Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.12.2 lets any attacker who can reach the service execute arbitrary operating system commands on the underlying host. Rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw requires no credentials, no user interaction, and no non-default configuration, so a default Langflow deployment exposed beyond localhost is directly exploitable. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); IBM has published a vendor advisory with a fix, and practical risk is concentrated in self-hosted developer instances that are bound to reachable interfaces rather than being restricted to localhost or placed behind authentication and firewalling.
Unauthenticated remote attackers with IP reachability to an affected Cisco NX-OS device can achieve arbitrary code execution with root privileges - or force a process crash and device reload - by sending crafted packets to the VXLAN Operation, Administration, and Maintenance (NGOAM) feature. The flaw is a stack-based buffer overflow (CWE-121) triggered by insufficient validation of IP traffic, and it is fully unauthenticated and requires no user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:N), yielding a 9.8 base score. Exploitation is gated by configuration: NGOAM is not part of a default NX-OS base image and must be explicitly enabled, so only VXLAN deployments that have turned the feature on and that expose an IP interface to the attacker are exposed; no public exploit code or confirmed active exploitation was identified at time of analysis, but the high EPSS-relevant severity and pre-auth RCE impact warrant priority patching on any NGOAM-enabled fabric.
Unauthenticated remote command execution in Splunk Enterprise search head cluster members allows any network-reachable attacker to run operating-system commands as the Splunk service account. The flaw (CWE-306) is that the Patroni REST API exposed on a search head cluster member performs critical configuration operations without requiring authentication, so an attacker who can reach that interface can invoke it directly - no credentials needed. Only deployments running search head clustering on Splunk Enterprise versions below 10.4.3 or below 10.2.7 are exposed; 10.0.x and 9.4.x are explicitly unaffected. CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) reflects a maximum-severity, low-complexity path with full confidentiality, integrity and availability impact, and no public exploit code or confirmed active exploitation has been identified at time of analysis, so exposure is driven mainly by whether the Patroni REST API port is reachable from untrusted networks.
Unauthenticated SQL injection in the OrdaSoft Simple Membership extension for Joomla (versions before 7.4.0) allows any remote attacker to read and manipulate the site's backend database through crafted input to the checkLoginPass task. The site/simplemembership.php endpoint dispatches task=checkLoginPass with no authentication or access-control check and concatenates the login request parameter straight into a SQL query with no escaping or parameterization, which scores 9.3 under CVSS 4.0 with PR:N and no user interaction required. Exploitation needs only that the component be installed and enabled on a publicly reachable Joomla site - no credentials, user interaction, or non-default setting - and no public exploit identified at time of analysis.
Unauthenticated PHP object injection in the String Locator WordPress plugin (versions before 2.6.8) lets an attacker store a crafted serialized PHP object in a database row via the plugin's database editor, with no authentication required (PR:N per the assessed vector). The payload only fires when a site administrator subsequently opens and saves that row in the editor, which is the UI:R precondition, and it escalates to remote code execution, arbitrary file deletion, or sensitive data disclosure only if a suitable POP gadget chain exists in another installed plugin or component, which is why our independent assessment rates attack complexity as High (AC:H) despite the raw CVSS 8.8 vector using AC:L. Publicly available exploit code exists, but the two gating conditions (an admin save action plus a usable gadget chain) meaningfully reduce real-world exploitability, and no CISA KEV listing confirms active exploitation.
Privilege escalation in the Koinonia Link WordPress plugin (versions 1.1.2 through earlier than 1.1.5) lets any authenticated user, including a low-privileged subscriber, grant themselves the Administrator role by tampering with the role value submitted during a profile update. The flaw is a missing authorization check on the role-save routine (CWE-269), not a memory-safety or injection bug, and it is remotely reachable with no user interaction (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8), meaning successful exploitation yields total control of the WordPress site. Publicly available exploit code exists and the vendor has released a fix in 1.1.5; the practical barrier is only the need for a valid account, so sites with open self-service registration are exposed to unauthenticated attackers who simply register first, while sites with registration disabled limit the threat to existing users.
