Denial of service in the RabbitMQ Java client (com.rabbitmq:amqp-client / rabbitmq-java-client) prior to the fixed release allows a single small, malformed JSON-RPC message body to permanently hang or crash a JVM. The deprecated com.rabbitmq.tools.jsonrpc tooling - JsonRpcServer and JsonRpcClient - falls back to DefaultJsonRpcMapper when no mapper is supplied, and that mapper hands raw message bodies straight to JSONReader.read(), whose string and comment scanners fail to stop at CharacterIterator.DONE. An input truncated inside a quoted string drives the parser into an unending append loop that exhausts the heap with OutOfMemoryError, while an unterminated // line comment pins a thread at 100% CPU indefinitely; neither condition is recoverable per request. Publicly available exploit code exists (a proof-of-concept is included in the vendor advisory) and the CVE is tracked by CISA SSVC with Exploitation=poc and Technical Impact=partial, though EPSS probability is low at roughly 0.49% (40th percentile) and no CISA KEV listing is present. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates a network-reachable, unauthenticated availability-only impact.
Unauthenticated broken authentication in the Graphina - Elementor Charts and Graphs WordPress plugin affects versions 3.1.12 and earlier, allowing network-reachable attackers to reach functionality that should require authentication and, per the assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5), to obtain high-impact confidential information without any credentials or user interaction. Because the vector carries PR:N, exploitation requires no authentication and no special conditions beyond the plugin being installed, active, and at a vulnerable version - in practice this means a site running Elementor with the affected Graphina release. Only confidentiality is impacted; there is no integrity or availability effect per the assessed vector, and no public exploit code or CISA KEV entry was identified in the available intelligence, so no public exploit is identified at time of analysis. The precise vulnerable feature or endpoint is not described in the supplied data and should be confirmed against the Patchstack advisory.
Heap buffer overflow in SixLabors ImageSharp (all versions from 3.0.0 up to but excluding 4.1.1) is triggered when the library decodes a strip-organized TIFF file that uses CCITT Group 3 (T4) or Modified Huffman compression: attacker-controlled run lengths are written into the strip buffer before the current row width is validated, corrupting heap memory and terminating the host process. Exploitation is remote and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), but the realistic outcome is denial of service - a crash - rather than data disclosure or modification, and no public exploit code was identified at time of analysis. The issue is fixed in ImageSharp 4.1.1 via the vendor advisory GHSA-jj3q-cwqj-842r and pull request #3176.
Unauthenticated sensitive data exposure in the WordPress plugin SiteVault - Backup, Restore, Migration & Cloning (by royal_plugins) at version 1.5.17 and earlier lets remote attackers retrieve sensitive information from affected sites without authentication, user interaction, or special configuration, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5 HIGH). Only sites with the plugin installed and active at or below 1.5.17 are exposed; the impact is high confidentiality loss with no integrity or availability effect, consistent with the CWE-201 sensitive-data-exposure classification reported by Patchstack. No public exploit code has been identified at time of analysis, no CISA KEV listing applies, and no EPSS score was supplied, so the practical risk is driven mainly by the plugin's install base and the ease of unauthenticated, low-complexity remote exploitation.
Unauthenticated attackers can reach functionality in the WordPress plugin Sermon'e (vendor beplusthemes) at version 1.0.2 and earlier that performs no authorization check, exposing data the plugin is meant to protect. The flaw is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning it is remotely reachable with no credentials and no user interaction, and it affects confidentiality only while leaving integrity and availability intact; exploitation requires only that the plugin be installed and active. There is no public exploit identified at time of analysis and the plugin is not listed in CISA KEV, so the practical risk is driven by deployment scope rather than by active exploitation; the specific vulnerable endpoint is not described in the available data and should be confirmed from the Patchstack advisory.
Unauthenticated information disclosure in the WooCommerce Multivendor Marketplace - REST API plugin (versions up to 1.6.3) allows remote attackers to bypass access controls and read sensitive data from affected WordPress sites. The vulnerability has a CVSS score of 7.5 (CWE-862, missing authorization) and requires no authentication or user interaction. No public exploit code has been identified at time of analysis, and the overall risk is assessed as a credible but moderate-priority issue due to its confidentiality-only impact and the need for the specific plugin to be installed.
