributed workload. The defect (CWE-822, untrusted pointer dereference) affects RCCL running on AMD Instinct MI200/MI300/MI350-class accelerators and carries a CVSS 4.0 base score of 7.7 (vector AV:N/AC:H/AT:N/PR:L/UI:N, High confidentiality/integrity/availability), mapping to an assessed CVSS 3.1 of AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Exploitation is not confirmed as active (CVE is not in CISA KEV) and no public exploit code has been identified at time of analysis; the attack requires a pre-existing foothold as a peer rank inside the collective group rather than anonymous internet access, so this is a moderate-priority issue for distributed AMD GPU deployments rather than an internet-wide emergency.
Arbitrary file deletion in Jobs for WordPress 2.8.2 and earlier allows authenticated Contributor-level users to delete arbitrary files via a path traversal flaw (CWE-22). The vulnerability is network-reachable, requires no user interaction, and has a CVSS score of 7.7 with high availability impact but no confidentiality or integrity impact. No public exploit has been identified at the time of analysis, and no vendor-released patch is available.
Dell Container Storage Modules releases before 1.18.0 write sensitive information into their log files, so a low-privileged, authenticated remote user who can read those logs can obtain credentials, tokens, or other confidential data recorded there. The issue carries a CVSS 3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), inflated primarily by the scope change to components beyond the vulnerable module rather than by ease of mass exploitation. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), so the practical risk is bounded by the prerequisite of existing low-privileged authentication plus read access to the module's log output.
Server-side request forgery in the Backstage @backstage/plugin-techdocs-node package (0.11.12 through 1.14.6, and 1.15.0 through 1.15.4) lets an authenticated user who controls a TechDocs source repository have documentation builds fetch and publish content from network locations reachable by the build environment. The issue is rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), reflecting a confidentiality-only, scope-changing impact that requires repo write access and a build topology where internal endpoints are reachable without token or special-header protections; newer cloud metadata services that require tokens or custom headers are explicitly not directly accessible. Vendor-released patches exist in @backstage/plugin-techdocs-node 1.14.7 and 1.15.5 (and in Backstage releases v1.50.6, v1.54.8, v1.55.0); no public exploit identified at time of analysis.
Improper URL validation in the @backstage/plugin-catalog-backend package of Backstage prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1 lets an authenticated user with catalog-write capability craft catalog entities whose placeholder directives ($text, $json, $yaml) resolve to files in a repository other than the entity's own source repo. Because the placeholder resolver executes with the backend's configured SCM integration credentials, the attacker can read content the resolver is authorized to fetch but that the user should not see, giving a confidentiality impact rated 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Exploitation requires a valid authenticated account plus a deployment where integrations can reach the targeted external resource - the vendor scopes impact to 'certain configurations,' so hardened single-repo or tightly scoped integration setups may not be affected; no public exploit code was identified at time of analysis.
Arbitrary file write through path traversal in lrzsz before 0.13.0 lets a malicious ZMODEM sender place files outside the current directory - including by absolute pathname - when the victim runs the lrz receive utility in restricted mode. Exploitation requires the victim to actively initiate or accept a ZMODEM transfer (UI:P/AT:P), the binary to be built without the --enable-pubdir option (the default, since only that build hardens checkpath()), and the attacker to control the sending side; the primitive is limited to files the receiving user account can already write, though overwriting SSH keys, shell profiles, or cron entries can extend impact. No public exploit identified at time of analysis, and the risk is a conditional integrity/availability issue rather than a mass-exploitation emergency given the user-interaction and build-configuration prerequisites.
Server-side request forgery in Gitea 1.27.3 and earlier allows an authenticated user with permission to start repository migrations to reach internal services by pointing an allow-listed migration hostname at a loopback or private address, bypassing the ALLOW_LOCALNETWORKS=false restriction. Exploitation requires the optional [migrations] ALLOWED_DOMAINS allow-list to be configured (default installations are unaffected by this specific bypass), valid migration rights (CVSS PR:L, authenticated), and attacker control over DNS resolution for a hostname already present in that allow-list. No public exploit code or confirmed active exploitation was identified at time of analysis; the root-cause class is network-restriction bypass (SSRF-style) rather than an authentication bypass, despite that tag in the source data.
