Missing authorization checks in the MultiversX 'multisig-improved' reference smart contract (mx-multisig-and-modules) allow an account holding the Proposer role to unilaterally move funds, draining 100% of a deployed contract's EGLD/ESDT balance in as few as two transactions with zero board signatures. The flaw is a CWE-306 missing-authentication issue in the fund-moving execution path; exploitation requires the attacker to already hold the Proposer role on a specific vulnerable deployment (assessed as PR:L, authenticated), not fully anonymous access, and publicly available exploit code exists, though there is no confirmed active exploitation (no CISA KEV) and EPSS is only 0.15% (3rd percentile). Deployments built from the affected commit are fully exposed once a Proposer-role account is compromised or malicious.
Prototype pollution in Payload CMS's @payloadcms/plugin-import-export module lets an unauthenticated remote attacker submit prototype-sensitive field paths to the plugin's endpoints, corrupting object prototypes and triggering unintended application behavior that can escalate to remote code execution. The flaw affects Payload 3.0.0 through versions before 3.88.0 and 4.0.0-canary.0 through versions before 4.0.0-canary.27, but only when the Import Export plugin is installed and enabled - sites without that plugin are unaffected. No public exploit code has been identified at time of analysis, and exploitation is gated by the presence of a reachable prototype-pollution gadget in the target application, so real-world impact is conditional even though the vendor advisory and a 9.3 CVSS 4.0 score (independent assessment: CVSS 3.1 8.1-range with AC:H) both flag it as high severity.
Field-level access control can be bypassed in Payload CMS's document duplicate operation, letting a caller with access to the duplicate endpoint copy hidden or read/create-restricted values from a source document into a newly created document - potentially exposing secrets such as tokens or credentials stored in access-controlled fields. The issue affects the npm `payload` package from 3.0.0 up to (but not including) 3.90.0, and 4.0.0 canary releases before 4.0.0-canary.34; the `disableDuplicate` setting, which is on by default for auth collections, did not actually block the operation before the fix. Exploitation requires an authenticated account that can reach the duplicate endpoint on a collection containing protected fields, and is a field-level authorization bypass rather than an unauthenticated remote compromise; vendor patches 3.90.0 and 4.0.0-canary.34 are released, and no public exploit code or active exploitation was identified at time of analysis.
Unauthenticated remote attackers can bypass authentication in the web management interface of HPE AOS-S (ArubaOS-Switch), gaining full administrative control of the switch, as reflected in the 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Any device with the HTTP/HTTPS management service reachable from an untrusted network is exposed, and because the vector requires no credentials and no user interaction, network reachability of that interface is the primary limiting factor. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation; this is a genuine high-priority issue whose exact affected firmware versions and fixed releases are not detailed in the available data and must be confirmed against the HPE advisory.
Authentication bypass in the Aruba AOS-S (HPE Aruba Networking switch) management interface could allow an unauthenticated remote attacker to gain unauthorized access to the affected system, but exploitation is constrained by high attack complexity (AC:H) and specific preconditions outside the attacker's control that HPE has not publicly detailed. No public exploit code or CISA KEV active exploitation has been identified at time of analysis. Although the nominal CVSS 3.1 base score is 9.8 CRITICAL, the assessed vector emphasizes that successful attacks are not reliable against an arbitrary default deployment, and HPE advisory hpesbnw05156en_us should be consulted for exposure details.
Unauthenticated remote code execution affects the AOS-S switch firmware line from HPE Aruba, where a buffer overflow in a network-facing interface can be triggered by a remote attacker without credentials, user interaction, or a privileged network position (CVSS 9.8, AV:N/AC:L/PR:N/UI:N, full confidentiality, integrity, and availability impact). The practical barrier to exploitation is reachability of the specific affected interface on the switch rather than any authentication control, so switches whose management or service interfaces are exposed beyond a segmented management network carry the highest risk. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the advisory does not name the vulnerable service, port, protocol, or the affected and fixed firmware versions, so defenders must confirm exposure against HPE bulletin hpesbnw05156en_us.