Out-of-bounds heap writes in the ImageSharp TIFF CCITT Group 4 (T6) fax encoder, affecting versions 2.1.0 through 4.1.1, allow attacker-supplied image data to corrupt memory and terminate the process. The encoder allocates only Width × rowsPerStrip bytes for a strip while T6BitCompressor.CompressStrip can emit encoded row data plus two 12-bit end-of-facsimile-block codes beyond that capacity, and TiffCcittCompressor.WriteCode performs the writes without bounds checks; a decode-and-re-encode flow that inherits TiffCompression.CcittGroup4Fax and one-bit bilevel metadata from the input reaches this path, giving unauthenticated remote attackers a denial-of-service primitive (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H). Impact is confined to availability - no confidentiality or integrity effect - and there is no public exploit code identified at time of analysis and no CISA KEV listing; the issue is fixed in version 4.1.2.
Denial of service in SixLabors ImageSharp (2.0.0 up to but not including 4.1.2) lets a remote, unauthenticated attacker terminate an image-processing process by supplying a crafted 32-bit floating-point TIFF. The attack only succeeds when the consuming application decodes that TIFF into an Image<HalfVector4> and then applies the global HistogramEqualization processor, at which point a non-finite or out-of-range BT.709 luminance value is consumed as an unchecked histogram offset in GrayscaleLevelsRowOperation.Invoke, producing an out-of-bounds access (CWE-787) and process termination. Impact is availability-only (CVSS 7.5, C:N/I:N/A:H); Adaptive Histogram Equalization and AutoLevel are explicitly unaffected, and no public exploit code or CISA KEV listing was identified at time of analysis.
Memory corruption in SixLabors ImageSharp 4.0.0 through 4.1.1 allows an unauthenticated remote attacker to crash or destabilize a host process by supplying an image whose embedded ICC profile declares more than four LUT16 input/output channels, causing out-of-bounds writes past a four-float internal buffer. The flaw is only reachable when an application has explicitly set DecoderOptions.ColorProfileHandling to Convert, since the default Preserve mode does not run ICC conversion; the independent assessment scores it CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting an availability-only impact rather than data disclosure or modification. No public exploit code was identified at time of analysis, and the issue is fixed in version 4.1.2.
TIFF encoding in SixLabors ImageSharp 2.0.0 through 4.1.1 can write past the end of an undersized compressed-data buffer when CCITT Group 3 fax compression is used on narrow 1-bit images, corrupting process memory and typically terminating the process. The flaw is reachable by remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) only when the host application either explicitly selects TiffCompression.CcittGroup3Fax during encoding or inherits that compression setting from attacker-supplied TIFF metadata in a decode-and-re-encode flow; the impact is limited to availability (denial of service), with no confidentiality or integrity loss assessed. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version, 4.1.2.
Missing authorization checks in the PayPlug for WooCommerce (Official) WordPress plugin at version 3.1.0 and earlier let unauthenticated remote attackers reach plugin functionality that should require privileged access, degrading site integrity (CVSS 3.1 base 7.5, HIGH). The assessed vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N confirms the flaw is network-reachable, low-complexity, and requires no authentication or user interaction, and it affects WooCommerce stores running this PayPlug payment-gateway plugin within the vulnerable range; exploitation is constrained only by the need for the plugin to be installed and active. No public exploit identified at time of analysis, and no CISA KEV listing is associated with this CVE, so broad opportunistic scanning rather than confirmed active exploitation is the realistic near-term concern.
Unauthenticated sensitive data exposure in the Snapshotify - All-in-One Backup & Restore & Migrate WordPress plugin (versions 1.3.2 and earlier) allows remote attackers to retrieve information the plugin transmits without adequate protection, yielding a high confidentiality impact with no integrity or availability impact. The flaw is remotely reachable, requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5), and is rooted in CWE-201, the insertion of sensitive information into sent data. Exposure is limited to WordPress sites that have this specific backup/restore/migrate plugin installed and active; no public exploit identified at time of analysis, and no EPSS, KEV or proof-of-concept data was provided with the source material.