Unauthenticated adjacent-network attackers can crash or potentially execute arbitrary code on Arista Wi-Fi access points when the packet-capture service is running in an uncommon non-default streaming mode. The flaw is a stack-based buffer overflow (CWE-121) triggered by a crafted packet to the capture service; no authentication or user interaction is required, but the attacker must have Layer-2/adjacent access and the target must already have the non-default streaming mode enabled, so default-configured devices are not exposed. No public exploit code was identified at time of analysis, and this is a conditional priority rather than a drop-everything emergency because exploitation depends on that deliberately enabled configuration.
OS command injection in lrzsz before 0.13.0 allows a remote ZMODEM/YMODEM sender to execute arbitrary shell commands as the receiving user by supplying a crafted filename during an lrz receive. The flaw is reachable only when lrz is invoked under a suffixed/alias name such as lrztar and operates in pipe mode, where procheader() in src/lrz.c forwards the unescaped filename to popen() and shell metacharacters are interpreted. Successful exploitation requires the victim to accept or initiate the transfer (UI:P) and yields command execution at the receiver's privilege level only (no cross-system impact per SC:N/SI:N/SA:N); no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-supplied CVSS 4.0 score is 7.7 (High) while an independent assessment rates it CVSS 3.1 8.1 with AC:H given the non-default invocation and interaction prerequisites.
Improper authentication in the OAuth token endpoint of Cloud Foundry UAA (CWE-287) enables an authenticated remote attacker to exchange a low-privileged user access token for a fully-privileged client_credentials token, bypassing the need for the client secret. The attacker must possess a valid user token for an OAuth client that is configured to support both a public authorization_code+PKCE flow and the client_credentials grant on the same client_id, a non-default combination; the resulting client token carries the client's full authorities (e.g., clients.write), allowing creation of arbitrary OAuth clients. No public exploit code has been identified at time of analysis, and exploitation requires authenticated user access, with impact scaling to the authorities assigned to the affected client.
Web origin policy bypass in Google Chrome's Navigation component on iOS allows a remote, unauthenticated attacker to escape intended origin boundaries and reach a privileged page when a victim opens a crafted HTML page. Exploitation is constrained by two factors: the mandatory user interaction (CVSS UI:R - the victim must actively load the malicious page) and the narrow platform scope, since only the iOS build of Chrome is affected rather than Chrome on other operating systems. Risk signals are modest - EPSS is 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis - and Google has shipped a fix, so this is a moderate-priority issue rather than an urgent one.
Information disclosure in JetBrains TeamCity before 2026.2.1 allows a crafted Git submodule URL to make the server read files from local repositories reachable by the TeamCity service account, exposing source code and other local repository contents. The supplied NVD vector rates this as network-reachable without privileges (PR:N), but our assessment applies a low-privileged precondition (PR:L), because the attacker must be able to influence a submodule URL - typically by committing a malicious .gitmodules file to a repository TeamCity checks out, or by controlling a VCS root - on an instance configured to resolve Git submodules. Impact is confidentiality-only with no integrity or availability effect; EPSS is low (0.62%, 48th percentile), SSVC records no exploitation activity, and no public exploit code has been identified at time of analysis.
Argument injection in Microsoft UFO's run_shell tool lets an attacker who can influence an agent workflow execute arbitrary code as the desktop user on Windows systems running UFO prior to 3.0.9. The tool validates only the first token of the bash_command parameter and permits explorer.exe, which then delegates its path argument to ShellExecute - so a crafted call such as explorer.exe "C:\Users\victim\payload.bat" launches an attacker-controlled executable or script even though the subprocess is spawned with shell=False. Exploitation requires user interaction (an active agent workflow on Windows and a successfully induced tool call), and successful execution gives the attacker access to the victim user's files, tokens, and sessions. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; the vendor-released patch is version 3.0.9.
Hard-coded credentials embedded in the csm-docs component of Dell Container Storage Modules (CSM) before version 1.18.0 expose sensitive information to remote attackers who can reach the affected service over the network. Per the CVSS vector (PR:N/UI:N), no legitimate authentication or user interaction is required once a network path exists, although the attacker must know the embedded credentials, and impact is confined to confidentiality (C:H with I:N/A:N). No public exploit code or active exploitation has been identified at time of analysis (SSVC Exploitation: none, not in CISA KEV); EPSS is low at 0.54% (44th percentile), and Dell has released a fixed version, CSM 1.18.0.
