Unauthenticated reflected cross-site scripting (XSS) in the WordPress plugin Real 3D FlipBook versions 5.5 and earlier allows remote attackers to inject arbitrary script into a victim's browser session via a crafted link, requiring user interaction (UI:R) such as clicking the link. No authentication is required (PR:N), and the flaw is network-reachable (AV:N) with low complexity (AC:L), but impact is limited to the victim's browser context with no server-side compromise. Our independent assessment adjusts the availability impact to none (A:N), yielding a CVSS 3.1 base score of 6.1 rather than the vendor's 7.1; no public exploit code or active exploitation is identified at time of analysis.
Qualcomm Snapdragon firmware skips authentication and cryptographic signature checks when processing non-ELF partition images, allowing an attacker with local low-privileged access to stage and mount unsigned or corrupted images that the device then trusts. The flaw carries a 7.1 CVSS score (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) and maps to CWE-347; no public exploit code and no CISA KEV entry were identified at time of analysis, and because exploitation is not remote and requires an existing on-device foothold or physical/debug access, it is a moderate-priority local issue rather than a mass-exploitation threat.
Crafted HTTP requests sent by an unauthenticated wireless client associated to a captive-portal-enabled SSID can crash the Captive Portal service on affected Arista Wi-Fi access points, and a sustained low-rate flood of such requests can keep the portal persistently unavailable (CVSS 7.1, availability-only, no confidentiality or integrity impact and no remote code execution). Exploitation is limited to the wireless adjacency: the attacker must be within RF range and associated to a captive-portal SSID, and access points without Captive Portal configured are not exposed. Because the portal process restarts automatically after each crash, a single request is self-healing; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation.
A crafted HTTP request from an unauthenticated wireless client associated to a Captive-Portal-enabled SSID can crash the Captive Portal service on Arista Wi-Fi access points, causing a temporary denial of service until the service automatically restarts. Exploitation requires the Captive Portal feature to be explicitly enabled (non-default) and the attacker to be within wireless range; it is not reachable from the general internet. The vendor confirms remote code execution is not possible, and no public exploit code has been identified at time of analysis.
Authenticated SQL injection in the Arista CloudVision CUE API allows a network user with valid credentials to degrade backend availability by supplying malicious values in specific request parameters that lack proper validation. The CVSS 4.0 score is 7.1 (High), driven entirely by high availability impact (VA:H) with zero confidentiality or integrity impact (VC:N/VI:N), which is atypical for SQL injection. No public exploit code has been identified at time of analysis, and exploitation requires prior authentication (PR:L).
Authenticated users of the Arista Spectralight WiFi-server application can submit crafted XML requests that trigger external-entity resolution and disclose arbitrary local files from the server, with a secondary partial denial-of-service effect from entity processing. Exploitation requires valid credentials (CVSS 4.0 vector shows PR:L; the independent assessment concurs with PR:L) and network reach to an XML-accepting endpoint, so the realistic threat population is insiders or attackers who have already obtained an account rather than unauthenticated internet scanners. No public exploit code and no CISA KEV listing were identified at time of analysis, and the issue is rated CVSS 7.1 / CWE-611 - a moderate-severity, authentication-gated information-disclosure flaw rather than a top-tier emergency.
Unauthenticated attackers with adjacent-network access can crash the TDP daemon on TP-Link Tapo C500 v2.0 cameras by sending a single crafted UDP datagram, causing a denial-of-service condition. The flaw is an out-of-bounds function-pointer dispatch (CWE-823) that triggers an invalid indirect call, and the CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) plus our independent CVSS 3.1 assessment (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirm only availability is impacted-no data disclosure or code execution. No public exploit code or active exploitation is identified in the provided data, but the vendor has released a patch; the attack requires Layer-2 adjacency and no authentication, session, or pairing.
Quasar Framework's development-only SSR/SSG error handler (@quasar/render-ssr-error before 2.2.4 and @quasar/app-vite before 3.3.0) serializes the developer's shell environment variables, request headers, and cookies into the HTML error page produced by serve.devError(), and because the dev server listens on all interfaces by default, any network-adjacent client that can provoke a render failure can read those secrets without authentication. The same page escaped only the exact lowercase '</script>' spelling, so case variants or alternate closing-tag delimiters reflected in diagnostic data can terminate the script element and inject markup; for that injected code to execute in a browser it must accompany the developer's own request, which is why user interaction and high attack complexity apply. The issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0 (commit 61c2bd8, advisory GHSA-r5mf-4r5x-q78f); no public exploit identified at time of analysis, and production SSR builds are unaffected - this is a developer-workstation-scoped risk rather than a broad production threat.