Unauthenticated information disclosure in the Norvis Backup WordPress plugin (versions up to and including 1.1.0) allows any remote attacker to retrieve sensitive site data without credentials, user interaction, or special configuration, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N with high confidentiality impact (base 7.5 HIGH) and no integrity or availability impact. The flaw is a CWE-201 sensitive-information-in-sent-data issue in a low-prevalence backup plugin, so exposure is limited to sites actually running this plugin at a vulnerable version. There is no public exploit identified at time of analysis, and no vendor-released patch version was confirmed in the available data; the sole source is the Patchstack advisory.
Unauthenticated sensitive data exposure in the Museder RestoreOne WordPress plugin (versions up to 2.7.276) allows remote attackers to access confidential information without authentication. With a CVSS score of 7.5 (High), the flaw requires no user interaction and has high confidentiality impact (C:H) but no integrity or availability effect. No public exploit code or active exploitation has been identified at time of analysis, and the risk is confined to WordPress sites with this specific plugin installed.
Unauthenticated sensitive data exposure in SafeSnap - Verified WordPress Backup & Restore 2.1.2 and earlier allows remote attackers to retrieve confidential information from affected WordPress sites. The flaw, tracked as CVE-2026-41559 and categorized as CWE-201 (insertion of sensitive information into sent data), has a CVSS base score of 7.5 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact without requiring authentication or user interaction. No public exploit code or active exploitation was identified at time of analysis, but the low complexity and network reachability make timely patching important.
Unauthenticated SQL injection in WooCommerce Lottery (WPGenie) versions up to and including 2.2.9 lets a remote attacker who can reach the plugin's lottery endpoint inject SQL against the underlying WordPress database, reading arbitrary data from it. No credentials or user interaction are required (PR:N, UI:N), and the vendor-assigned vector notes high confidentiality impact with limited availability effect, though its AC:H rating alongside our assessed AC:L indicates the reliability of the injection depends on conditions at the injection point that the advisory does not fully enumerate. Exploitation is narrow in practice because only WordPress sites running both WooCommerce and this specific niche paid add-on are exposed; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Unauthenticated sensitive data exposure in the Groundhogg WordPress plugin versions 4.8.3 and earlier allows remote attackers to retrieve confidential information from affected sites. Tracked as CVE-2026-104385 with a CVSS score of 7.5, the flaw requires no authentication or user interaction and can be exploited over the network with low complexity. No public exploit identified at time of analysis, but the high confidentiality impact (CWE-201) makes prompt remediation critical.
Unauthenticated sensitive data exposure in the WordPress plugin Xserver Migrator affects all versions up to and including 1.6.6, allowing any remote attacker to read information the plugin should keep confidential, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Because the vector carries PR:N and UI:N, no account, credentials, or user interaction are required, so an unexposed default installation running the vulnerable version is reachable directly over the network; the flaw carries high confidentiality impact with no integrity or availability effect, matching CWE-497. No public exploit code has been identified at time of analysis and the plugin has not been added to CISA KEV, so this is currently a patch-urgency rather than an active-incident issue; the practical exposure is limited because the plugin is a niche migration utility rather than a widely deployed component.
Unauthenticated remote attackers can access backup data from WordPress sites running the WXD Backup Lite plugin versions 1.0.2 and earlier due to a missing authorization check (CWE-862). The flaw carries a CVSS 3.1 base score of 7.5 (HIGH) with high confidentiality impact only, and exploitation requires no authentication or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the low-complexity nature and unauthenticated access make it a significant risk for affected sites.
Unauthenticated broken access control in the WordPress plugin Advanced Posts Listing - Show Post List Easily (versions 1.0.8 and earlier) lets remote attackers retrieve protected post or listing data without logging in or triggering any user interaction. With a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and CWE-862 missing authorization, the flaw is a confidentiality-only issue: it exposes data but does not allow modification or denial of service. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, and the primary limiting factor is deployment-only sites running this specific, low-footprint plugin are affected.
