A transient denial-of-service condition affects Qualcomm Snapdragon firmware when it processes a continuous receive command containing a zero-sized global configuration override, causing a buffer over-read that temporarily disrupts the device. Per the independent assessment, exploitation requires an attacker to reach the firmware command-processing interface, likely from adjacent radio range or a position on the relevant communication channel, with no authentication or user interaction required and low complexity. The impact is limited to a self-recovering availability loss, with no data exposure or code execution, and no public exploit has been identified at time of analysis; risk is moderate rather than top-tier urgency.
Authentication bypass in WP Synchro (WP Migration Plugin DB & Files) through version 1.16.1 lets a low-privilege subscriber-level account defeat the plugin's two-factor authentication enforcement, resulting in high confidentiality, integrity, and availability impact on the affected WordPress site. The flaw is network-reachable but requires an existing authenticated account (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and carries high attack complexity, so it is not exploitable by a fully unauthenticated attacker and in practice favors sites that permit open user registration. No public exploit code was identified at time of analysis, and this is assessed as a moderate-priority issue rather than an urgent one.
Unauthenticated sensitive data exposure in the Sitemovr WordPress plugin versions 1.0.1 and earlier allows remote attackers to retrieve undisclosed sensitive information from affected sites without authentication, user interaction, or non-default configuration, per the CVSS vector (7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exploitation is limited mainly by deployment: only WordPress sites that use this obscure plugin and have not updated past 1.0.1 are exposed, and the Patchstack advisory does not specify exactly which data or endpoint leaks. No public exploit code was identified at time of analysis, and the independent assessment rates the available signals as consistent but thin.
Denial of service in Mozilla node-convict 6.2.2 and later allows remote, unauthenticated attackers to overwrite core JavaScript methods on the global Object function via config.set(), causing persistent process-wide failure that requires a restart. The flaw arises because the library's prototype-pollution filters only block constructor.prototype.* and __proto__.* key paths, while a key such as constructor.assign is resolved by walk() to the global Object constructor, permitting tampering with methods like Object.assign. Exploitation is not automatic: it requires an application endpoint or handler that forwards attacker-controlled property names directly into config.set(), so only configurations driven by untrusted keys are exposed; no public exploit code has been identified and EPSS is low (0.24%, 14th percentile), with CISA SSVC recording Exploitation: none and no KEV listing.
Use-after-free in the Linux kernel's CIFS/SMB client can be triggered when the cifs_demultiplex_thread exits while a reconnect work item is still queued on cifsiod_wq, allowing smb2_reconnect_server() to read a server structure that clean_demultiplex_info() has already freed with kfree_sensitive(). The bug is reached unauthenticated per the vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R), but it requires an active CIFS/SMB mount to an attacker-controlled or repeatedly failing SMB server plus a narrow race at connection teardown, which is why the assessed impact is LOW in practice even though the published base score is 7.5. EPSS is 0.21% (10th percentile), no public exploit has been identified at time of analysis, and vendor fixes exist in the 6.6.158, 6.12.112, 6.18.54 and 7.2.8 stable releases.
A use-after-free race in the Linux kernel CIFS/SMB client (cifs_try_adding_channels()) allows a malicious or compromised SMB3 multichannel server to corrupt kernel memory on any client that mounts a share with multichannel enabled, primarily causing a kernel crash (high availability impact) and, secondarily, limited disclosure of freed memory contents. The client's interface iteration caches the next ses->iface_list entry under iface_lock, then drops that lock for the full duration of cifs_ses_add_channel(); a concurrent SMB3_request_interfaces()/parse_server_interfaces() refresh can mark interfaces inactive and kfree() that cached entry before the iterator advances, after which the loop dereferences freed memory. Reaching the window requires the client to have established an SMB3 multichannel session against an attacker-influenced server (CVSS vector PR:N but UI:R, AC:H), and no public exploit code has been identified at time of analysis; EPSS is 0.21% (10th percentile), so exploitation is opportunistic rather than broadly observed.