Memory corruption flaws in HPE Aruba Networking AOS-S switch firmware allow an unauthenticated attacker who is positioned on the same Layer-2/adjacent network segment to corrupt memory and potentially execute arbitrary code on the switch (CVSS 9.6, AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Exploitation requires network adjacency - a directly connected device, a compromised host on the same VLAN/broadcast domain, or an attacker already inside the local network - but within that position no credentials and no user interaction are needed, and attack complexity is low, so default-configured, unpatched switches are exposed by sending crafted traffic to the vulnerable handler. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the primary exposure limiter is physical/logical access to the switch segment rather than remote internet reachability.
OS command injection in the TOTOLINK X6000R wireless router (firmware 9.4.0cu.652_B20230116) allows remote attackers to execute arbitrary shell commands on the device by supplying a crafted file_name argument that is processed by the firmware_check routine behind the /cgi-bin/cstecgi.cgi endpoint. The vendor-derived CVSS 4.0 vector scores this 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity and availability impact on both the vulnerable and subsequent systems), and our independent assessment is consistent: CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating low-complexity, unauthenticated remote exploitation with scope change and full device compromise. No public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis, and real-world exposure is limited to units whose web management interface is reachable from the attacker's position - a WAN-exposed admin interface or an attacker already positioned on the LAN.
An unauthenticated buffer overflow in HPE Aruba AOS-S switch software lets an attacker who already sits on an adjacent Layer 2 network segment read out sensitive memory contents and crash the device, producing a denial of service. The flaw carries a CVSS 3.1 base score of 9.3 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H), meaning no credentials or user interaction are needed, but the attacker must be able to reach the switch from an adjacent network rather than across the internet. No public exploit code or confirmed active exploitation was identified at time of analysis, so risk is real and high-severity for organizations running Aruba/HPE switching infrastructure yet bounded by the adjacent-network attack vector. The HPE security advisory (hpesbnw05156en_us) is the authoritative source for affected builds and fixed firmware.
Unauthenticated remote attackers can trigger buffer overflows in an interface of HPE Aruba AOS-S (ArubaOS-Switch) that is not named in the advisory, allowing them to expose sensitive memory contents and crash the device for a denial of service. The flaw is rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), so no credentials or user interaction are required, although realistic attacker reach is heavily conditioned on whether the specific vulnerable interface is exposed to untrusted networks. No public exploit code has been identified and the CVE is not in CISA KEV, so it is not confirmed actively exploited at time of analysis.
Unauthenticated remote credential theft in the Dell Container Storage Modules (CSM) Authorization component before v1.18.0 allows any attacker who can reach the csm-authorization-storage gRPC service to retrieve the storage-backend administrator credentials for every registered storage array, turning a single unauthenticated request path into full administrative control of the underlying storage infrastructure. The defect is a missing-authentication error (CWE-306) in a critical function and carries a CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), with the scope change reflecting the pivot from the CSM authorization service into the storage arrays themselves. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the principal gating factors are environmental - the optional Authorization module must be deployed, its gRPC endpoint must be reachable from the attacker's network position, and at least one array must already be onboarded so that credentials exist to steal - which is why Dell's DSA-2026-448 advisory and the availability of a fixed release make this a genuine top-priority item rather than a theoretical high-CVSS score.
Unauthenticated remote attackers can exploit Dell Container Storage Modules (CSM) deployments running versions prior to 1.18.0 to elevate privileges, because a critical function is reachable without any authentication check (CWE-306); the vendor scores this CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and our independent assessment concurs that this is a genuine top-priority issue rather than a high-score/low-risk artifact. Per the provided CVSS vector the attack is unauthenticated, requires no user interaction, and involves no special difficulty (AC:L), so any party who can route traffic to the vulnerable CSM endpoint can trigger it. The decisive limiting factor is network exposure of that endpoint - CSM components frequently run inside a Kubernetes cluster, so realistic blast radius depends on whether the deployed service is reachable from an attacker-controlled network segment. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated arbitrary file upload in Kognetiks Chatbot for WordPress 2.4.9 and earlier allows remote attackers to upload files to the WordPress site without authentication, potentially leading to code execution if the uploaded file is placed in a web-executable location. The independent assessment confirms a high-priority, genuine vulnerability with remote unauthenticated exploitation, no user interaction, and only the vulnerable plugin being installed and active as a prerequisite. No CISA KEV entry or public exploit code is identified in the provided data, and EPSS is not provided.