Unauthenticated, network-reachable requests can abuse a missing authorization check in the Easy Digital Downloads WordPress plugin (versions up to and including 3.7.1) to perform actions that should require a privileged, logged-in user, giving attackers an integrity-only impact consistent with the 7.5 CVSS 3.1 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Any WordPress site with the plugin installed and active at or below 3.7.1 is in scope, and exploitation requires no credentials, no privileges, and no victim interaction; the trade-off is that no data disclosure or denial of service is expected, so the realistic blast radius is unauthorized modification of site/e-commerce data rather than full compromise. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and the specific protected action that is exposed is not detailed in the available intelligence, so affected versions should be treated as unauthorized-write capable until a fix is confirmed.
A transient denial-of-service condition affects Qualcomm Snapdragon firmware when it processes a continuous receive command containing a zero-sized global configuration override, causing a buffer over-read that temporarily disrupts the device. Per the independent assessment, exploitation requires an attacker to reach the firmware command-processing interface, likely from adjacent radio range or a position on the relevant communication channel, with no authentication or user interaction required and low complexity. The impact is limited to a self-recovering availability loss, with no data exposure or code execution, and no public exploit has been identified at time of analysis; risk is moderate rather than top-tier urgency.
Authentication bypass in WP Synchro (WP Migration Plugin DB & Files) through version 1.16.1 lets a low-privilege subscriber-level account defeat the plugin's two-factor authentication enforcement, resulting in high confidentiality, integrity, and availability impact on the affected WordPress site. The flaw is network-reachable but requires an existing authenticated account (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and carries high attack complexity, so it is not exploitable by a fully unauthenticated attacker and in practice favors sites that permit open user registration. No public exploit code was identified at time of analysis, and this is assessed as a moderate-priority issue rather than an urgent one.
Unauthenticated sensitive data exposure in the Sitemovr WordPress plugin versions 1.0.1 and earlier allows remote attackers to retrieve undisclosed sensitive information from affected sites without authentication, user interaction, or non-default configuration, per the CVSS vector (7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exploitation is limited mainly by deployment: only WordPress sites that use this obscure plugin and have not updated past 1.0.1 are exposed, and the Patchstack advisory does not specify exactly which data or endpoint leaks. No public exploit code was identified at time of analysis, and the independent assessment rates the available signals as consistent but thin.
Denial of service in Mozilla node-convict 6.2.2 and later allows remote, unauthenticated attackers to overwrite core JavaScript methods on the global Object function via config.set(), causing persistent process-wide failure that requires a restart. The flaw arises because the library's prototype-pollution filters only block constructor.prototype.* and __proto__.* key paths, while a key such as constructor.assign is resolved by walk() to the global Object constructor, permitting tampering with methods like Object.assign. Exploitation is not automatic: it requires an application endpoint or handler that forwards attacker-controlled property names directly into config.set(), so only configurations driven by untrusted keys are exposed; no public exploit code has been identified and EPSS is low (0.24%, 14th percentile), with CISA SSVC recording Exploitation: none and no KEV listing.
Use-after-free in the Linux kernel's CIFS/SMB client can be triggered when the cifs_demultiplex_thread exits while a reconnect work item is still queued on cifsiod_wq, allowing smb2_reconnect_server() to read a server structure that clean_demultiplex_info() has already freed with kfree_sensitive(). The bug is reached unauthenticated per the vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R), but it requires an active CIFS/SMB mount to an attacker-controlled or repeatedly failing SMB server plus a narrow race at connection teardown, which is why the assessed impact is LOW in practice even though the published base score is 7.5. EPSS is 0.21% (10th percentile), no public exploit has been identified at time of analysis, and vendor fixes exist in the 6.6.158, 6.12.112, 6.18.54 and 7.2.8 stable releases.