One-click account takeover in Telegram Desktop before 7.2.9, where the Core::Sandbox inter-process communication layer fails to neutralize the semicolon record separator in URLs delivered through tg:// links. An attacker who gets a victim to open a crafted tg:// link can smuggle an extra OPEN: record into the IPC stream; that record is dispatched to the interpret: scheme handler, which uploads attacker-chosen local files - most damagingly the tdata session keys - to an attacker-controlled channel, giving full control of the victim's Telegram account. The issue is unauthenticated and needs no non-default configuration (CVSS PR:N, default install); the sole prerequisite is passive user interaction, namely opening the attacker-supplied link, and publicly available exploit code exists. CISA KEV does not list this issue as confirmed actively exploited.
Unauthenticated payment-result forgery in the Nexi XPay Build WordPress plugin through 7.6.2 lets any remote attacker mark arbitrary orders as paid or failed, cancel those orders at will, and retrieve the order keys that unlock guest buyers' personal details. The vulnerable surface is the plugin's payment-result handling routes, which accept a supplied payment result without verifying it, so no credentials, user interaction, or non-default configuration are needed beyond a site running the plugin as an active Nexi XPay gateway. Publicly available exploit code exists via the WPScan advisory, and although there is no confirmed active exploitation (not listed in CISA KEV), the high integrity impact on order state and the exposure of guest customer data make this an actionable priority; exploitation is limited in practice only by the narrow installed base of this specific gateway plugin.
Denial of service in the Excelize Go library (versions 2.1.0 through 2.11.0) allows an attacker-controlled spreadsheet to pin a CPU core for an arbitrary duration when a Go application calls File.GetRows or iterates Rows.Next/Rows.Columns on the untrusted file. The bug is an inconsistency in the row-number limit: Rows.Next enforces the TotalRows (1,048,576) cap, but Rows.Columns consumes the 'r' attribute of a crafted <row> element located after an ordinary valid row without that cap, so the iterator walks every missing row number instead of rejecting the workbook. Impact is availability-only (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), unauthenticated but requiring the application to accept and parse attacker-supplied XLSX files; no public exploit code was identified at time of analysis and no fixed release exists, though an upstream fix is present in PR #2438/commit 01a9ff32. This is a genuine but bounded denial-of-service issue (CWE-770, uncontrolled resource consumption).
Unauthenticated attackers can forge payment-notification callbacks to the Nexi XPay Build WordPress plugin (through version 7.6.2) and mark arbitrary WooCommerce orders as paid - or downgrade genuinely paid orders to a failed status - because the plugin skips its security-token comparison whenever the targeted order has no stored token. The issue is remotely reachable at low complexity with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5), and the impact is purely integrity-based: no confidentiality loss, but direct tampering with order and payment state on the store. Publicly available exploit code exists; however, no CISA KEV listing or other confirmation of active exploitation is present in the supplied intelligence, and exploitation is constrained to orders that happen to be in the tokenless condition.
Authenticated users holding the WordPress Editor role on sites running the WP Coder plugin (versions 4.0 up to but not including 4.5.2) can save and execute arbitrary PHP code on the server, resulting in full site compromise. The flaw is a privilege-boundary failure: the plugin gates its PHP code-execution feature on a content capability that the Editor role holds by default rather than restricting it to administrators, so no plugin misconfiguration is needed. Exploitation requires an existing Editor-level (or higher) account - it is not remote-unauthenticated - but publicly available exploit code exists, and the vendor has released WP Coder 4.5.2 to fix it. No confirmed active exploitation (CISA KEV) has been reported, so risk is concentrated on sites that hand Editor access to semi-trusted contributors.
Reflected cross-site scripting in the Magee Shortcodes WordPress plugin through version 2.1.1 lets unauthenticated attackers inject script into pages by abusing AJAX actions that reflect unsanitised user input back to the browser. Exploitation requires a victim with an active session to be socially engineered into clicking a crafted link pointing at one of the plugin's unauthenticated AJAX endpoints, and the resulting impact is bounded by that victim's privileges - a moderated session yields limited damage, while an administrator session could enable actions such as session or content manipulation. CVSS 3.1 scores the issue 7.1 (AV:N/AC:L/PR:N/UI:R/S:C), WPScan is credited with the report, and publicly available exploit code exists, though there is no evidence of confirmed active exploitation (CISA KEV) and no vendor-released fixed version has been identified at time of analysis.