Path traversal in @quasar/icongenie versions before 6.1.1 lets a crafted profile cause the icongenie generate --profile command to write generated image content to any path writable by the invoking developer, enabling overwrite of shell startup files, build scripts, or other executable configuration. Exploitation requires the developer to run the command against an attacker-supplied profile (UI:R) and gives no direct remote access; no public exploit code identified at time of analysis, and the issue is fixed in 6.1.1.
A label-enforcement bypass in the External Secrets Operator (ESO) webhook generator lets any Kubernetes principal that is permitted to create webhook generator resources point a generator at a victim's Secret that was never labelled for webhook use, and then have its contents exfiltrated to an attacker-controlled URL. The flaw affects ESO releases from 0.10.0 up to (but not including) 1.3.2 and stems from an initialization-order bug that cleared the EnforceLabels flag after it had been set, so the provider-side check for the external-secrets.io/type=webhook label was skipped instead of failing. Exploitation is conditional: it requires an affected version, the webhook generator feature in use, and delegated RBAC rights to create generators.external-secrets.io/v1alpha1 Webhook objects, which is why the assessed vector carries PR:L; clusters that never use webhook generators or that tightly constrain generator creation are not exposed. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, and a vendor patch is available in 1.3.2.
Arbitrary file read in Rundeck before 6.2.0 lets an authenticated user who holds only the project 'configure' ACL read any file on the server by setting the resources.source.N.config.file property to an absolute path outside the project directory, then retrieving the contents through the editProjectNodeSourceFile or apiSourceGetContent endpoints. Recoverable data includes database passwords, LDAP bind credentials and configuration belonging to other projects, making this a meaningful lateral-movement aid for anyone with delegated project administration rights; there is no user-interaction requirement and no non-default configuration needed. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but VulnCheck reported it and the vendor-released fix ships in Rundeck 6.2.0.
Refcount initialization ordering in the Linux kernel's RDMA iWARP port-mapper (iwpm) subsystem allows a local, low-privileged attacker to trigger a kref "addition on 0" race that can lead to premature object release and kernel memory corruption, rated 7.0 High (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Only systems that actually load and use the RDMA stack with iWARP port-mapper netlink traffic are exposed - the iwpm subsystem is not active on default desktop or server installs without InfiniBand/RDMA hardware or the software RDMA drivers (rxe, siw). Exploitation requires local code execution plus winning a narrow timing window on an SMP system, and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is 0.22% (11th percentile).
Stale sysfs attributes left behind by the Linux kernel's w83791d hwmon driver after unbind can expose freed memory to local users, because the normal remove path deletes only the w83791d_group but not the optional w83791d_group_fanpwm45 group created when the fan/pwm 4-5 pins are not used as GPIO. Callbacks on those leftover files dereference devm-allocated driver data that is released after unbind, creating a use-after-free condition. The flaw is local-only and highly conditional (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0): it requires a system physically equipped with the Winbond W83791D sensor chip, the fan/pwm 4-5 pins not configured as GPIO, and a driver unbind through the normal teardown path, and exploitation further depends on winning a race against the devm free. There is no public exploit identified at time of analysis, EPSS is low at 0.22% (11th percentile), and vendor patches are available in the stable trees.
A write use-after-free in the Linux kernel's XFRM (IPsec) state framework allows a local attacker who can add and delete xfrm states to corrupt freed slab memory, which in turn spawns a read use-after-free during state lookup. The defect is an incomplete fix: commit 14acf9652e56 switched the bydst/bysrc/byseq/byspi hash lists to hlist_del_init_rcu() but missed state_cache and state_cache_input, so a second __xfrm_state_delete() on the same state writes through the LIST_POISON2 pprev value instead of becoming a harmless no-op. Exploitation requires low privileges (CVSS PR:L, AV:L) - realistically the ability to manipulate xfrm state, normally gated by CAP_NET_ADMIN, which unprivileged users can obtain inside a user plus network namespace - and the attacker must win a timing-dependent delete/delete race (AC:H), so this is a real but not urgent kernel memory-corruption bug rather than a mass-exploitation priority: no public exploit identified at time of analysis, EPSS 0.21% (10th percentile), and no CISA KEV listing.
A stale virtual interface entry in the Linux kernel's mac80211 WiFi stack can drive the kernel into a BUG() at net/wireless/core.h:141 (wiphy_to_rdev) and crash or corrupt memory when a network namespace holding a wiphy is destroyed and the wiphy's migration back to init_ns fails on a memory-allocation error. Kernels with mac80211 loaded are affected from the 2.6.32-era lineage carrying commit 463d018323851a608eef52a9427b0585005c647f, with local exploitation requiring namespace-administration privileges (PR:L) plus a racy, largely attacker-uncontrollable allocation failure (AC:H) - CVSS 3.1 base 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), though independent assessment downgrades confidentiality and integrity to LOW while retaining HIGH availability impact. No public exploit code has been identified at time of analysis, the CVE is not in CISA KEV, and EPSS is only 0.18% (7th percentile), so the effective real-world priority is LOW despite the HIGH base score; vendor-released patches exist in 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.