Unauthorized read access to stored form submissions and form email configuration in Payload CMS deployments running the @payloadcms/plugin-form-builder plugin before 3.90.0 (and 4.0.0-canary versions before 4.0.0-canary.34) is achievable by an authenticated non-admin user, based on the vendor patch, which replaces a permissive 'any logged-in user' read rule with a check that the requester belongs to the configured admin user collection. The published CVE record characterizes the flaw as remote code execution (CWE-94, CVSS 10.0), but the actual shipped fix is an access-control tightening on the Forms and FormSubmissions collections plus tests asserting that users from unrelated collections are denied, so the verifiable impact is a confidentiality breach of form data rather than code execution; these conflicting signals should be reconciled with the vendor advisory before prioritization. There is no public exploit identified at time of analysis and no indication of confirmed active exploitation, but the authorization requirements (the CVSS vector claims unauthenticated, while the patch implies a logged-in non-admin account is needed) should be confirmed against the vendor before assuming unauthenticated exposure.
Unauthenticated arbitrary file upload in the Doctreat WordPress theme (versions up to and including 1.7.0) allows remote attackers to upload and execute malicious files, potentially leading to complete site takeover. The flaw requires no authentication or user interaction and affects only sites running this specific commercial Amentotech theme. No public exploit code was identified at the time of analysis, but the critical severity warrants immediate remediation.
Unauthenticated privilege escalation in the Doctreat Core WordPress plugin (versions 1.7.0 and earlier, vendor namespace amentotech) lets a remote visitor gain administrator-level rights on any affected site without logging in, supplying credentials, or interacting with a victim. The input assigns a maximal CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting a low-complexity, unauthenticated, network-reachable flaw with scope change and full loss of confidentiality, integrity, and availability; only sites with this specific plugin installed and un-updated are in scope. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
Sandbox escape in JetBrains TeamCity's Kotlin DSL configuration mechanism allows an attacker who can supply or modify versioned-settings build configuration code to run arbitrary code on the TeamCity server, breaking out of the DSL evaluation sandbox. The vendor advisory covers TeamCity releases before 2026.1.3 and before 2025.11.7; the CVSS 3.1 vector published with the CVE is a full 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), while our independent assessment scores it lower at PR:L because practical exploitation requires the ability to inject Kotlin DSL - realistically project-administration/edit rights in the TeamCity UI or write/commit access to the VCS repository holding the project's versioned settings - and the Kotlin DSL / versioned settings feature must actually be enabled. Risk signals here are genuinely conflicting and should be read carefully: a maximum-severity scope-changing RCE sits alongside a low EPSS of 0.27% (18th percentile), CISA SSVC 'Exploitation: none' and 'Automatable: no', and no public exploit identified at time of analysis, so this looks more like a high-impact but privilege-gated flaw than a broadly wormable one.
Remote code execution in WooCommerce Designer Pro (versions up to 1.9.33) allows authenticated attackers with Subscriber-level access or higher to execute arbitrary code on the server. The flaw is a code injection (CWE-94) with a CVSS score of 9.9 (Critical), requiring no user interaction and resulting in complete loss of confidentiality, integrity, and availability (scope change). Exploitation is most realistic on WooCommerce storefronts that permit open customer self-registration; no public exploit identified at time of analysis. The independent assessment confirms this is a genuine high-priority issue rather than a theoretical risk.
Privilege escalation in Dell Container Storage Modules (CSM) Operator versions prior to 1.18.0 allows an authenticated, low-privileged attacker who can create or modify the ContainerStorageModule Custom Resource to obtain root-level access on Kubernetes cluster nodes. The flaw is an improper privilege management weakness (CWE-269) in the ContainerStorageModule Custom Resource reconciler, rated CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) because the impact crosses a security scope boundary and delivers total confidentiality, integrity, and availability impact against the underlying nodes. Exploitation is not unrestricted: it requires a low-privileged cluster credential with rights to submit or alter the CSM Custom Resource (PR:L, no user interaction), so multi-tenant clusters that grant this permission broadly are the highest-risk deployments. No public exploit code has been identified at time of analysis and no CISA KEV entry exists; EPSS data was not provided.