Reflected cross-site scripting in the If-So Dynamic Content WordPress plugin (versions 1.4.4 through below 1.10.2) lets an unauthenticated attacker supply a value whose URL scheme is not validated, which is then reflected into a link on a plugin admin page and executed as arbitrary JavaScript in the browser of a logged-in administrator who opens a crafted link. Publicly available exploit code exists and is documented in the WPScan advisory (also tracked as ENISA EUVD-2026-94188), so this is a non-persistent, socially-engineered attack that must be delivered to each victim individually rather than mass-exploited. The assessed CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, with no availability impact in our assessment) reflects the scope change inherent to XSS in a privileged admin context, but the practical impact is bounded by the user-interaction prerequisite and by the fact that a privileged WordPress user must be lured into clicking the link.
Insecure direct object reference (IDOR) in Gophish through 0.12.1 lets any authenticated, low-privileged user take over other users' groups, templates, landing pages, and sending profiles by supplying a victim's sequential object ID to the API create endpoints (/api/groups/, /api/templates/, /api/pages/, /api/smtp/). Because the server trusts the client-supplied ID instead of assigning a new one, the attacker can overwrite and reassign the victim's objects, locking the original owner out and exposing their recipient lists. Exploitation requires a valid account on a multi-user deployment (a single-operator install has no victims to hijack), and publicly available exploit code exists; there is no confirmed in-the-wild exploitation (CISA KEV) and no vendor patch was identified at time of analysis.
Credential stuffing and unlimited password guessing against the Gophish phishing-simulation platform through version 0.12.1 are enabled by a login rate-limit bypass: the throttling middleware keys its counter on a client address that is rewritten from the attacker-supplied X-Forwarded-For or X-Real-IP header, so an unauthenticated remote attacker who sends a different forwarded address with every request never trips the limiter. Publicly available exploit code exists (documented in the Ostorlab review and VulnCheck advisory), and the flaw is rated CVSS 4.0 6.9 / assessed CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); it is not confirmed actively exploited, so exploitation depends on whether the /login endpoint is network-reachable and whether targeted accounts use weak, default, or guessable credentials. The issue is genuine but moderate in severity rather than a top-tier emergency, and its real-world impact is sharply reduced for instances whose admin interface is not exposed to untrusted networks.
Authenticated stored cross-site scripting in the Envira Gallery WordPress plugin before 1.16.1 allows users with Author role or higher to inject arbitrary web scripts through unsanitized gallery display configuration values, which are stored and later rendered into an image tag attribute. The injected script executes when any visitor, including an administrator, views a page containing the affected gallery; exploitation requires an authenticated low-privilege account and a victim page view. Publicly available exploit code exists, but no CISA KEV active-exploitation flag is provided; the independent assessment rates it as requiring Author+ access with user interaction and limited confidentiality/integrity impact.
Stored cross-site scripting (XSS) in Envira Gallery WordPress plugin before 1.16.1 allows an authenticated user with Author role or higher to store a malicious gallery item identifier that is output unsanitized in an image tag attribute, causing script execution when any visitor, including an administrator, views a page embedding the gallery. Publicly available exploit code exists for this issue, but it is not listed in CISA KEV in the provided data; the vendor has released a patch in version 1.16.1. The input rates this CVSS 6.8 (Medium), while the independent assessment vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
SQL injection in the MPG WordPress plugin before 4.2.3 allows authenticated users holding the Editor role or higher to inject crafted data through the plugin's project-import functionality, causing sensitive records such as WordPress password hashes to be read out of the database. The flaw is CWE-89: imported project data is not structurally validated before it is concatenated into a database query. Publicly available exploit code exists (per WPScan and the CVE.org reference), though the vulnerability is not confirmed actively exploited (CISA KEV), and its practical reach is bounded by the PR:H vector - anonymous visitors and low-privilege accounts (Subscriber, Contributor) cannot trigger it. Upgrading to version 4.2.3 removes the condition.
Second-order SQL injection in the Animated Number Counters WordPress plugin before version 3.1 allows an attacker with an Editor-level account to store a crafted counter value that is later concatenated into an SQL query and executed when any unauthenticated visitor loads a page containing the counter, enabling extraction of arbitrary database contents including password hashes. The flaw requires an existing Editor account (authenticated, high privileges) for the initial injection, but the malicious SQL runs without further authentication. A vendor patch (version 3.1) is available, and publicly available exploit code exists; the assessed CVSS vector (6.8, PR:H, scope changed) reflects the privileged prerequisite and high confidentiality impact.