Fluent Affiliate Pro, a WordPress affiliate-management plugin maintained by WP Manage Ninja, fails to enforce authorization checks on certain requests in versions 1.6.4 and earlier, allowing unauthenticated remote attackers to perform actions they should not be permitted to perform (CWE-862). The flaw carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning exploitation requires no credentials, no user interaction, and no special configuration, but its impact is confined to integrity - attackers can modify affiliate or plugin data, with no confidentiality or availability impact assessed. No public exploit code has been identified and no CISA KEV entry exists at the time of analysis, so the practical risk is driven mainly by whether a given site runs this specific plugin at a vulnerable version, which limits the real-world attack surface.
Unauthenticated broken access control in Morning for WooCommerce (plugin slug wc-gateway-greeninvoice) 2.4.1 and earlier allows remote attackers to reach plugin functionality that should require authorization, undermining the integrity of the store's invoicing/gateway data. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5 High) confirms the flaw is network-reachable with no credentials and no user interaction, while bounding impact to integrity alone - no confidentiality or availability effect is assessed. Exposure is confined to WooCommerce stores that specifically deploy this Green Invoice/Morning gateway plugin; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated broken access control in FluentBooking Pro versions prior to 2.5.0 allows remote attackers to bypass authorization checks and modify booking-related data or functionality, as scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with high integrity impact but no confidentiality or availability impact. The flaw requires no authentication and no user interaction, and can be exploited against any internet-reachable WordPress site running the vulnerable paid plugin. No public exploit code was identified at time of analysis, and a vendor patch is available in version 2.5.0.
A protocol-version negotiation mismatch during RDS-over-RDMA connection setup in the Linux kernel deadlocks the kernel by making an RDMA-CM event handler wait on itself, permanently stalling the RDS connection workqueues and causing denial of service. Only hosts with the RDS stack loaded and bound to an RDMA transport (InfiniBand, RoCE, or iWARP) that expose a reachable RDMA-CM listener are affected; unauthenticated peers able to establish an RDMA-CM connection - typically from the same RDMA fabric or subnet (assessed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - can trigger it by negotiating a protocol version older than RDS_PROTOCOL_COMPAT_VERSION. Impact is availability-only (C:N/I:N/A:H); EPSS is low at 0.18% (7th percentile), no public exploit code has been identified at time of analysis, and vendor patches are available for the affected stable branches.
A possible kernel deadlock in the Linux kernel's Bluetooth RFCOMM listener teardown path can be reached by an unauthenticated attacker within Bluetooth radio range (AV:A, PR:N per the vector) who races a new incoming RFCOMM connection against the cleanup of a listening socket. Triggering requires Bluetooth to be enabled on the target, a live application listening on an RFCOMM channel, proximity, and a narrow timing window (AC:H); the condition was reported by lockdep as a POSSIBLE lock-order inversion between a child socket lock and rfcomm_mutex, not a confirmed and reliably reproducible crash, and the assessed impact is availability only (C:N/I:N/A:H). No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is very low at 0.18% (7th percentile); vendors have released fixes.
Kernel memory corruption and crash in the Linux kernel's SMB/CIFS client (cifs.ko) arises from a missing list-head initialization in TCP_Server_Info.rlist combined with a race in cifs_signal_cifsd_for_reconnect(). Because rlist is allocated with kzalloc, its ->next and ->prev pointers are NULL rather than self-referential, so list_empty() always returns false and list_add() dereferences a NULL ->prev; concurrently, multiple cifsd threads can add the same server's rlist node twice, corrupting the list. Only systems actively using the kernel SMB/CIFS client with a mounted share and a reconnect event are affected; the authoritative assessment scores this CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H, i.e. unauthenticated but requiring user interaction and a hard-to-win timing race, with impact limited to a kernel crash (denial of service) rather than code execution or data theft. EPSS is low at 0.18% (6th percentile), and no public exploit has been identified at time of analysis.