A use-after-free race in the Linux kernel CIFS/SMB client (cifs_try_adding_channels()) allows a malicious or compromised SMB3 multichannel server to corrupt kernel memory on any client that mounts a share with multichannel enabled, primarily causing a kernel crash (high availability impact) and, secondarily, limited disclosure of freed memory contents. The client's interface iteration caches the next ses->iface_list entry under iface_lock, then drops that lock for the full duration of cifs_ses_add_channel(); a concurrent SMB3_request_interfaces()/parse_server_interfaces() refresh can mark interfaces inactive and kfree() that cached entry before the iterator advances, after which the loop dereferences freed memory. Reaching the window requires the client to have established an SMB3 multichannel session against an attacker-influenced server (CVSS vector PR:N but UI:R, AC:H), and no public exploit code has been identified at time of analysis; EPSS is 0.21% (10th percentile), so exploitation is opportunistic rather than broadly observed.
Fluent Affiliate Pro, a WordPress affiliate-management plugin maintained by WP Manage Ninja, fails to enforce authorization checks on certain requests in versions 1.6.4 and earlier, allowing unauthenticated remote attackers to perform actions they should not be permitted to perform (CWE-862). The flaw carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning exploitation requires no credentials, no user interaction, and no special configuration, but its impact is confined to integrity - attackers can modify affiliate or plugin data, with no confidentiality or availability impact assessed. No public exploit code has been identified and no CISA KEV entry exists at the time of analysis, so the practical risk is driven mainly by whether a given site runs this specific plugin at a vulnerable version, which limits the real-world attack surface.
Unauthenticated broken access control in Morning for WooCommerce (plugin slug wc-gateway-greeninvoice) 2.4.1 and earlier allows remote attackers to reach plugin functionality that should require authorization, undermining the integrity of the store's invoicing/gateway data. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5 High) confirms the flaw is network-reachable with no credentials and no user interaction, while bounding impact to integrity alone - no confidentiality or availability effect is assessed. Exposure is confined to WooCommerce stores that specifically deploy this Green Invoice/Morning gateway plugin; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated broken access control in FluentBooking Pro versions prior to 2.5.0 allows remote attackers to bypass authorization checks and modify booking-related data or functionality, as scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with high integrity impact but no confidentiality or availability impact. The flaw requires no authentication and no user interaction, and can be exploited against any internet-reachable WordPress site running the vulnerable paid plugin. No public exploit code was identified at time of analysis, and a vendor patch is available in version 2.5.0.
A protocol-version negotiation mismatch during RDS-over-RDMA connection setup in the Linux kernel deadlocks the kernel by making an RDMA-CM event handler wait on itself, permanently stalling the RDS connection workqueues and causing denial of service. Only hosts with the RDS stack loaded and bound to an RDMA transport (InfiniBand, RoCE, or iWARP) that expose a reachable RDMA-CM listener are affected; unauthenticated peers able to establish an RDMA-CM connection - typically from the same RDMA fabric or subnet (assessed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - can trigger it by negotiating a protocol version older than RDS_PROTOCOL_COMPAT_VERSION. Impact is availability-only (C:N/I:N/A:H); EPSS is low at 0.18% (7th percentile), no public exploit code has been identified at time of analysis, and vendor patches are available for the affected stable branches.
A possible kernel deadlock in the Linux kernel's Bluetooth RFCOMM listener teardown path can be reached by an unauthenticated attacker within Bluetooth radio range (AV:A, PR:N per the vector) who races a new incoming RFCOMM connection against the cleanup of a listening socket. Triggering requires Bluetooth to be enabled on the target, a live application listening on an RFCOMM channel, proximity, and a narrow timing window (AC:H); the condition was reported by lockdep as a POSSIBLE lock-order inversion between a child socket lock and rfcomm_mutex, not a confirmed and reliably reproducible crash, and the assessed impact is availability only (C:N/I:N/A:H). No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is very low at 0.18% (7th percentile); vendors have released fixes.