Uploading a specially structured CSV file through GitLab CE/EE's import functionality lets an authenticated user with import rights overwhelm the instance's Sidekiq background workers, degrading or stalling asynchronous job processing across the deployment (CVSS 6.5, availability-only impact). The defect exists in every release from 11.7 up to the fixed versions 18.8.9, 18.9.5, and 18.10.3, and publicly available exploit code exists, documented in the linked HackerOne report; CISA's SSVC assessment records no observed exploitation and classifies the issue as not automatable, and our independent assessment rates it a genuine but moderate-priority issue rather than an emergency. Because the CVSS vector specifies PR:L with AV:N/AC:L/UI:N, only authenticated accounts that can reach a CSV import feature are affected - anonymous or pre-authentication attacks are not possible, and the risk is highest on multi-tenant or internet-facing instances that allow low-trust users to self-register or bring data in.
A crafted Excel (.xlsx) file can crash any Go application that parses it with Excelize 2.0.0 through 2.11.0 using a non-streaming worksheet API, resulting in an unrecovered panic that terminates the process. The bug occurs when a row lists a higher-column cell (e.g. D1) before a lower-column final cell (e.g. B1): checkRow sizes its backing cell slice from the last cell in document order, so the earlier cell's column index falls outside the slice and triggers an out-of-bounds access. Exploitation requires the victim or application to load the malicious workbook (UI:R), impact is limited to availability with no data disclosure or code execution, and no public exploit was identified at time of analysis; an upstream fix is available as a PR/commit but a released patched version is not independently confirmed.
Optimole WordPress plugin versions 4.0.0 through 4.2.15 expose the site's stored third-party image-optimization service credentials to any authenticated user, including the lowest-privilege Subscriber role, because the account dashboard widget renders that data without a capability check. Exploitation requires only a valid account on the affected site and no user interaction, giving a complete confidentiality loss (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with the practical risk driven mostly by whether open self-registration lets an outsider obtain the required Subscriber session. Publicly available exploit code exists and the vendor shipped a patch in 4.2.15; this issue is not confirmed actively exploited (CISA KEV) and should be treated as a legitimate medium-severity flaw rather than a high-urgency threat.
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.1.0, fixed in 3.1.1) allows any remote attacker to fetch a plugin-generated log file left inside a web-accessible directory, exposing the site's carrier integration key and customer order data. Recovering the integration key lets an attacker tamper with WooCommerce order statuses, so the issue carries both confidentiality and limited integrity impact (CVSS 6.5, PR:N/UI:N per the assessed vector). Publicly available exploit code exists and the flaw is trivially automatable, though no confirmed active exploitation has been observed, and the affected plugin has a narrow deployment base.
Username enumeration in Gophish through 0.12.1 allows unauthenticated remote attackers to distinguish valid administrator accounts from invalid ones by measuring response-time differences in the login handler, which performs a bcrypt comparison for existing users but short-circuits for unknown ones. Rated low-to-moderate priority (CVSS 4.0 6.3; assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N with low confidentiality impact), the flaw yields only a list of valid usernames and does not authenticate an attacker, disclose passwords, or modify data. Publicly available exploit code exists, but there is no evidence of active exploitation and no CISA KEV listing; real-world exposure is sharply limited to deployments where the Gophish admin interface (POST /login) is reachable from an untrusted network, since the recommended deployment keeps it on an internal or VPN-only segment.
Unauthenticated remote attackers can bypass the cryptographic signature verification on authentication tokens in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem, SSM On-Prem), so a forged JSON Web Token is accepted as authentic and the licensing server can be fully compromised; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields a 10.0, meaning no credentials and no user interaction are required, low complexity, a scope change, and high impact to confidentiality, integrity and availability. Cisco's internal hardening review addressed this together with other internally discovered issues, and the advisory-linked hardening releases are the fix path, with no exact patched version numbers disclosed in the available data; the practical limiting factor is network exposure of the management/licensing interface, since the attacker must be able to reach the instance. No CISA KEV entry exists and no public exploit code has been identified at time of analysis, so this is a maximum-severity but not yet observed-exploited issue.