Insufficient validation in the Single Sign-On (SSO) login flow of Arista CloudVision lets a remote, unauthenticated attacker craft a login URL that, once clicked by a user, causes the identity provider to send IdP-issued authentication material to an attacker-controlled URL rather than to CloudVision (CWE-601 open redirect), resulting in credential/assertion theft and potential account impersonation. The vulnerability is rated High (vendor CVSS 4.0 7.6; assessed CVSS 3.1 7.6, AV:N/AC:H/PR:N/UI:R with High confidentiality and integrity impact) and only affects deployments where CloudVision SSO is configured and in use. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation depends on victim interaction plus specific SSO/IdP configuration and the attacker's ability to produce a redirect accepted by the deployment.
Denial of service in the RabbitMQ Java client (com.rabbitmq:amqp-client / rabbitmq-java-client) prior to the fixed release allows a single small, malformed JSON-RPC message body to permanently hang or crash a JVM. The deprecated com.rabbitmq.tools.jsonrpc tooling - JsonRpcServer and JsonRpcClient - falls back to DefaultJsonRpcMapper when no mapper is supplied, and that mapper hands raw message bodies straight to JSONReader.read(), whose string and comment scanners fail to stop at CharacterIterator.DONE. An input truncated inside a quoted string drives the parser into an unending append loop that exhausts the heap with OutOfMemoryError, while an unterminated // line comment pins a thread at 100% CPU indefinitely; neither condition is recoverable per request. Publicly available exploit code exists (a proof-of-concept is included in the vendor advisory) and the CVE is tracked by CISA SSVC with Exploitation=poc and Technical Impact=partial, though EPSS probability is low at roughly 0.49% (40th percentile) and no CISA KEV listing is present. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates a network-reachable, unauthenticated availability-only impact.
Unauthenticated broken authentication in the Graphina - Elementor Charts and Graphs WordPress plugin affects versions 3.1.12 and earlier, allowing network-reachable attackers to reach functionality that should require authentication and, per the assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5), to obtain high-impact confidential information without any credentials or user interaction. Because the vector carries PR:N, exploitation requires no authentication and no special conditions beyond the plugin being installed, active, and at a vulnerable version - in practice this means a site running Elementor with the affected Graphina release. Only confidentiality is impacted; there is no integrity or availability effect per the assessed vector, and no public exploit code or CISA KEV entry was identified in the available intelligence, so no public exploit is identified at time of analysis. The precise vulnerable feature or endpoint is not described in the supplied data and should be confirmed against the Patchstack advisory.
Heap buffer overflow in SixLabors ImageSharp (all versions from 3.0.0 up to but excluding 4.1.1) is triggered when the library decodes a strip-organized TIFF file that uses CCITT Group 3 (T4) or Modified Huffman compression: attacker-controlled run lengths are written into the strip buffer before the current row width is validated, corrupting heap memory and terminating the host process. Exploitation is remote and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), but the realistic outcome is denial of service - a crash - rather than data disclosure or modification, and no public exploit code was identified at time of analysis. The issue is fixed in ImageSharp 4.1.1 via the vendor advisory GHSA-jj3q-cwqj-842r and pull request #3176.
Unauthenticated sensitive data exposure in the WordPress plugin SiteVault - Backup, Restore, Migration & Cloning (by royal_plugins) at version 1.5.17 and earlier lets remote attackers retrieve sensitive information from affected sites without authentication, user interaction, or special configuration, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5 HIGH). Only sites with the plugin installed and active at or below 1.5.17 are exposed; the impact is high confidentiality loss with no integrity or availability effect, consistent with the CWE-201 sensitive-data-exposure classification reported by Patchstack. No public exploit code has been identified at time of analysis, no CISA KEV listing applies, and no EPSS score was supplied, so the practical risk is driven mainly by the plugin's install base and the ease of unauthenticated, low-complexity remote exploitation.
Unauthenticated attackers can reach functionality in the WordPress plugin Sermon'e (vendor beplusthemes) at version 1.0.2 and earlier that performs no authorization check, exposing data the plugin is meant to protect. The flaw is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning it is remotely reachable with no credentials and no user interaction, and it affects confidentiality only while leaving integrity and availability intact; exploitation requires only that the plugin be installed and active. There is no public exploit identified at time of analysis and the plugin is not listed in CISA KEV, so the practical risk is driven by deployment scope rather than by active exploitation; the specific vulnerable endpoint is not described in the available data and should be confirmed from the Patchstack advisory.
Unauthenticated information disclosure in the WooCommerce Multivendor Marketplace - REST API plugin (versions up to 1.6.3) allows remote attackers to bypass access controls and read sensitive data from affected WordPress sites. The vulnerability has a CVSS score of 7.5 (CWE-862, missing authorization) and requires no authentication or user interaction. No public exploit code has been identified at time of analysis, and the overall risk is assessed as a credible but moderate-priority issue due to its confidentiality-only impact and the need for the specific plugin to be installed.