Kernel memory corruption and crash in the Linux kernel's SMB/CIFS client (cifs.ko) arises from a missing list-head initialization in TCP_Server_Info.rlist combined with a race in cifs_signal_cifsd_for_reconnect(). Because rlist is allocated with kzalloc, its ->next and ->prev pointers are NULL rather than self-referential, so list_empty() always returns false and list_add() dereferences a NULL ->prev; concurrently, multiple cifsd threads can add the same server's rlist node twice, corrupting the list. Only systems actively using the kernel SMB/CIFS client with a mounted share and a reconnect event are affected; the authoritative assessment scores this CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H, i.e. unauthenticated but requiring user interaction and a hard-to-win timing race, with impact limited to a kernel crash (denial of service) rather than code execution or data theft. EPSS is low at 0.18% (6th percentile), and no public exploit has been identified at time of analysis.
Denial of service in Gitea affects instances running 1.27.3 and earlier that have Actions enabled: a user who can open a pull request from a fork can submit a small workflow file whose static strategy.matrix expands to an enormous number of job combinations, exhausting server memory and potentially killing the Gitea process. Because the Cartesian-product expansion occurs at run-creation time, before the fork pull-request approval gate is enforced, no maintainer approval and no self-hosted runner are required to trigger the resource consumption. Gitea 28.0.0 rejects static matrices exceeding 256 combinations before expansion; EPSS is 0.16% (4th percentile), there is no CISA KEV entry, and no public exploit code has been identified at time of analysis. This is a moderate, not top-tier, priority.
Gitea instances up to and including 1.27.3 can be crashed by a repository administrator who configures an external issue tracker link format whose regular expression uses alternation with separate capture groups; the resulting invalid slice index triggers a Go runtime panic that terminates the Gitea process, and because rendering is triggered on later page views (for example a README containing matching text), the crash hits every user of the instance, not just the configurator. Exploitation requires an actor able to edit a repository's external issue tracker settings - on instances that permit self-service repository creation this effectively means any authenticated user on their own repository - so the practical barrier is configuration privilege rather than anonymity. Independent signals are moderate and partly conflicting: EPSS is only 0.16% (4th percentile), CISA SSVC rates exploitation as 'none' with partial technical impact, no CISA KEV listing or public exploit code has been identified at time of analysis, and a vendor fix ships in Gitea 28.0.0.
Authenticated users who are able to open a pull request from a fork can cancel trusted, in-progress Gitea Actions runs in the base repository when those runs share a workflow-level concurrency group with cancel-in-progress enabled, because the cancellation logic does not check whether the newer run still needs approval before terminating the older ones. The attacker runs no code and gains no data access, but on self-hosted runners the interruption can abort an in-flight deployment and leave partial state behind. No public exploit code has been identified at time of analysis and EPSS is low at 0.16% (4th percentile), consistent with a targeted, configuration-dependent CI-disruption issue rather than a broad default-config exposure.
Server-side request forgery in Gitea 1.27.3 and earlier lets a user who can start a repository migration or mirror reach blocked internal addresses: Gitea validates the destination hostname against its egress allow/block lists before invoking Git, but the Git subprocess resolves the hostname independently when it actually connects, so an attacker who controls the destination's DNS can re-point the name from an allowed address to an internal one between validation and connection. Exploitation requires both the ability to initiate a migration (on a default install this means a logged-in account, and instances with open registration make it effectively unauthenticated) and control of authoritative DNS with suitably short TTLs, which is why the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N rather than the vendor's 7.5. No public exploit code has been identified at time of analysis, EPSS is only 0.15% (3rd percentile), and SSVC records Exploitation: none with partial technical impact; the vendor-released fix is Gitea 28.0.0.
Server-side request forgery in Gitea (versions up to and including 1.27.3) lets a repository administrator bypass the configured outbound host policy: Gitea validates the initial remote URL for push mirrors, wiki remote checks, and migrated pull-request heads, but the raw Git operation that follows will chase an HTTP redirect to an address the policy would otherwise block, causing the server's Git client to reach internal services. Exploitation is meaningfully constrained - it requires repository-administrator privileges, a restrictive egress allow-list must actually be configured, and the attacker must control or locate an allow-listed endpoint that redirects to the desired internal target - so the realized impact is bounded by which internal services are reachable from the Gitea host. EPSS is 0.15% (3rd percentile), no public exploit identified at time of analysis, and there is no CISA KEV listing, so exploitation appears opportunistic and low-volume rather than confirmed actively exploited. Note that the published CVSS vector (7.5, PR:N) overstates the privilege requirement; our assessment rates it PR:L with limited confidentiality and integrity impact.