Pre-authentication server-side request forgery in the SonicWall SMA1000 Appliance's Work Place interface lets a remote attacker who can reach the appliance abuse an unintended alternate access path that bypasses authentication and coerce the device into issuing requests on the attacker's behalf, reaching internal functionality that is not otherwise exposed externally (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - high confidentiality impact, low integrity impact, no availability impact). Affected builds are SMA1000 12.4.3-03526 (platform-hotfix) and older, and 12.5.0-02952 (platform-hotfix) and older; because the Work Place portal is normally internet-facing on these remote-access appliances, exposure is broad and this is a genuine top-priority vulnerability rather than a high-CVSS-but-low-risk artifact. No public exploit identified at time of analysis, and exploitation requires only default network reachability with no credentials and no user interaction, so the practical impact is bounded mainly by which internal services the appliance can reach through the forged requests.
Unauthenticated command injection in the Fanvil X7A IP phone's web management portal (firmware 2.6.0.1182) lets any attacker who can reach the diagnostic ping tool execute arbitrary commands with the privileges of the underlying Android operating system, resulting in total device compromise (CVSS 10.0, scope-changed, S:C). No credentials or user interaction are required (PR:N/UI:N), publicly available exploit code exists, and CISA's SSVC assessment rates the flaw fully automatable with total technical impact, so any deployment with the portal reachable from untrusted or flat networks should be assumed exploitable at scale. In correctly segmented environments the real-world attacker population is limited to hosts with management-VLAN or LAN reachability to the phone's portal.
Remote code execution can result in IBM Langflow OSS 1.0.0 through 1.12.2 through a dependency confusion weakness, where the product resolves an expected dependency from a public package registry instead of the intended trusted source. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates an unauthenticated remote attacker with no user interaction required, and the unpatched severity is rated 9.8; however, our independent assessment lowers the attack complexity to AC:H because successful exploitation depends on the attacker knowing or guessing the exact dependency name and on the victim's resolver preferring an attacker-published public package over the legitimate one, typically during an install, build, or import event rather than against a running service. There is no confirmed active exploitation (CISA KEV does not list this CVE), SSVC records Exploitation: none and Automatable: no, no public exploit code has been identified at time of analysis, and EPSS is only 0.68% (51st percentile), so the practical near-term risk is materially lower than the 9.8 headline suggests. A vendor patch is available per the IBM advisory.
Remote code execution in LMCache multiprocess (distributed) mode allows unauthenticated attackers to execute arbitrary code as the LMCache process user by sending a crafted msgpack message with extension code 1 to the ZeroMQ ROUTER transport (default TCP port 5555). The flaw occurs because DeviceIPCWrapper.Deserialize calls pickle.loads on untrusted data before the request handler runs; official container images run as root, amplifying impact. Network exploitation requires the operator to have configured a routable --host for multi-node deployments (default binds to localhost), and no public exploit code has been identified at time of analysis.
Homer (sipcapture/homer-app) deployments running in the default internal authentication mode bootstrap an administrator account with the hardcoded credentials admin / sipcapture and never force a password change, so any unauthenticated attacker who can reach the /api/v3/auth login endpoint can obtain a full admin JWT on a freshly deployed instance. The GitHub advisory publishes working exploit code (a two-request curl sequence against /api/v3/auth and /api/v3/users), and no lockout, rate limiting, or first-login change requirement is in place, making publicly available exploit code exist for this CWE-798 hardcoded-credential flaw. Vendor fixes ship in Homer 11.0.283 (commit b2e942031ff8cd7435a244ebef306ee97d16b809), which replaces the fixed bootstrap hash with a random password logged once at startup or an operator-supplied admin_password_hash.
Unauthenticated information disclosure in the WordPress plugin Integration for Epos Now and WooCommerce (versions 4.6.0 through 4.11.1) lets any remote visitor who can reach an unprotected REST endpoint read the site's scheduled background tasks together with their stored arguments, exposing WooCommerce order identifiers and, under narrower conditions, the plaintext passwords of newly registered customers queued for WooCommerce's deferred-emails feature. No credentials or user interaction are required (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), but the high attack complexity reflects two dependencies: WooCommerce's deferred-emails option must be enabled, and a freshly registered customer's email task must still be present in the scheduled-task queue when the request is made. Publicly available exploit code exists and vendor patch 4.11.2 is available; exploitation has not been confirmed in the wild, and the practical blast radius is limited by the conditional nature of the password exposure.