Denial of service in Gitea affects instances running 1.27.3 and earlier that have Actions enabled: a user who can open a pull request from a fork can submit a small workflow file whose static strategy.matrix expands to an enormous number of job combinations, exhausting server memory and potentially killing the Gitea process. Because the Cartesian-product expansion occurs at run-creation time, before the fork pull-request approval gate is enforced, no maintainer approval and no self-hosted runner are required to trigger the resource consumption. Gitea 28.0.0 rejects static matrices exceeding 256 combinations before expansion; EPSS is 0.16% (4th percentile), there is no CISA KEV entry, and no public exploit code has been identified at time of analysis. This is a moderate, not top-tier, priority.
Gitea instances up to and including 1.27.3 can be crashed by a repository administrator who configures an external issue tracker link format whose regular expression uses alternation with separate capture groups; the resulting invalid slice index triggers a Go runtime panic that terminates the Gitea process, and because rendering is triggered on later page views (for example a README containing matching text), the crash hits every user of the instance, not just the configurator. Exploitation requires an actor able to edit a repository's external issue tracker settings - on instances that permit self-service repository creation this effectively means any authenticated user on their own repository - so the practical barrier is configuration privilege rather than anonymity. Independent signals are moderate and partly conflicting: EPSS is only 0.16% (4th percentile), CISA SSVC rates exploitation as 'none' with partial technical impact, no CISA KEV listing or public exploit code has been identified at time of analysis, and a vendor fix ships in Gitea 28.0.0.
Authenticated users who are able to open a pull request from a fork can cancel trusted, in-progress Gitea Actions runs in the base repository when those runs share a workflow-level concurrency group with cancel-in-progress enabled, because the cancellation logic does not check whether the newer run still needs approval before terminating the older ones. The attacker runs no code and gains no data access, but on self-hosted runners the interruption can abort an in-flight deployment and leave partial state behind. No public exploit code has been identified at time of analysis and EPSS is low at 0.16% (4th percentile), consistent with a targeted, configuration-dependent CI-disruption issue rather than a broad default-config exposure.
Server-side request forgery in Gitea 1.27.3 and earlier lets a user who can start a repository migration or mirror reach blocked internal addresses: Gitea validates the destination hostname against its egress allow/block lists before invoking Git, but the Git subprocess resolves the hostname independently when it actually connects, so an attacker who controls the destination's DNS can re-point the name from an allowed address to an internal one between validation and connection. Exploitation requires both the ability to initiate a migration (on a default install this means a logged-in account, and instances with open registration make it effectively unauthenticated) and control of authoritative DNS with suitably short TTLs, which is why the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N rather than the vendor's 7.5. No public exploit code has been identified at time of analysis, EPSS is only 0.15% (3rd percentile), and SSVC records Exploitation: none with partial technical impact; the vendor-released fix is Gitea 28.0.0.
Server-side request forgery in Gitea (versions up to and including 1.27.3) lets a repository administrator bypass the configured outbound host policy: Gitea validates the initial remote URL for push mirrors, wiki remote checks, and migrated pull-request heads, but the raw Git operation that follows will chase an HTTP redirect to an address the policy would otherwise block, causing the server's Git client to reach internal services. Exploitation is meaningfully constrained - it requires repository-administrator privileges, a restrictive egress allow-list must actually be configured, and the attacker must control or locate an allow-listed endpoint that redirects to the desired internal target - so the realized impact is bounded by which internal services are reachable from the Gitea host. EPSS is 0.15% (3rd percentile), no public exploit identified at time of analysis, and there is no CISA KEV listing, so exploitation appears opportunistic and low-volume rather than confirmed actively exploited. Note that the published CVSS vector (7.5, PR:N) overstates the privilege requirement; our assessment rates it PR:L with limited confidentiality and integrity impact.
Heap corruption and process termination in SixLabors ImageSharp 3.0.0 through 4.1.0 can be triggered by decoding a crafted tiled TIFF that uses CCITT fax compression (T4, T6, or Modified Huffman) with a TileWidth smaller than ImageWidth. Because DestinationBuffer is sized by TileWidth while TiffDecompressorsFactory.Create instantiates the fax decompressor with the full frame width, attacker-controlled scanlines overflow the tile buffer, producing out-of-bounds writes and CWE-787 heap corruption. The flaw is remotely reachable, requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5), and is scored availability-only. No public exploit code has been identified at time of analysis, and the issue is fixed in version 4.1.1.
