Sensitive information is inserted into log files by the Apache Geode Web Management component in versions 2.0.0 through 2.0.2, so any party able to read those logs can recover the exposed confidential values (CWE-532, high confidentiality impact only). The NVD entry scores this 7.5 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, but our independent assessment applies AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - the practical constraint is obtaining access to the generated log output or a UI that surfaces it, so real-world exploitation is materially harder than the 7.5 network-vector score implies and authentication requirements are not settled by the available data. Exploitation is not confirmed actively exploited (CISA KEV does not list this CVE), no public exploit code has been identified at time of analysis, and EPSS is low at 0.17 percent (6th percentile), making this a moderate-priority information-disclosure issue rather than an urgent remote-compromise risk.
Denial of service via out-of-bounds slice access in the Nickname profile of golang.org/x/text/secure/precis (all versions before 0.41.0), where transforming crafted input into a short destination buffer triggers a Go runtime panic. The flaw is remotely reachable and unauthenticated (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, base 7.5), but impact is confined to availability (C:N/I:N/A:H) because Go's memory-safe runtime converts the invalid slice access into a panic rather than exploitable memory corruption. Applications are only exposed if they actually invoke the precis Nickname profile on attacker-controlled strings such as usernames or nicknames; projects that merely depend on x/text without hitting that code path are unaffected. No public exploit identified at time of analysis, and vendor-released patch: golang.org/x/text 0.41.0.
ImageMagick before 7.1.2-31 and 6.9.13-56 resolves image coders before applying its security-policy authorization check, so a crafted image can invoke a coder that a policy.xml rule with domain='coder' was meant to block and read data the policy prohibits. Real exposure is much narrower than the CVSS 7.5 network vector implies: the flaw is only meaningful where an administrator has actually configured a coder-domain policy (installations without one have no control to bypass), and the target application must still parse attacker-supplied images. With EPSS at 0.14% (3rd percentile), SSVC exploitation rated none, and no public exploit or CISA KEV activity identified at time of analysis, this is a low-urgency hardening item rather than an emergency.
Authenticated attackers holding BugTracker.NET administrator privileges can achieve server-side code execution by first reconfiguring the application so that attachments are stored in a web-accessible directory, then uploading an .aspx file that the attachment feature fails to filter by extension. Because the uploaded file lands in a location the web server serves and ASP.NET/IIS will process executable handlers there, requesting its URL runs arbitrary code under the web service account. Exploitation is heavily gated: it requires PR:H administrator access and a non-default storage configuration (reflected as AT:P in the CVSS 4.0 vector), and no public exploit code has been identified at time of analysis; the signals consistently describe this as a low real-world priority issue despite a high CVSS 4.0 base score of 7.5.
Operating system command injection in BugTracker.NET's SVN integration lets an authenticated administrator store malicious arguments in the repository configuration field, which are later concatenated into an svn.exe command line and executed when the revision-comparison feature is invoked, yielding arbitrary command execution under the application service account's privileges. Exploitation requires a high-privileged (administrator) account, the optional SVN integration to be enabled, and svn.exe to be installed and invokable by the service account (AT:P in the vendor CVSS 4.0 vector), so the realistic attack surface is narrow despite the network vector. There is no public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; the reported CVSS score is 7.5, though our independent assessment rates the practical risk lower given the layered prerequisites.
Connection-pool key scoping in AsyncHttpClient (AHC) 2.0.0 through 3.0.13 omits identity-defining fields for Kerberos, SPNEGO, NTLM, authenticated proxy and SOCKS/CONNECT login paths, so a request can be handed a pooled keep-alive socket that was already authenticated as an entirely different identity and then execute under that first identity's credentials, exposing the other identity's data or authority. Reachability is conditional: the application must use Kerberos/SPNEGO/NTLM, an authenticated proxy realm, or SOCKS/CONNECT proxy logins, and specifically the ambiguous cases where login has no configured principal, where realms are proxy realms, where distinct identities share a user name, or where proxy logins are used - clients using only HTTP Basic/Digest or a single identity/principal are not affected. Rated CVSS 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, CWE-346 Origin Validation Error); exploitation depends on timing the reuse of an already-authenticated socket across multiplexed callers, and there is no public exploit identified at time of analysis and no CISA KEV listing. Vendor-released patch: 3.0.14.
Cisco Meraki MR wireless access point software, MX security appliance firmware, MV camera firmware, and Cisco Campus Gateway Software can be crashed by an unauthenticated attacker positioned on the same Layer-2 adjacency (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 7.4) due to insufficient control flow management (CWE-691) fixed in a vendor hardening release. Exploitation is confined to attackers with an existing local foothold or wireless/physical proximity; it is not reachable from a routed or internet position, and the assessed impact is availability loss only, with no confidentiality or integrity compromise. There is no public exploit identified at time of analysis and no CISA KEV listing; the flaw was discovered through Cisco's internal security review rather than through exploitation reporting.
OAuth 2.0 bearer token compromise in Express Gateway through 1.16.11 is possible when a deployment keeps the default crypto.cipherKey value 'sensitiveKey' and an attacker can read the Redis datastore. The attacker can decrypt stored tokenEncrypted values, combine them with stored token IDs, and obtain valid bearer tokens for any user, causing high confidentiality and integrity impact while availability remains unaffected. This is not remotely exploitable without preconditions: the assessed vector requires high privileges (PR:H), a present attack requirement (AT:P), and high complexity (AC:H), and no public exploit was identified at time of analysis; it is not confirmed actively exploited (CISA KEV).