Unauthenticated remote code execution in the NX-API feature of Cisco NX-OS Software lets a remote attacker who can reach the NX-API listener run arbitrary code with root privileges, or crash processes hard enough to force a device reload (DoS), by sending a single crafted HTTP request. Exposure is conditional: NX-API is an optional, non-default feature, so only NX-OS devices and UCS-managed systems where it has been explicitly enabled are vulnerable to an attacker with routing access to the management/HTTP endpoint; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials or user interaction are required once that exposure exists. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV, but the 9.8 severity, root-level impact, and full CIA loss make this a high-priority item for any environment exposing the NX-API management plane.
Remote code execution and denial of service in Cisco NX-OS Software are possible when the SRv6 OAM (NGOAM) and SRv6 features are both enabled, due to a stack-based buffer overflow (CWE-121) from improper input validation of IP traffic. An unauthenticated, remote attacker with network reachability to an IP interface can send crafted packets to execute arbitrary code with root privileges or cause a reload, resulting in a DoS condition. Exploitation requires the non-default configuration of both NGOAM and SRv6 features; no public exploit was identified at time of analysis, and no CISA KEV listing exists.
Remote code execution with root privileges and denial-of-service in Cisco NX-OS Software can be triggered by unauthenticated network attackers when the NGOAM (VXLAN OAM) feature is enabled. Crafted IP packets sent to a device IP interface exploit improper input validation (stack buffer overflow, CWE-121), allowing arbitrary code execution or process crashes that reload the device. No public exploit identified at time of analysis; the non-default NGOAM configuration requirement limits exposure, but this remains a high-priority vulnerability per our independent assessment.
Unauthenticated, remote code execution with root privileges and denial of service in Cisco NX-OS Software on Nexus 3000 Series and Nexus 9000 Series switches, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A crafted MPLS echo-request packet sent to an IP address on an affected device is processed without proper validation, letting an attacker execute arbitrary code as root and crash critical processes, which can force a device reload. The decisive exposure prerequisite is that the MPLS OAM feature must be enabled and reachable, and MPLS OAM is not on by default in most deployments; there is no public exploit identified at time of analysis and no KEV listing is indicated by the provided intelligence.
Missing authentication in the HOMER (sipcapture Homer) coordinator allows remote unauthenticated attackers to fully control the administrative API whenever the JWT signing secret is left at its default empty value. Because JWTMiddleware and JWTMiddlewareV4 both short-circuit with next(c) when the secret is empty - and the middleware is not even registered on the protected route groups in that state - every endpoint under /api/v1, /api/v3 and /api/v4 is reachable without credentials, permitting reads and writes of users, configuration, database connection strings and stored VoIP call data, including creation of a new admin user. The flaw carries a 9.8 CVSS (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) under CWE-306, is unauthenticated by vector, and a vendor fix is available per the advisory; exploitation status is no public exploit identified at time of analysis, though the vendor advisory itself contains curl-based reproduction steps.
Missing authentication for critical functions in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem, SSM On-Prem) lets unauthenticated remote attackers reach protected functionality with no credentials and no user interaction, exposing confidentiality, integrity, and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). The issues were discovered during Cisco's own internal security review and are bundled into a hardening release documented in Cisco advisory cisco-sa-hardening-ssm-Ph77wdhf rather than being tied to a single feature or endpoint. No public exploit code and no confirmed active exploitation have been identified at time of analysis, but because the licensing server is frequently deployed on internal networks with broad reach to managed devices and license data, any internet- or flat-network-exposed instance should be treated as an urgent patch priority.
PHP object injection in The Events Calendar WordPress plugin (all versions through 6.17.4, published by Liquid Web / StellarWP) allows an attacker to pass crafted serialized data into a deserialization code path and instantiate arbitrary PHP objects, which can escalate to code execution, data theft or full site compromise if a usable POP gadget chain exists in the plugin, WordPress core or any other installed theme/plugin. The supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a remote, unauthenticated, no-interaction attack, but the advisory does not name the vulnerable endpoint, and comparable Patchstack object-injection findings frequently require at least a low-privilege authenticated session; our independent assessment therefore keeps the same impact ratings while treating exploitability as high-complexity (AC:H). There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is driven by whether a reachable gadget chain is present on a given WordPress installation rather than by confirmed active exploitation.