Credential disclosure in the MCP TypeScript SDK OAuth client (npm @modelcontextprotocol/sdk 1.12.0 through 1.30.1, and @modelcontextprotocol/client 2.0.0 through 2.1.0 in narrower configurations) lets a malicious or compromised MCP server direct the client's stored OAuth credentials to an authorization server of the attacker's choosing. Because saved credentials were never bound to the authorization server that issued them, a remote, unauthenticated attacker who controls or compromises the MCP server the victim connects to can silently receive a stored refresh_token and client_secret - or a bundled provider's client_secret or signed assertion - yielding full confidentiality impact (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, per the PR:N vector the request is unauthenticated). No public exploit code and no confirmed active exploitation were identified at time of analysis; exploitation requires the victim application to use the SDK's OAuth client over HTTP and to connect to an MCP server it does not fully trust while holding credentials for a legitimate authorization server.
Insecure deserialization in the TrueLayer Magento 2 Plugin's Psr16CacheAdapter component allows an attacker who already has write access to the Magento cache backend (Redis or Memcached) to achieve arbitrary code execution via crafted PHP objects. The flaw arises from PHP's unserialize() being called without class restrictions, and exploitation requires both cache-write capability-obtainable through local filesystem access or an exposed cache service-and the presence of a usable gadget chain in the deployed Magento/Adobe Commerce environment. Although rated CVSS 7.5, real-world risk is materially lower because the attack preconditions are stringent; no public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited.
Unauthenticated directory traversal in kkFileView 5.0.0 through 5.0.2 lets remote attackers create arbitrary directories and write files outside the intended fileDir root via the fileUpload, createFolder, and existsFile endpoints, which concatenate an attacker-supplied 'path' parameter into the upload base path without any validation. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms that no credentials and no user interaction are needed, and that the impact is integrity-only (C:N/A:N), meaning the attacker can plant content beyond the configured storage root but gains no direct read or availability effect. Exploitation is gated chiefly by exposure rather than configuration - kkFileView is typically deployed as an internal document-preview service - and no public exploit code was identified at time of analysis, so internet-facing, unauthenticated reachability of the upload endpoints is the real-world precondition for mass abuse.
Missing authentication for critical functions in Dell Container Storage Modules' CSI drivers (csi-powerflex, csi-powermax and csi-powerstore) at versions prior to 1.18.0 allows an unauthenticated attacker with adjacent network access to read sensitive information from the Kubernetes storage layer, with no user interaction required (CVSS 7.4, scope-changed, high confidentiality impact only). Affected environments are limited to those that have actually deployed one of these three Dell CSI drivers alongside the corresponding Dell storage array; the vector is AV:A, so the flaw is not reachable from an arbitrary internet host but only from a host on the same logical or physical network segment as the cluster. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none and automatable as no, and EPSS is 0.30% (21st percentile), so this is a moderate-priority hardening item rather than an emergency; a vendor patch is available in 1.18.0.
Improper TLS certificate validation in the Dell Container Storage Modules (CSM) proxy-server before 1.18.0 allows an unauthenticated adjacent-network attacker who can man-in-the-middle TLS traffic to obtain storage backend administrator credentials. The issue is confidentiality-only (C:H/I:N/A:N) and requires an active MITM position on an adjacent network rather than internet reachability; no public exploit code was identified at time of analysis and EPSS is 0.12% (2nd percentile). Dell has released CSM 1.18.0 to address it, so this is a moderate defense-in-depth priority rather than an emergency.
Sandbox escape in Google Chrome on iOS (versions prior to 155.0.8059.39) allows a local attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox via a local program. The flaw is an incorrect reference resolution (CWE-706) in the Passwords component, rated Medium by Chromium and carrying a CVSS 7.4 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code or confirmed active exploitation has been identified at time of analysis; a vendor patch is available.