A use-after-free in the Linux kernel's Soft-RoCE (rdma_rxe) driver allows a local user who can open the RDMA uverbs interface and issue ATTACH_MCAST on a UD queue pair to trigger freeing of a published multicast-group object while it is still reachable from the driver's mcg_tree, giving high confidentiality, integrity and availability impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The race is only reachable when the backing Ethernet multicast programming step, rxe_mcast_add(), fails mid-operation (for example -ENODEV after the backing netdev is removed, or a propagated dev_mc_add() error), which is why the attack complexity is High and the practical priority is low. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.18% (7th percentile), and vendor patches are available in mainline and multiple stable branches.
Network namespace teardown in the Linux kernel's cfg80211 wireless configuration subsystem can leave a wiphy (wireless device) pointing at a freed network namespace when the interface migration back to the initial namespace fails, producing a kernel mode fault (reported at address 0x30 via genlmsg_multicast_netns / nl80211_notify_wiphy / wiphy_unregister) and crashing the host. The independent assessment rates this availability-only (C:N/I:N/A:H) with AV:L/PR:L, meaning a local attacker with low privileges - CAP_NET_ADMIN or access to an unprivileged user namespace that permits netns creation - is required, and the attack is complicated because it depends on a memory allocation failure occurring at exactly the right moment. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is 0.17% (6th percentile), consistent with a low-priority defensive fix rather than an imminent threat.
Local users with low privileges can drive the Linux kernel into a race condition in the RDMA/core helper ib_get_eth_speed(), which calls a net_device's ethtool callback after that device has already completed NETDEV_UNREGISTER and ndo_uninit during teardown, corrupting or crashing the kernel. Exposure is narrow: the host must have an active RDMA device bound to an Ethernet (RoCE) or InfiniBand link layer and that device must be unregistering while an asynchronous RDMA port query is in flight, so exploitation requires winning a tight timing window (upstream CVSS 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; the independent assessment keeps the same AV:L/AC:H/PR:L vector but rates confidentiality and integrity as low and availability as high). Vendor-released patches exist for stable branches 6.1.189, 6.6.158, 6.12.112, 6.18.54 and 7.2.8 (plus 7.3-rc4); no public exploit code or confirmed active exploitation is known, and EPSS is only 0.17% (5th percentile).
Out-of-bounds kernel memory writes in the WibuKey driver for Windows below version 6.72 allow an authenticated, locally logged-on low-privileged user who can send input to the driver (for example via a device IOCTL) to crash the affected system and, under unfavorable kernel heap layouts, modify adjacent kernel memory. Because the flaw requires local access and authentication and depends on uncontrolled kernel memory layout, reliability is limited primarily to denial of service, with adjacent-memory modification explicitly conditional rather than a guaranteed outcome. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is local-only with no network vector.
A use-after-free race condition in the Android kernel's epoll teardown path (ep_free in eventpoll.c) lets a locally installed or otherwise compromised unprivileged app escalate to kernel-level privileges by reclaiming a freed eventpoll object before cleanup completes. The flaw is tracked as CVE-2026-56906 (CWE-362) with a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires an existing low-privilege code-execution foothold and a successful, timing-sensitive race - no user interaction and no special product configuration are needed. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV absent; SSVC Exploitation='none', Automatable='no'), which places this in the second-tier priority band for most defenders.
OpenSSH sshd before 10.6 can incorrectly persist GSSAPIAuthentication state across authentication attempts when GSSAPIAuthentication is enabled, allowing a remote, unauthenticated attacker to influence authentication integrity on the same connection. This is a non-default configuration issue: stock OpenSSH deployments without Kerberos/GSSAPI are not affected, and the attacker must drive a sequence of authentication attempts (high attack complexity). No public exploit code has been identified, EPSS is very low (0.08%, 0th percentile), and CISA SSVC reports no exploitation; the vendor has released a fix in OpenSSH 10.6.
Credentials can incorrectly persist after a failed GSSAPIAuthentication attempt in the sshd daemon of OpenSSH before 10.6, allowing an authentication context that should have been discarded to remain usable and potentially granting access under another identity (CWE-669, integrity impact). Only hosts that explicitly enable GSSAPIAuthentication are affected, since the OpenSSH default is 'no', so exposure is largely limited to Kerberos/GSSAPI-integrated environments; the flaw is fixed in OpenSSH 10.6. No public exploit code has been identified at time of analysis, EPSS is negligible (0.08%), and CISA SSVC records no observed exploitation and rates the issue as non-automatable with partial technical impact, so real-world risk is moderate despite the 7.5 'High' base score.