Unauthenticated remote attackers who can reach the management/API plane of the Cisco Application Policy Infrastructure Controller (APIC) could potentially achieve full compromise of confidentiality, integrity, and availability, as reflected by the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue was discovered by Cisco's own engineering team during an internal security review of APIC and falls under CWE-664, the improper control of a resource through its lifetime; affected coverage in the supplied CPE is a wildcard for all APIC versions, so no specific vulnerable build range is enumerated. At time of analysis there is no public exploit identified and no CISA KEV confirmation, although APIC's role as a data-center SDN controller on typically isolated management networks is the principal practical barrier to exploitation rather than any input-confirmed technical prerequisite.
Improper neutralization flaws in Cisco Application Policy Infrastructure Controller (APIC), the software controller for Cisco ACI data-center fabrics, allow unauthenticated network-reachable attackers to achieve full confidentiality, integrity, and availability impact - the input assigns CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issues were found during Cisco's own internal hardening review and are bundled as a single CVE covering multiple CWE-707 (Improper Neutralization) weaknesses rather than one disclosed trigger path; no specific protocol, endpoint, or non-default configuration prerequisite is documented. No public exploit code and confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied. Practically, exploitability hinges on reachability of APIC management/controller interfaces, which are normally confined to isolated out-of-band management networks, so real-world exposure is largely limited to insiders or attackers who have already pivoted into the management segment. Patches are available per the Cisco advisory cisco-sa-hardening-apic-UOXWtfh; because the reference is a hardening release rather than a single tagged fix, an exact fixed version string was not provided in the input data.
Unauthenticated remote access-control bypass in Cisco APIC gives network-reachable attackers full compromise of confidentiality, integrity, and availability (CVSS 9.8) against the ACI data-center controller. The CVE groups multiple internally discovered improper access control issues (CWE-284) addressed by Cisco hardening releases, and the provided data does not enumerate exact affected versions, so the Cisco advisory must be used to confirm vulnerable releases. No public exploit identified at time of analysis; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is remotely reachable without authentication or user interaction, though real-world exposure depends on reachability to APIC's typically isolated management/API plane.
Improper access control in Cisco NX-OS - including NX-OS running in ACI mode and the NX-OS component of managed Cisco Unified Computing System deployments - could allow a remote, unauthenticated attacker to bypass access restrictions and achieve full compromise of confidentiality, integrity, and availability (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue was identified during a Cisco internal security review and is addressed in a NX-OS software hardening release rather than a single-point bug fix, with the advisory grouping multiple internally discovered access-control weaknesses under CVE-2026-76455. At time of analysis no public exploit code or confirmed active exploitation has been identified, and the specific vulnerable feature, protocol, or configuration mode is not disclosed in the available data, so exposure must be validated against the Cisco advisory before triage.
Out-of-bounds write defects in Cisco NX-OS Software - spanning standalone NX-OS switches, NX-OS System Software running in ACI mode, and NX-OS-based software managed through Cisco UCS - carry a vendor CVSS of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning a remote, unauthenticated attacker with network reachability could potentially cause high confidentiality, integrity, and availability impact. The issues were discovered during a Cisco internal security review and are delivered as part of a bundled software hardening release rather than a single pinpointed defect, so the affected subsystem, protocol, or port is not enumerated in the available data. At time of analysis there is no public exploit identified, CISA SSVC records exploitation as 'none' with automatable 'no', and EPSS is low at 0.28% (19th percentile), indicating manual, targeted rather than scalable risk.
Unauthenticated users who can reach the websocket handler on a Fanvil X7A device running firmware 2.6.0.1182 can read operational logs and issue diagnostic requests without ever establishing a session, because the handler does not enforce authentication for sessionless connections. The affected scope is narrowly defined: only that specific firmware build is reported, and exploitation requires nothing more than network reachability to the device's management websocket, with no credentials, user interaction, or configuration change (CVSS vector PR:N/UI:N, and the upstream advisory rates it 9.8). Signals around this issue conflict: MITRE scores it 9.8/C:H/I:H/A:H, while the independent assessment lands at 8.6 with C:H/I:L/A:L, and EPSS is low at 0.19% (8th percentile) with no public exploit code identified at time of analysis and no CISA KEV listing, so real-world risk is driven far more by whether the device is exposed than by current exploitation activity.