Unauthenticated requests to the WordPress picu plugin (versions up to and including 3.10.1) can reach plugin functionality that is supposed to be protected by an authorization check, letting any remote visitor perform an action the plugin intended to reserve for a privileged or otherwise authorized user. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, with Low confidentiality, integrity and availability impact and S:U) confirms that no credentials, no user interaction and no non-default configuration are required, so any reachable installation is exposed, though the resulting impact is bounded rather than a full site takeover - the specific protected action gated by the missing check is not identified in the available data. There is no public exploit identified at time of analysis and no CISA KEV listing; real-world risk is constrained mainly by the small install base of this specialized client-proofing plugin and by the Low severity of each impact metric.
Code injection in the Reader Mode feature of Google Chrome on iOS (versions prior to 155.0.8059.39) lets a remote, unauthenticated attacker bypass the web origin policy by convincing a victim to open a crafted HTML page in the browser. The flaw is confined to the iOS build and depends on social engineering to drive the victim to the malicious page, so effective user interaction is required; impact is limited to a partial confidentiality, integrity and availability loss through origin-policy circumvention rather than full system compromise. No public exploit code has been identified at time of analysis, EPSS is a low 0.27% (17th percentile), and the issue is not listed in CISA KEV, so despite the 7.3 High CVSS the real-world priority is low-to-moderate. Google has shipped a vendor patch, fixed in Chrome 155.0.8059.39.
Unauthenticated path traversal in an API endpoint of HPE Aruba ClearPass Policy Manager allows a remote attacker to manipulate authorization logic and be assigned a role they were not intended to hold, yielding partial confidentiality, integrity, and availability impact (CVSS 7.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Because the vector is PR:N and UI:N, no credentials or user interaction are required - the practical barrier is network reachability of the ClearPass management/API interface, so internet-facing or broadly exposed deployments are the most at risk while those confined to isolated administrative networks are largely shielded. Exploitation status: no public exploit identified at time of analysis, and neither a CISA KEV listing nor an EPSS score was supplied with the source data; impact is bounded to role/authorization manipulation rather than full host compromise.
Unauthenticated broken access control in the BEAR bulk-editor plugin for WordPress (vendor realmag777, plugin slug woo-bulk-editor) affects version 1.2.2 and earlier, letting network-reachable attackers invoke functionality that should require authorization without any login, token, or victim interaction. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, 7.3 HIGH) rates the technical impact as partial across confidentiality, integrity, and availability rather than full site compromise, and exploitation is gated primarily by deployment - only sites with this specific plugin version installed and active are exposed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the Patchstack report does not disclose the precise vulnerable endpoint or parameter.
Local authenticated attackers who share a writable Java temporary directory with a victim JVM can exploit a time-of-check/time-of-use race in lz4-java 1.7.0 through 1.11.3 to replace the native LZ4 library extracted by net.jpountz.util.Native.load(), potentially executing native code with the victim's privileges. The vulnerability is local-only and requires winning a race against native-library extraction, plus a shared java.io.tmpdir and native binding use; hardened configurations may instead fail loading and fall back to Java implementations. Version 1.11.4 fixes the issue; no public exploit identified at time of analysis.
Authenticated remote code execution in HPE Networking ClearPass Policy Manager allows an attacker who already holds high-privilege administrative access to the management interface to run arbitrary commands on the underlying operating system, potentially leading to full host compromise. The flaw is remotely reachable (AV:N), requires no user interaction (UI:N) and has low attack complexity (AC:L), but its severity is bounded by the CVSS PR:H prerequisite - only administrator-level accounts can trigger it, so exploitation realistically depends on credential compromise, insider access, or chaining from a separate authentication or privilege-escalation weakness. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); with a base score of 7.2, this is assessed as a moderate-priority issue rather than a top-tier emergency, though the confidentiality, integrity and availability impact on a successful hit is high.