Server-side cross-site scripting in Quasar Framework's SSR meta plugin (versions prior to 2.22.0) allows remote attackers who can influence dynamic page metadata - such as a post title, product name, excerpt, or display name - to inject executable markup into the server-rendered HTML before hydration. The flaw is in the getHead() serializer, which interpolates values supplied through useMeta() into title, meta, link, and script tags without HTML text or quoted-attribute encoding, while the client-side apply() path is unaffected because it relies on DOM APIs that encode attributes. Exploitation requires the target application to run Quasar in SSR mode and to feed attacker-influenceable data into useMeta() without prior sanitization, and a victim must load the affected page for the injected script to run; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the 10.0 CVSS base score overstates the universal real-world risk given these preconditions. The issue is fixed in version 2.22.0.
Arbitrary file upload in the Amentotech Workreap Core WordPress plugin (all versions through 3.4.5) lets an authenticated attacker who holds an Employer or Sales Representative role push attacker-controlled files onto the server, which on a standard WordPress/LAMP stack typically escalates to remote code execution and full site takeover. The issue is scored CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and the scope-change metric reflects that the impact crosses out of the plugin into the underlying host, while the low complexity and lack of user interaction mean an attacker only needs a valid low-privileged account. There is no CISA KEV listing and no public exploit identified at time of analysis, but the practical barrier collapses on sites that allow open self-registration of employer or vendor accounts, making this a genuine high-priority vulnerability that should be patched promptly.
Arbitrary file upload in the WordPress plugin Taskbot (versions 6.6 and earlier) lets an authenticated attacker with only a subscriber-level account upload executable files to the server, which can be leveraged to run code and take full control of the hosting site. The vulnerability is rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and stems from missing file type/extension validation in the plugin's upload handler (CWE-434); the scope-change metric reflects that compromising the plugin escalates into compromise of the whole WordPress installation. Exploitation requires a valid account at the subscriber role or higher - on sites that allow self-registration, that role is trivially obtainable by anyone, lowering the effective barrier close to unauthenticated. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so sites running Taskbot 6.6 or earlier should treat this as high priority.
WP Duplicate, a WordPress plugin maintained by Revmakx, fails to validate uploaded files in versions up to and including 1.1.11, letting a user holding only a Subscriber-level account push an arbitrary file (for example a PHP script) onto the server. The published CVSS 3.1 score is 9.9 (AV:N/AC:L/PR:L/UI:N, with S:C in the vendor/registry vector while the independent assessment scores S:U with C:H/I:H/A:H); exploitation is remote, low-complexity and needs no user interaction, and the practical barrier is simply that the target site must allow the attacker to hold a Subscriber account, which self-service registration makes trivial. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, so impact is potential rather than observed, but the low privilege requirement keeps the risk high for any site with open registration.
SQL injection in the web-based management interface of ClearPass Policy Manager lets a low-privileged authenticated remote attacker inject arbitrary SQL and run database commands against the underlying ClearPass instance, yielding high confidentiality, integrity and availability impact with a scope change (CVSS 3.1 base 9.9). The flaw is not pre-authentication: the attacker must already hold a valid low-privilege operator account or session on the management UI (PR:L), and no non-default feature or special configuration is needed beyond that (AC:L, UI:N). There is no public exploit identified at time of analysis and no known active exploitation, but the severity plus the sensitivity of the data held by a network access control policy store make this a genuine high-priority remediation item rather than a high-CVSS outlier.
The Bitbucket pull-request Scaffolder actions in Backstage can be abused by an authenticated user with template-execution rights and influence over the target Bitbucket repository to copy files outside the intended temporary workspace, potentially affecting backend confidentiality, integrity or availability. Deployments running @backstage/plugin-scaffolder-backend-module-bitbucket-cloud before 0.3.10 or @backstage/plugin-scaffolder-backend-module-bitbucket-server before 0.2.25 (Backstage before 1.54.6) are affected; the vendor rates the issue CVSS 9.9 (scope changed, PR:L). No public exploit identified at time of analysis (EPSS 0.33%, CISA SSVC exploitation: none), but vendor-released fixed versions exist and the issue carries an act_now priority.