Heap corruption and process termination in SixLabors ImageSharp 3.0.0 through 4.1.0 can be triggered by decoding a crafted tiled TIFF that uses CCITT fax compression (T4, T6, or Modified Huffman) with a TileWidth smaller than ImageWidth. Because DestinationBuffer is sized by TileWidth while TiffDecompressorsFactory.Create instantiates the fax decompressor with the full frame width, attacker-controlled scanlines overflow the tile buffer, producing out-of-bounds writes and CWE-787 heap corruption. The flaw is remotely reachable, requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5), and is scored availability-only. No public exploit code has been identified at time of analysis, and the issue is fixed in version 4.1.1.
Credential disclosure in the MCP TypeScript SDK OAuth client (npm @modelcontextprotocol/sdk 1.12.0 through 1.30.1, and @modelcontextprotocol/client 2.0.0 through 2.1.0 in narrower configurations) lets a malicious or compromised MCP server direct the client's stored OAuth credentials to an authorization server of the attacker's choosing. Because saved credentials were never bound to the authorization server that issued them, a remote, unauthenticated attacker who controls or compromises the MCP server the victim connects to can silently receive a stored refresh_token and client_secret - or a bundled provider's client_secret or signed assertion - yielding full confidentiality impact (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, per the PR:N vector the request is unauthenticated). No public exploit code and no confirmed active exploitation were identified at time of analysis; exploitation requires the victim application to use the SDK's OAuth client over HTTP and to connect to an MCP server it does not fully trust while holding credentials for a legitimate authorization server.
Insecure deserialization in the TrueLayer Magento 2 Plugin's Psr16CacheAdapter component allows an attacker who already has write access to the Magento cache backend (Redis or Memcached) to achieve arbitrary code execution via crafted PHP objects. The flaw arises from PHP's unserialize() being called without class restrictions, and exploitation requires both cache-write capability-obtainable through local filesystem access or an exposed cache service-and the presence of a usable gadget chain in the deployed Magento/Adobe Commerce environment. Although rated CVSS 7.5, real-world risk is materially lower because the attack preconditions are stringent; no public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited.
Unauthenticated directory traversal in kkFileView 5.0.0 through 5.0.2 lets remote attackers create arbitrary directories and write files outside the intended fileDir root via the fileUpload, createFolder, and existsFile endpoints, which concatenate an attacker-supplied 'path' parameter into the upload base path without any validation. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms that no credentials and no user interaction are needed, and that the impact is integrity-only (C:N/A:N), meaning the attacker can plant content beyond the configured storage root but gains no direct read or availability effect. Exploitation is gated chiefly by exposure rather than configuration - kkFileView is typically deployed as an internal document-preview service - and no public exploit code was identified at time of analysis, so internet-facing, unauthenticated reachability of the upload endpoints is the real-world precondition for mass abuse.
Missing authentication for critical functions in Dell Container Storage Modules' CSI drivers (csi-powerflex, csi-powermax and csi-powerstore) at versions prior to 1.18.0 allows an unauthenticated attacker with adjacent network access to read sensitive information from the Kubernetes storage layer, with no user interaction required (CVSS 7.4, scope-changed, high confidentiality impact only). Affected environments are limited to those that have actually deployed one of these three Dell CSI drivers alongside the corresponding Dell storage array; the vector is AV:A, so the flaw is not reachable from an arbitrary internet host but only from a host on the same logical or physical network segment as the cluster. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none and automatable as no, and EPSS is 0.30% (21st percentile), so this is a moderate-priority hardening item rather than an emergency; a vendor patch is available in 1.18.0.