Privilege escalation in the PublishPress Capabilities WordPress plugin (slug capability-manager-enhanced) up to and including version 2.45.0 lets an attacker who already holds an elevated authenticated role use the plugin's role/capability management functions to grant themselves capabilities they should not receive, potentially reaching full site compromise (CVSS 3.1 base 7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The dominant risk-limiting factor is the PR:H prerequisite: the actor must already possess a high-privilege role, so sites that reserve such roles for fully trusted administrators face substantially reduced real-world exposure. No public exploit code has been identified at time of analysis, and the flaw is not reported as actively exploited in the provided intelligence.
Privilege escalation in the WebAppick Challan WordPress plugin (published as PDF Invoice for WooCommerce) version 3.7.88 and earlier allows an authenticated WooCommerce Shop Manager to obtain capabilities beyond the intended Shop Manager role, rated CVSS v3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector carries PR:H, only attackers who already hold valid Shop Manager credentials or control a Shop Manager session can reach the flaw; anonymous visitors and self-registered subscriber-level users cannot use it, and WooCommerce must be active on the site for that role to exist at all. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Incorrect authorization in Elasticsearch 8.x and 9.x allows an authenticated, already-privileged user (CVSS PR:H) who has been granted a non-default, delegated role-management privilege to escalate privileges within a cluster. By abusing a role-definition setting that expands the set of indices matched against a delegated index-scoped privilege, the holder can modify their own assigned role and reach indices that should remain restricted, including internal security data, and from there potentially obtain full administrative control of the cluster. Exploitation is only possible when the cluster has the configurable delegated role-management privilege explicitly enabled and granted with a broadly-scoped index pattern; default deployments that never delegate this capability are not affected. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV). Vendor-released patches are available in Elasticsearch 8.19.22, 9.4.7, and 9.5.4.
Sensitive data exposure in the Edwiser Bridge WordPress plugin, affecting versions up to and including 4.3.4, allows remote attackers to read information the plugin transmits without any authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). The weakness is classified as CWE-201, information exposure through sent data, meaning the plugin emits sensitive values outward rather than verifying that the requester is entitled to them; the assessed impact is loss of confidentiality only, with no integrity or availability effect, and the exact leaking feature or endpoint is not enumerated in the available advisory. This is a moderate-priority issue rather than an urgent one: no public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) is reported, and the plugin's narrow, education-sector install base (WordPress sites integrated with Moodle) limits realistic exposure.
Unauthorized action execution in PowerPress Podcasting (≤11.17.9) allows unauthenticated network attackers to bypass access controls with low integrity and availability impact, as the plugin fails to enforce authorization (CWE-862). Affected are WordPress sites running the plugin; the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, but there is no confidentiality impact and only low integrity/availability impact. No public exploit is identified at time of analysis, and the risk is primarily opportunistic mass scanning against internet-facing instances rather than targeted data theft or code execution.
Privilege escalation in the WordPress plugin Import and Export Users and Customers (versions through 2.5.5) allows an authenticated Editor-level account to assign itself or another user the administrator role by abusing the plugin's user import/export functionality, a CWE-266 incorrect privilege assignment flaw rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is conditional: the attacker needs a pre-existing high-privilege account (Editor or comparable), the plugin installed and active, and no user interaction is required once that session exists. No confirmed active exploitation (CISA KEV) and no publicly available exploit code were identified at time of analysis, so the practical risk is a serious but situational escalation on multi-author or multi-tenant WordPress sites that delegate Editor accounts to less-trusted users rather than a broad internet-facing emergency.
SQL injection in the ClearPass Policy Manager API lets a remote attacker who already holds administrative privileges execute arbitrary database commands against the appliance, putting the confidentiality, integrity, and availability of its configuration and policy data at high risk (CVSS 7.2). The privilege requirement is the decisive constraint: exploitation requires network reachability to the management/API interface plus valid admin-level credentials (PR:H, AV:N, AC:L, UI:N), so realistic exposure is limited to privileged insiders or attackers who have first compromised an administrator account. No public exploit code and no confirmed active exploitation were identified at time of analysis, which keeps this a high-but-not-critical issue whose severity in practice tracks how well admin access and management-plane reachability are controlled.