Code execution in Handlebars.js versions 4.0.0 through 4.7.9 occurs when an application hands an attacker-controllable, pre-parsed AST object - rather than a template string - to Handlebars.compile() or Handlebars.precompile(); the compiler writes JavaScript expressions carried in unchecked AST fields straight into the generated code, which then executes in the server process wherever the compiled output runs. The flaw is an incomplete fix: the AST validation added in 4.7.9 for CVE-2026-33937 covered only PathExpression, NumberLiteral and BooleanLiteral values, leaving fields such as Program.blockParams.length, a non-PathExpression parameter depth, a non-string StringLiteral.value and a non-string PathExpression.original unvalidated. The published CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H (9.8) and treats this as trivially remote and unauthenticated, but that materially overstates real-world exposure: the vulnerable path is a non-default application design pattern that the vendor explicitly warns against, so applications that compile only template strings - the standard, documented usage - are completely unaffected, and no public exploit code has been identified at time of analysis. Vendor-released patch: 4.7.10.
Missing integrity verification in the HPE Networking ClearPass Policy Manager client agent allows remote unauthenticated attackers to introduce untrusted code that the agent then executes on the enrolled client system, giving full code execution on that endpoint. Only systems running the vulnerable client agent (for example OnGuard deployments) are exposed; the ClearPass server itself is not the target of this flaw, and organizations that do not deploy the agent are unaffected. The input CVSS of 9.8 reflects the worst case, but the authoritative independent assessment scores it AV:N/AC:H, because the attacker must first be able to supply or substitute the code the agent consumes - typically a man-in-the-middle position on the agent's communication or update channel, or control of a source the agent implicitly trusts. There is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so the practical risk is conditional on the attacker obtaining that network positioning or trusted-source access.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.12.2 allows attackers to execute arbitrary code via improper control of code generation (CWE-94). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicates remote, unauthenticated, low-complexity exploitation with full confidentiality, integrity, and availability impact, though the independent assessment notes the pre-auth condition is not independently confirmed by the description. A vendor patch is available, and no public exploit code has been identified at time of analysis; risk is highest for internet-exposed instances within the affected version range.
Unauthenticated remote code execution is the exposure created by a format string flaw in a service interface of HPE Networking ClearPass Policy Manager: an attacker who can reach the vulnerable interface can supply crafted input that corrupts process memory and, on successful exploitation, execute arbitrary code in the context of the affected service, with high confidentiality, integrity and availability impact (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code or confirmed active exploitation is identified at the time of analysis, and the report originates from HPE's own security-alert address, but the absence of authentication, user interaction or attack complexity means exploitation is straightforward for any attacker with network reachability to the interface. The practical limiting factor is exposure: ClearPass management and service interfaces are normally confined to segmented management networks, so internet-facing or user-network-reachable deployments carry the greatest immediate risk.
Missing integrity verification in the HPE ClearPass Policy Manager OnGuard agent allows an unauthenticated, remote attacker to execute arbitrary code with the agent's elevated privileges on managed endpoints. In practice, exploitation requires the attacker to intercept, modify, or impersonate the data/update channel the agent trusts (e.g., adversary-in-the-middle or rogue server), meaning the vendor's low-complexity rating (CVSS 9.8) is tempered by this positioning requirement. No public exploit code has been identified at time of analysis, and there is no indication of active exploitation (not in CISA KEV).
Unauthenticated remote code execution in the web interface of HPE Networking ClearPass Policy Manager allows an attacker who can reach that interface over the network to run arbitrary code on the appliance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms no authentication, no user interaction, and low attack complexity, with full confidentiality, integrity, and availability impact - a genuine high-priority vulnerability rather than a high-CVSS-but-low-risk artifact. No public exploit identified at time of analysis; the practical limiting factor is network exposure of the ClearPass web interface, so deployments reachable from the internet or broad internal networks are at direct risk while those restricted to isolated management networks or behind VPN/firewall controls are substantially less exposed.
Unauthenticated privilege escalation in Meta Box AIO versions 3.7.1 and earlier allows remote attackers to gain elevated privileges on WordPress sites where the plugin is installed and active. With a CVSS score of 9.8 (Critical) and a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, the flaw requires no authentication or user interaction and can be exploited over the network. No public exploit code has been identified at the time of analysis, but the vulnerability is rated critical due to its potential for full site compromise.