Out-of-bounds heap writes in the ImageSharp TIFF CCITT Group 4 (T6) fax encoder, affecting versions 2.1.0 through 4.1.1, allow attacker-supplied image data to corrupt memory and terminate the process. The encoder allocates only Width × rowsPerStrip bytes for a strip while T6BitCompressor.CompressStrip can emit encoded row data plus two 12-bit end-of-facsimile-block codes beyond that capacity, and TiffCcittCompressor.WriteCode performs the writes without bounds checks; a decode-and-re-encode flow that inherits TiffCompression.CcittGroup4Fax and one-bit bilevel metadata from the input reaches this path, giving unauthenticated remote attackers a denial-of-service primitive (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H). Impact is confined to availability - no confidentiality or integrity effect - and there is no public exploit code identified at time of analysis and no CISA KEV listing; the issue is fixed in version 4.1.2.
Denial of service in SixLabors ImageSharp (2.0.0 up to but not including 4.1.2) lets a remote, unauthenticated attacker terminate an image-processing process by supplying a crafted 32-bit floating-point TIFF. The attack only succeeds when the consuming application decodes that TIFF into an Image<HalfVector4> and then applies the global HistogramEqualization processor, at which point a non-finite or out-of-range BT.709 luminance value is consumed as an unchecked histogram offset in GrayscaleLevelsRowOperation.Invoke, producing an out-of-bounds access (CWE-787) and process termination. Impact is availability-only (CVSS 7.5, C:N/I:N/A:H); Adaptive Histogram Equalization and AutoLevel are explicitly unaffected, and no public exploit code or CISA KEV listing was identified at time of analysis.
Memory corruption in SixLabors ImageSharp 4.0.0 through 4.1.1 allows an unauthenticated remote attacker to crash or destabilize a host process by supplying an image whose embedded ICC profile declares more than four LUT16 input/output channels, causing out-of-bounds writes past a four-float internal buffer. The flaw is only reachable when an application has explicitly set DecoderOptions.ColorProfileHandling to Convert, since the default Preserve mode does not run ICC conversion; the independent assessment scores it CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting an availability-only impact rather than data disclosure or modification. No public exploit code was identified at time of analysis, and the issue is fixed in version 4.1.2.
TIFF encoding in SixLabors ImageSharp 2.0.0 through 4.1.1 can write past the end of an undersized compressed-data buffer when CCITT Group 3 fax compression is used on narrow 1-bit images, corrupting process memory and typically terminating the process. The flaw is reachable by remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) only when the host application either explicitly selects TiffCompression.CcittGroup3Fax during encoding or inherits that compression setting from attacker-supplied TIFF metadata in a decode-and-re-encode flow; the impact is limited to availability (denial of service), with no confidentiality or integrity loss assessed. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version, 4.1.2.
Missing authorization checks in the PayPlug for WooCommerce (Official) WordPress plugin at version 3.1.0 and earlier let unauthenticated remote attackers reach plugin functionality that should require privileged access, degrading site integrity (CVSS 3.1 base 7.5, HIGH). The assessed vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N confirms the flaw is network-reachable, low-complexity, and requires no authentication or user interaction, and it affects WooCommerce stores running this PayPlug payment-gateway plugin within the vulnerable range; exploitation is constrained only by the need for the plugin to be installed and active. No public exploit identified at time of analysis, and no CISA KEV listing is associated with this CVE, so broad opportunistic scanning rather than confirmed active exploitation is the realistic near-term concern.
Unauthenticated sensitive data exposure in the Snapshotify - All-in-One Backup & Restore & Migrate WordPress plugin (versions 1.3.2 and earlier) allows remote attackers to retrieve information the plugin transmits without adequate protection, yielding a high confidentiality impact with no integrity or availability impact. The flaw is remotely reachable, requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5), and is rooted in CWE-201, the insertion of sensitive information into sent data. Exposure is limited to WordPress sites that have this specific backup/restore/migrate plugin installed and active; no public exploit identified at time of analysis, and no EPSS, KEV or proof-of-concept data was provided with the source material.