Improper certificate validation in Dell System Update (DSU) versions prior to 2.3.0.0 lets an authenticated, high-privileged attacker who can occupy a man-in-the-middle position on the update path present DSU with a forged TLS certificate and deliver a malicious update payload, which the vendor describes as leading to remote execution on the affected host. The barriers are substantial: the CVSS vector (AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) requires high privileges, a high-complexity MITM/certificate-spoofing condition, and a user initiating or accepting an update, and the scope change (S:C) reflects impact escaping the update client into the payload it installs. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so despite the genuinely High CVSS 7.6 base score, real-world urgency is tempered by these preconditions rather than driven by observed exploitation.
Stored cross-site scripting in the WordPress plugin Post SMTP (Complete Email Deliverability and SMTP Solution) affects all versions up to and including 4.0.1, allowing an unauthenticated attacker to persist arbitrary script content through the 'user_email' parameter. Exploitation is conditional: it requires a WordPress Multisite installation with public user registration enabled, where WordPress accepts email addresses containing numeric HTML character references that Post SMTP's stricter validator rejects, causing the send to fail and the raw attacker-controlled address to be written verbatim into the email log via the failed-send exception message; the payload then executes when an administrator views the affected email-log page. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is best characterized as conditional rather than broadly urgent because the prerequisite Multisite-plus-open-registration configuration is non-default and the payload is inert until an admin opens the log view. Upgrading to 4.0.2 remediates the issue.
Unauthenticated server-side request forgery in the Instapage WordPress plugin, affecting all versions up to and including 3.7.2, lets any remote attacker who can reach a vulnerable site make the web server issue requests to arbitrary internal or external destinations. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) confirms the attack is network-reachable, requires no credentials and no user interaction, and crosses a security scope boundary, though the Low confidentiality and Low integrity ratings indicate constrained response retrieval and limited write effects rather than full data exfiltration. No public exploit code or in-the-wild exploitation has been identified at time of analysis, and no EPSS or KEV data was supplied; this is a medium-to-high severity, lower-urgency issue whose practical impact depends on what internal services, cloud metadata endpoints, or trusted-network resources are reachable from the affected web server.
Unauthenticated server-side request forgery in the WordPress plugin PDF Smart Viewer for Elementor (versions 1.0.4 and earlier) lets any remote attacker induce the affected site's server to fetch an arbitrary URL of the attacker's choosing, with no authentication (PR:N) and no user interaction (UI:N) required per the assessed CVSS vector. Because the scope is changed (S:C) but confidentiality and integrity impacts are bounded (C:L/I:L), a successful attack typically means using the WordPress host as a request proxy to probe or interact with internal-only services, loopback interfaces, or cloud instance metadata endpoints rather than direct compromise of the plugin itself. Only sites with the plugin installed and active, and whose PDF-fetching functionality is reachable, are exposed; no public exploit code was identified at time of analysis, and exploitation is not confirmed as active in the wild.
Authenticated external-URL upload retrieval in Payload CMS versions after 3.0.0 and before 3.90.0 can leak Payload session cookies to an unintended third-party origin: when a user triggers a server-side fetch of an attacker-influenced file URL, a cross-origin HTTP redirect is followed without re-verifying that the destination is trusted, so authentication data is forwarded to whoever controls the redirect target. Exploitation is conditional and requires an authenticated user (CVSS 4.0 PR:L and the independent 3.1 assessment both indicate PR:L, with UI:A/UI:R), use of the external-URL upload feature, and attacker influence over a redirecting endpoint; only cookies matching the configured cookiePrefix (the Payload session cookies) are exposed. There is no CISA KEV listing and no public exploit identified at time of analysis, and the issue is fixed in version 3.90.0.
Unintended data can be extracted from Arista CloudVision Sensor by authenticated high-privilege users exploiting a path traversal flaw in CloudVision Portal (on-premises) and CloudVision Sensor, though the requirement for high privileges and additional preconditions limits the risk to moderate priority. No public exploit code has been identified, and the vulnerability is not confirmed as actively exploited. The flaw primarily impacts confidentiality, with no integrity or availability impact on the vulnerable component according to the independent assessment.