Authentication bypass in HPE Networking ClearPass Policy Manager allows an unauthenticated remote attacker to circumvent existing authentication controls on the product's web-based management and API interfaces and obtain administrative access to the affected system. The flaw carries a vendor-assessed CVSS of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, no user interaction, and no special configuration are required - only network reachability to a management or API endpoint, which in many deployments is restricted to management VLANs or admin networks, making exposure control the primary practical limiting factor. Our assessment rates this a genuine top-priority vulnerability rather than a high-CVSS-but-low-real-risk case; no public exploit code and no confirmed active exploitation were identified at time of analysis, and ClearPass is a network access control / policy enforcement platform, so administrative compromise can extend impact well beyond the appliance itself.
Authentication bypass in HPE Aruba Networking ClearPass Policy Manager allows an unauthenticated remote attacker to circumvent existing authentication controls on the affected interface and gain unauthorized access to the system, rated CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code was identified and the vulnerability is not confirmed actively exploited (no CISA KEV), but the assessed vector shows no credentials, no user interaction and no special configuration required, implying default-configuration exploitability where the interface is reachable. Independent assessment concludes the available signals point to a genuine high-priority issue rather than a CVSS-inflated non-issue; the exact affected versions and the specific exposed service are not named in the available HPE bulletin, so exposure of the interface is the primary risk-limiting factor.
Unauthenticated privilege escalation in the Amentotech Taskbot plugin for WordPress (versions 6.6 and earlier) allows any remote attacker to elevate privileges on a vulnerable site without credentials or victim interaction, as reflected by the CVSS 3.1 vector PR:N/UI:N/AC:L and a 9.8 base score. Because the flaw sits in privilege-assignment logic that is reachable in the plugin's default configuration, a standard installation that simply has Taskbot active is exposed; the practical limiting factor is that exposure depends entirely on this relatively uncommon plugin being deployed. There is confirmed actively exploited status absent - no CISA KEV entry was provided - and no public exploit code was identified in the supplied intelligence at time of analysis, so this should be prioritized on the basis of severity and ease of exploitation rather than observed attacks, with the caveat that corroborating intelligence is sparse and comes primarily from the Patchstack report.
Unauthenticated SQL injection in HPE Aruba Networking ClearPass Policy Manager allows a remote attacker who can reach the affected interface to inject arbitrary SQL into the application's database layer, with successful exploitation enabling execution of arbitrary database commands. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials or user interaction are required and the confidentiality, integrity, and availability impact is total; any ClearPass instance whose management/web service is reachable from an untrusted network is directly at risk. No public exploit code has been identified at time of analysis and the flaw is not in CISA's KEV catalog, but the pre-authentication, network-reachable profile and the database-command execution outcome make this a high-priority item for exposure reduction and patching per the HPE advisory.
Path traversal in HPE Aruba ClearPass Policy Manager allows an authenticated attacker with access to the management interface to read and modify files on the underlying operating system. The independent assessment rates this as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, requiring a valid session and network reachability to the management plane; the vendor's stated vector with PR:N conflicts with the description's authentication prerequisite. No public exploit code or CISA KEV entry is identified at time of analysis.
Payload CMS releases before 3.90.0 (and canary builds before 4.0.0-canary.34) expose an orderable reorder endpoint that writes document order changes without evaluating collection or field-level update access control, allowing a caller who can reach that endpoint to alter the sort position of documents in any collection or join field that has the orderable option enabled. The vendor's own fix commit confirms the pre-patch endpoint accepted arbitrary orderableFieldName values and performed the underlying update with access checks bypassed (overrideAccess true), and the post-fix code now rejects unconfigured fields with HTTP 400 and re-runs executeAccess per document, so exploitation depends on the orderable feature being explicitly configured and the achievable impact is confined to the ordering field rather than arbitrary document content. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; authentication requirements are not confirmed from available data, and the input CVSS of 9.8 (triple-High impact) is inconsistent with the source-code evidence, which supports the lower assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.