Unauthenticated information disclosure in the Norvis Backup WordPress plugin (versions up to and including 1.1.0) allows any remote attacker to retrieve sensitive site data without credentials, user interaction, or special configuration, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N with high confidentiality impact (base 7.5 HIGH) and no integrity or availability impact. The flaw is a CWE-201 sensitive-information-in-sent-data issue in a low-prevalence backup plugin, so exposure is limited to sites actually running this plugin at a vulnerable version. There is no public exploit identified at time of analysis, and no vendor-released patch version was confirmed in the available data; the sole source is the Patchstack advisory.
Unauthenticated sensitive data exposure in the Museder RestoreOne WordPress plugin (versions up to 2.7.276) allows remote attackers to access confidential information without authentication. With a CVSS score of 7.5 (High), the flaw requires no user interaction and has high confidentiality impact (C:H) but no integrity or availability effect. No public exploit code or active exploitation has been identified at time of analysis, and the risk is confined to WordPress sites with this specific plugin installed.
Unauthenticated sensitive data exposure in SafeSnap - Verified WordPress Backup & Restore 2.1.2 and earlier allows remote attackers to retrieve confidential information from affected WordPress sites. The flaw, tracked as CVE-2026-41559 and categorized as CWE-201 (insertion of sensitive information into sent data), has a CVSS base score of 7.5 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact without requiring authentication or user interaction. No public exploit code or active exploitation was identified at time of analysis, but the low complexity and network reachability make timely patching important.
Unauthenticated SQL injection in WooCommerce Lottery (WPGenie) versions up to and including 2.2.9 lets a remote attacker who can reach the plugin's lottery endpoint inject SQL against the underlying WordPress database, reading arbitrary data from it. No credentials or user interaction are required (PR:N, UI:N), and the vendor-assigned vector notes high confidentiality impact with limited availability effect, though its AC:H rating alongside our assessed AC:L indicates the reliability of the injection depends on conditions at the injection point that the advisory does not fully enumerate. Exploitation is narrow in practice because only WordPress sites running both WooCommerce and this specific niche paid add-on are exposed; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Unauthenticated sensitive data exposure in the Groundhogg WordPress plugin versions 4.8.3 and earlier allows remote attackers to retrieve confidential information from affected sites. Tracked as CVE-2026-104385 with a CVSS score of 7.5, the flaw requires no authentication or user interaction and can be exploited over the network with low complexity. No public exploit identified at time of analysis, but the high confidentiality impact (CWE-201) makes prompt remediation critical.
Unauthenticated sensitive data exposure in the WordPress plugin Xserver Migrator affects all versions up to and including 1.6.6, allowing any remote attacker to read information the plugin should keep confidential, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Because the vector carries PR:N and UI:N, no account, credentials, or user interaction are required, so an unexposed default installation running the vulnerable version is reachable directly over the network; the flaw carries high confidentiality impact with no integrity or availability effect, matching CWE-497. No public exploit code has been identified at time of analysis and the plugin has not been added to CISA KEV, so this is currently a patch-urgency rather than an active-incident issue; the practical exposure is limited because the plugin is a niche migration utility rather than a widely deployed component.
Unauthenticated remote attackers can access backup data from WordPress sites running the WXD Backup Lite plugin versions 1.0.2 and earlier due to a missing authorization check (CWE-862). The flaw carries a CVSS 3.1 base score of 7.5 (HIGH) with high confidentiality impact only, and exploitation requires no authentication or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the low-complexity nature and unauthenticated access make it a significant risk for affected sites.
Unauthenticated broken access control in the WordPress plugin Advanced Posts Listing - Show Post List Easily (versions 1.0.8 and earlier) lets remote attackers retrieve protected post or listing data without logging in or triggering any user interaction. With a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and CWE-862 missing authorization, the flaw is a confidentiality-only issue: it exposes data but does not allow modification or denial of service. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, and the primary limiting factor is deployment-only sites running this specific, low-footprint plugin are affected.
Unauthenticated, network-reachable requests can abuse a missing authorization check in the Easy Digital Downloads WordPress plugin (versions up to and including 3.7.1) to perform actions that should require a privileged, logged-in user, giving attackers an integrity-only impact consistent with the 7.5 CVSS 3.1 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Any WordPress site with the plugin installed and active at or below 3.7.1 is in scope, and exploitation requires no credentials, no privileges, and no victim interaction; the trade-off is that no data disclosure or denial of service is expected, so the realistic blast radius is unauthorized modification of site/e-commerce data rather than full compromise. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and the specific protected action that is exposed is not detailed in the available intelligence, so affected versions should be treated as unauthorized-write capable until a fix is confirmed.