Improper TLS certificate validation in the Dell Container Storage Modules (CSM) proxy-server before 1.18.0 allows an unauthenticated adjacent-network attacker who can man-in-the-middle TLS traffic to obtain storage backend administrator credentials. The issue is confidentiality-only (C:H/I:N/A:N) and requires an active MITM position on an adjacent network rather than internet reachability; no public exploit code was identified at time of analysis and EPSS is 0.12% (2nd percentile). Dell has released CSM 1.18.0 to address it, so this is a moderate defense-in-depth priority rather than an emergency.
Sandbox escape in Google Chrome on iOS (versions prior to 155.0.8059.39) allows a local attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox via a local program. The flaw is an incorrect reference resolution (CWE-706) in the Passwords component, rated Medium by Chromium and carrying a CVSS 7.4 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code or confirmed active exploitation has been identified at time of analysis; a vendor patch is available.
Unauthenticated requests to the WordPress picu plugin (versions up to and including 3.10.1) can reach plugin functionality that is supposed to be protected by an authorization check, letting any remote visitor perform an action the plugin intended to reserve for a privileged or otherwise authorized user. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, with Low confidentiality, integrity and availability impact and S:U) confirms that no credentials, no user interaction and no non-default configuration are required, so any reachable installation is exposed, though the resulting impact is bounded rather than a full site takeover - the specific protected action gated by the missing check is not identified in the available data. There is no public exploit identified at time of analysis and no CISA KEV listing; real-world risk is constrained mainly by the small install base of this specialized client-proofing plugin and by the Low severity of each impact metric.
Code injection in the Reader Mode feature of Google Chrome on iOS (versions prior to 155.0.8059.39) lets a remote, unauthenticated attacker bypass the web origin policy by convincing a victim to open a crafted HTML page in the browser. The flaw is confined to the iOS build and depends on social engineering to drive the victim to the malicious page, so effective user interaction is required; impact is limited to a partial confidentiality, integrity and availability loss through origin-policy circumvention rather than full system compromise. No public exploit code has been identified at time of analysis, EPSS is a low 0.27% (17th percentile), and the issue is not listed in CISA KEV, so despite the 7.3 High CVSS the real-world priority is low-to-moderate. Google has shipped a vendor patch, fixed in Chrome 155.0.8059.39.
Unauthenticated path traversal in an API endpoint of HPE Aruba ClearPass Policy Manager allows a remote attacker to manipulate authorization logic and be assigned a role they were not intended to hold, yielding partial confidentiality, integrity, and availability impact (CVSS 7.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Because the vector is PR:N and UI:N, no credentials or user interaction are required - the practical barrier is network reachability of the ClearPass management/API interface, so internet-facing or broadly exposed deployments are the most at risk while those confined to isolated administrative networks are largely shielded. Exploitation status: no public exploit identified at time of analysis, and neither a CISA KEV listing nor an EPSS score was supplied with the source data; impact is bounded to role/authorization manipulation rather than full host compromise.
Unauthenticated broken access control in the BEAR bulk-editor plugin for WordPress (vendor realmag777, plugin slug woo-bulk-editor) affects version 1.2.2 and earlier, letting network-reachable attackers invoke functionality that should require authorization without any login, token, or victim interaction. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, 7.3 HIGH) rates the technical impact as partial across confidentiality, integrity, and availability rather than full site compromise, and exploitation is gated primarily by deployment - only sites with this specific plugin version installed and active are exposed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the Patchstack report does not disclose the precise vulnerable endpoint or parameter.
Local authenticated attackers who share a writable Java temporary directory with a victim JVM can exploit a time-of-check/time-of-use race in lz4-java 1.7.0 through 1.11.3 to replace the native LZ4 library extracted by net.jpountz.util.Native.load(), potentially executing native code with the victim's privileges. The vulnerability is local-only and requires winning a race against native-library extraction, plus a shared java.io.tmpdir and native binding use; hardened configurations may instead fail loading and fall back to Java implementations. Version 1.11.4 fixes the issue; no public exploit identified at time of analysis.