Improper neutralization (injection-class weakness, CWE-707) in Splunk Enterprise lets an attacker submit crafted input through a network-reachable Splunk interface and achieve high impact across confidentiality, integrity, and availability - per our independent assessment, exploitation requires low-privilege authentication (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), even though the upstream NVD-style vector claims PR:N/unauthenticated. Affected are Splunk Enterprise 10.4 before 10.4.3, 10.2 before 10.2.7, 10.0 before 10.0.10, and 9.4 before 9.4.15; the vendor grouped multiple internally identified findings by CWE and assigned this CVE to the neutralization group, so the advisory names no single endpoint or feature. No public exploit code has been identified at time of analysis, EPSS is only 0.15% (4th percentile), and the vulnerability is not listed as confirmed actively exploited (CISA KEV), so urgency should be driven by the critical severity and the accessibility of the affected interface rather than by observed exploitation.
Splunk Enterprise installations at versions below 9.4.15, 10.0.10, 10.2.7, and 10.4.3 are affected by a coding-standard defect that the vendor rates at CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning a remote, unauthenticated network attacker could in principle achieve full loss of confidentiality, integrity, and availability. The issue is one of several internally identified findings that Splunk grouped under CWE-710 (Improper Adherence to Coding Standards) and documents in advisory SVD-2026-1002; because the advisory groups multiple defects by weakness class, it does not enumerate the specific component, feature, or configuration prerequisite involved, so the exact attack path cannot be confirmed from available data. Practical risk is presently tempered: EPSS is only 0.14 percent (3rd percentile) and there is no public exploit identified at time of analysis, with no CISA KEV listing indicating confirmed active exploitation; the dominant exposure factor is network reachability to the Splunk web interface or management port, which in many enterprise deployments is restricted to internal networks rather than internet-exposed.
Unauthenticated command injection in the Fanvil x7a IP phone's web management portal (firmware 2.6.0.1182) allows any attacker who can reach the portal's diagnostic ping tool to inject shell metacharacters and execute arbitrary commands on the underlying Android operating system, compromising confidentiality, integrity and availability equally (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). The practical gating factor is exposure: the portal is normally reachable only from a LAN or management VLAN, so risk falls sharply wherever it is not reachable from untrusted networks. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis - CISA's SSVC rates Exploitation as 'none' while classifying the flaw as automatable with total technical impact, meaning exploitation could spread quickly once a proof-of-concept surfaces.
Adjacent-network buffer management flaws in Cisco Meraki OS let an unauthenticated attacker within Layer 2 or wireless range trigger memory-safety failures on Cisco Meraki MR wireless access points, MV cameras, MX appliances, and Campus Gateway software, with the grouped advisory rated CVSS 9.6 (scope change plus high confidentiality, integrity, and availability impact). Exploitation requires the attacker to already sit on the same broadcast domain, Layer 2 segment, or RF coverage area - the flaw is not reachable from the routed internet - and the hardening bulletin does not disclose which protocol or feature actually triggers the CWE-119 condition. No public exploit code or confirmed active exploitation was identified at time of analysis; the fix ships as part of a vendor internal hardening release rather than a discrete single-version patch.
Denial of service in Open5GS up to and including 2.7.7: an unanswerable or failing PFCP Session Report path triggered from the GTP-U receive code causes the UPF (and the parallel SGW-U path) to abort or to leak PFCP transaction objects, degrading or halting user-plane service. The flaw is CWE-770 uncontrolled resource allocation in the GTP-U receive path (src/upf/gtp-path.c, ogs_pfcp_xact_local_create) and is remotely reachable without authentication or user interaction (CVSS:3.1 AV:N/AC:L/PR:N/UI:N), though in a correctly segmented 5G core the N3/GTP-U socket is exposed only to the access network (gNB) rather than the public internet. Impact is availability-only (CVSS 5.5, A:L, no confidentiality or integrity effect); publicly available exploit code exists, and no confirmed actively exploited (CISA KEV) status has been reported.
Authenticated users holding only the low-privileged 'Backup Viewer' role on Veeam Backup & Replication can leverage a deserialization flaw to execute arbitrary code as SYSTEM on the backup server, turning a read-only backup monitoring account into full control of the backup infrastructure (CVSS 9.4; CWE-502). The attack is network-reachable (AV:N) and requires no user interaction, but it is not unauthenticated: a valid Backup Viewer account or stolen credentials for that role are mandatory (PR:L), which realistically limits exposure to insiders, credential-theft scenarios, or attackers who have already chained into the environment. The high severity is compounded by the scope change (S:C) and full loss of confidentiality, integrity, and availability across the backup server and connected systems; no public exploit code or confirmed active exploitation was identified at time of analysis.