Broken access control in the WP2LEADS WordPress plugin through version 3.5.7 lets any authenticated user holding a Subscriber-level account invoke plugin functionality that should be reserved for privileged roles, resulting in unauthorized disclosure of confidential data (CVSS 7.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). The plugin is the lead-capture/CRM-sync extension published by Tobias (@saleswonder.biz); the practical gating factor is account acquisition, so sites that permit open or self-service registration are the most realistically exposed while sites requiring manual account approval are largely shielded. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a genuine but moderate-priority exposure rather than an emergency.
Authorization bypass in the optional Amazon Q Business Lambda hook sample shipped alongside QnABot on AWS 7.0.0 through 7.4.5 lets an authenticated remote user cause the hook to read arbitrary Amazon S3 objects in the deploying AWS account, exposing data the caller should not be able to reach. Only customers who separately and manually deployed the q-business-lambda-hook sample stack on top of an affected QnABot version are exposed; the hook is not installed by default and the impact is limited to confidentiality within that account. Vendor-released patch: 7.4.6, and no public exploit identified at time of analysis. Per the authoritative assessment this is a moderate, conditional risk rather than a widespread emergency, because exploitation depends on the optional component being present, on authenticated access to the hook's request path, and the resulting impact is S3 object read only.
Missing authorization in the Wise Chat WordPress plugin (versions 3.4.1 and earlier) lets an authenticated low-privilege user - a Subscriber or any higher role - invoke functionality that lacks a capability check, allowing limited data modification and a significant availability impact on the affected site. The flaw is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H), meaning exploitation needs a valid low-privilege account (PR:L) but no victim interaction, so sites that allow open Subscriber self-registration are the realistic attack surface; sites with registration disabled and no untrusted low-privilege users are far less exposed. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the low attack complexity and broad WordPress install base make timely patching advisable. The vulnerability was reported through Patchstack by security researcher Marcin.
Authenticated Subscriber-level attackers can exploit missing authorization checks in ECPay Ecommerce for WooCommerce versions up to 1.1.2606090 to perform actions that may alter store integrity or cause a high availability impact. The flaw requires only a low-privileged account, which is readily available on sites with open registration, but confidentiality is not affected. No public exploit code has been identified, and the vulnerability is not known to be actively exploited.
SQL injection in the Mooberry Book Manager plugin for WordPress (4.16.2) allows an attacker holding an authenticated Subscriber-level account to inject SQL through plugin input and read data from the underlying WordPress database. Exploitation needs only a low-privilege account and no victim interaction, so sites with open user registration are the most exposed, though the confirmed impact is information disclosure rather than data tampering. No public exploit code has been identified and there is no CISA KEV entry or other indication of active exploitation at the time of analysis, so this is a moderate-priority issue rather than an urgent one.
Information disclosure in Payload CMS allows an authenticated user to read hidden or read-restricted fields from an authentication collection through the token refresh and password reset responses, which returned user documents before applying field-level access control and hidden-field filtering. Affected deployments are npm 'payload' versions >= 3.0.0 and < 3.90.0, plus canary releases >= 4.0.0-canary.0 and < 4.0.0-canary.34; exposure only materializes when an authentication collection actually defines hidden or read-restricted fields, and a valid session/token for that collection is mandatory (CVSS 4.0 PR:L, vendor score 7.1). No public exploit identified at time of analysis; the vendor fixed the flaw in 3.90.0 and 4.0.0-canary.34.
An authenticated user of Payload CMS can overwrite an existing S3 object owned by a different upload collection when the @payloadcms/storage-s3 plugin is used with client uploads enabled across multiple collections that share a single bucket and leave useCompositePrefixes at its default (false or unset). Because the signed-URL generation path did not bind the target object key to the requesting collection, the attacker's upload silently replaces the victim collection's stored file, bypassing that collection's access controls and any prior file-type/size validation. The flaw yields high integrity impact with no confidentiality loss (CVSS 7.1), requires an authenticated session (PR:L) plus the specific shared-bucket client-upload configuration, and no public exploit code or CISA KEV entry was identified at time of analysis.