Unauthenticated remote attackers can gain elevated privileges against Dell Container Storage Modules deployments because the CSM Authorization component ships with hard-coded credentials, as described in CWE-798 and scored CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Every CSM release prior to 1.18.0 is affected per the vendor advisory DSA-2026-448, and exploitation requires only that the CSM Authorization service be deployed and reachable over the network - no account, token, or user interaction is needed. Exposure is bounded by deployment footprint: only Kubernetes clusters using CSM Authorization to front Dell storage arrays are at risk, and network segmentation that keeps the authorization service off untrusted networks materially reduces reachability. No public exploit code and no confirmed active exploitation were identified at the time of analysis, but the unauthenticated, no-interaction exploit profile makes this a high-priority patch candidate.
Unauthenticated PHP Object Injection in the GDPR Framework By Data443 WordPress plugin through version 2.5.0 allows remote attackers to pass crafted serialized data to a PHP unserialize() path, potentially achieving full confidentiality, integrity, and availability impact if a usable gadget chain is reachable. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) confirms network-reachable, low-complexity, unauthenticated exploitation with no user interaction; the only prerequisite is an active vulnerable plugin installation. No public exploit code or CISA KEV entry was identified at time of analysis, though reliable code execution depends on the presence of a gadget chain in the plugin, WordPress core, or other loaded components.
Privilege elevation on Dell client endpoints that have Dell Command | Configure (DCC) installed at a version below 5.2.3.35, driven by improper handling of mixed encoding (CWE-175) that allows crafted, ambiguously encoded input to be processed in a way that yields elevated rights. Dell labels the flaw 9.8 with an AV:N/AC:L/PR:N/UI:N vector, but our independent assessment treats it as a local, low-privilege-triggered defect (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) because DCC is an optional local client-configuration utility rather than a network service and the advisory never identifies a remotely reachable interface - the input signals are sharply conflicting and must not be reconciled uncritically. There is no public exploit identified at time of analysis, EPSS is low at 0.27% (18th percentile), CISA SSVC records exploitation as none, and a vendor patch is available.
An out-of-bounds write in the Linux kernel's siw (Soft-iWARP) RDMA driver lets a connected iWARP peer corrupt kernel memory by delivering an extended DDP/RDMAP header split across more than one TCP receive callback; the miscalculated copy length (hdrlen - MIN_DDP_HDR instead of the number of missing bytes) pushes the destination past the header, overwrites the receive state including fpdu_part_rcvd, and a later callback reuses that corrupted value as a copy offset. The upstream CVSS 3.1 vector scores this 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates it AV:N/AC:H (8.1) because exploitation requires the siw driver to be loaded - it is not enabled in default Linux configurations - and requires the attacker to control TCP segmentation so the header spans multiple callbacks; no authentication is needed once an RDMA session exists. Exploitation status: no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and the issue is not listed in CISA KEV, though a vendor patch is available for the stable branches.
Out-of-bounds read and write in the Linux kernel's RDMA Soft-RoCE (rxe) driver (CVE-2026-98365) lets an unauthenticated peer on an already-established RDMA queue pair send a crafted RDMA-Write or RDMA-Read RETH whose iova+length wraps to zero, bypassing the mr_check_range() bounds check and causing a kernel oops (and possible memory corruption) in rxe_mr_copy_xarray(). No public exploit code was identified at time of analysis and EPSS is low at 0.17% (5th percentile), but realistic exposure is gated by configuration: the rdma_rxe module must be loaded and the host must expose Soft-RoCE on a reachable interface, which is not the default Linux setup. Vendor-released patches are available in stable kernels 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.
Denial of service in the Dbit WIFI4 N300 1.0.0 router allows an attacker who is already associated with the device's local Wi-Fi network to crash its management interface by sending an HTTP request to the /api/login endpoint that omits the username or password field, which the device's JSON parser cannot handle. No authentication is required (CVSS PR:N), but exploitation demands Wi-Fi adjacency/association rather than internet reachability, and the realized effect is limited to loss of availability of the web management interface - there is no described path to data disclosure or code execution. The input CVSS 3.1 base score of 9.8 (AV:N/.../C:H/I:H/A:H) substantially overstates real-world risk; our independent assessment scores it CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and EPSS is very low at 0.15% (4th percentile), with no public exploit and no CISA KEV listing identified at time of analysis.
Fork-originated Gitea Actions workflows can run on a base repository's registered runners without the required approval when a repository maintainer performs ordinary pull request triage, such as adding a label, because the approval decision was keyed to the user who triggered the event rather than the fork pull request author, allowing fork-controlled workflow code to execute in the base repository's CI context. Gitea versions up to and including 1.27.3 are affected when Actions is enabled and a matching runner is registered; the issue is fixed in Gitea 28.0.0. No public exploit code was identified at time of analysis and EPSS is low (0.15%, 3rd percentile), but exploitation is not autonomous: the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) requires an attacker-submitted fork pull request plus a privileged maintainer action, and CISA SSVC rates the technical impact as total, so the outcome when the prerequisite chain is met is full compromise of confidentiality, integrity, and availability of the workflow execution environment.
Mitigation bypass in Mozilla Firefox's File Handling component affects Firefox builds prior to 157.0.1 and lets an attacker defeat a protection mechanism that Firefox relies on when a user opens, downloads, or otherwise processes an attacker-supplied file. The input CVSS 3.1 vector rates this 9.8 CRITICAL, but the supporting evidence contradicts that: the vulnerability is a CWE-693 protection-mechanism failure whose practical impact depends on chaining it with a second attack rather than achieving standalone compromise, it is client-side and requires user interaction with malicious content, and the independent assessment scores it AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. Exploitation is unauthenticated per the vector (PR:N), exploitation is not automatable against a server, EPSS is a low 0.14% (3rd percentile), SSVC records Exploitation: none, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. A vendor patch is available in Firefox 157.0.1, so patched users are not exposed.
A use-after-free in the Android Bluetooth stack (bluetooth_ccc.cc, function BluetoothCccHandlerCallbackImpl) lets an attacker within Bluetooth radio range execute arbitrary code on unpatched Android devices, with no user interaction and no additional execution privileges required. The flaw is rated CVSS 9.8 under the vendor's AV:N vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); our independent assessment re-scores it AV:A because exploitation realistically requires the device's Bluetooth to be enabled and the attacker to be within radio range to deliver crafted CCC/GATT traffic, while agreeing that no authentication or victim action limits the attack. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and a fix is published in the Android/Pixel security bulletin dated 2026-10-01.
SQL injection in Payload CMS 3.0.0 through before 3.88.0 (and 4.0.0-canary builds before 4.0.0-canary.27) allows remote attackers to inject arbitrary SQL when the instance runs the SQLite (@payloadcms/db-sqlite) or Postgres (@payloadcms/db-postgres) adapter and untrusted users can query readable collections while supplying dynamic filters or join parameters. MongoDB-backed deployments are explicitly not affected, and the practical blast radius is bounded by which collections are readable to the attacker - if access control blocks those queries or dynamic filter/join input is not accepted, exploitation is blocked (the vendor-documented workaround). Vendor patches ship in 3.88.0 and 4.0.0-canary.27; no public exploit code was identified at time of analysis, and our independent assessment rates this a genuine high-priority issue with read-confidentiality impact dominating (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) rather than the vendor-published 9.8.
Path traversal in Dell System Update (DSU) versions prior to 2.3.0.0 allows an unauthenticated remote attacker to escape the intended restricted directory when the DSU client processes crafted pathnames in update content, resulting in filesystem access. Because DSU operates with elevated privileges, exploited path traversal can escalate to arbitrary code execution as root, potentially compromising both the application and the underlying operating system. Exploitation is not automatic: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) shows remote, unauthenticated reach but a mandatory user interaction step, and no public exploit code was identified at time of analysis. Dell has published a fixed release, and this is a genuinely high-priority flaw rather than merely a high-CVSS outlier.
Authenticated Backstage users can retrieve the internal execution data of other users' Scaffolder tasks - notably the SerializedTask secrets field (including __initiatorCredentials) and state.checkpoints - through the scaffolder-backend task API in versions prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0. Where scaffolder tasks or templates place credentials for an external service into those fields, the disclosure can extend to unauthorized changes in that external system, which is reflected in the assigned CRITICAL 9.6 score (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) and its scope change. Exploitation requires a valid authenticated account with permission to read the target task, and no public exploit has been identified at time of analysis.