Denial of service in Progress Telerik Document Processing's SpreadProcessing library (all versions prior to 2026.3.1006) allows unauthenticated remote attackers to hang an application CPU thread indefinitely by supplying a specifically corrupted XLS spreadsheet for import. The crafted file drives the XLS import routine into an infinite loop that ignores the library's configured import timeout, so the built-in timeout safeguard offers no protection and the affected worker thread becomes permanently unresponsive. Practical exposure depends on whether the host application actually accepts XLS uploads or imports from untrusted sources; no public exploit code or confirmed active exploitation has been identified at time of analysis, and impact is availability-only per our assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with the vendor publishing a base score of 7.3.
Unauthenticated server-side request forgery (SSRF) in the Cisco Finesse web-based management interface lets remote attackers send crafted HTTP requests that cause the device to make requests to associated services, potentially exposing limited sensitive information. The flaw is caused by improper input validation for specific HTTP requests and requires network reachability to the management interface but no credentials or user interaction; CVSS 3.1 score is 7.2, driven largely by scope change rather than severe direct impact. No public exploit identified at time of analysis.
Stored cross-site scripting (XSS) in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin through version 6.3.1 allows unauthenticated attackers to inject arbitrary web scripts into registration metadata that executes when a user views a page rendering a Kirki users collection with an image element bound to one of nine registration meta fields. Exploitation requires that public user registration is enabled, that a published page contains a `kirki-register` element (which exposes the necessary nonce in public markup), and that an image element is bound to a registration meta field; default installations without open registration are not affected. A vendor patch is available in version 6.3.2, and no public exploit code has been identified at the time of analysis.
Privilege escalation in HashiCorp Vault and Vault Enterprise allows an authenticated principal with delegated permissions to bypass explicit deny ACL rules by referencing a resource or policy name in non-canonical form, potentially reaching a protected resource or assigning a denied policy. Affected are Vault Community Edition before 2.1.2 and Vault Enterprise before 2.1.2, 1.21.12, 1.20.17, and 1.19.23, rated CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an already high-privileged, delegated user (PR:H) operating in a policy model that depends on explicit deny rules, and no public exploit code or confirmed active exploitation was identified at time of analysis (no EPSS data was provided), so this is best handled as a defense-in-depth hardening fix rather than an emergency.
Stored cross-site scripting in the OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress affects every version up to and including 6.3.10, allowing unauthenticated attackers to inject arbitrary script through the 's' search parameter as it is handled by the plugin's comments-atom feed flow; the payload is written into a retained .tmp file and executes when a victim later loads the affected page or file. Exploitation is conditional rather than automatic: it only succeeds where the front-end web server serves that .tmp artifact without a Content-Type header and without X-Content-Type-Options: nosniff, so that a MIME-sniffing Chromium-based browser treats it as HTML and runs the script, a configuration the advisory notes is common by default on many Apache and nginx/php-fpm deployments. No public exploit code has been identified and the issue is not listed in CISA KEV; because the assessed vector requires high attack complexity and a non-sniffing or correctly-headered server blocks the attack entirely, this is a genuine but conditional, moderate-risk issue rather than a top-tier emergency. A vendor-released fix is available in 6.3.11.
Remote code execution in SonicWall SMA1000 (Appliance Management Console) can be triggered by an authenticated administrator who uploads a crafted archive containing path traversal sequences, allowing files to be written outside the intended extraction directory and leading to code execution. The vulnerability is a classic Zip Slip (CWE-22) issue with a CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker must already hold high/administrative privileges on the AMC-a significant precondition that sharply limits the pool of realistic attackers to compromised or malicious administrators. No public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none), so this is a conditional high-severity risk rather than a mass-exploitation emergency.
Out-of-bounds read in the OpenVPN client before 2.7.8 can be triggered when the client establishes a TLS session with a malicious or compromised server that pushes a crafted option combination touching domain_search_list, producing an unsigned integer underflow that leads to a limited memory disclosure and a high-availability-impact client crash. The defect is client-side rather than a flaw in a server accepting inbound connections, and exploitation requires the attacker to control or impersonate the endpoint the victim connects to (the assessed CVSS 3.1 vector carries PR:L for exactly this reason). There is no public exploit identified at time of analysis and the issue is not in CISA KEV; the vendor CVSS 4.0 base score is 7.1 (VC:L/VA:H) and the vendor-released fix is OpenVPN 2.7.8.
Resource exhaustion in the Excelize Go library (versions 2.1.0 through 2.11.0) lets a crafted .xlsx workbook drive excessive CPU and memory consumption - up to process OOM - when an application loads the file and later invokes a column-mutating API such as SetColWidth. The root cause is a missing bounds check in flatCols, which iterates from an attacker-controlled column minimum to an attacker-controlled maximum and performs a deep copy plus append for every declared column number instead of clamping to the spreadsheet's 16,384-column limit. Exploitation requires a victim or service to parse the malicious workbook (UI:P) and then perform a column operation on it; no authentication to the library is required (PR:N), no public exploit code has been identified at time of analysis, and no fixed release is available - although an upstream fix exists as a pull request and commit. CVSS 4.0 base score is 7.1 with availability-only impact (VC:N/VI:N/VA:H); the impact is denial of service, not confidentiality or integrity loss.
Authenticated path traversal in the web portal of Satel Iberia's SenNet Datalogger Serie 200 allows a low-privileged portal user to read arbitrary files and list directories accessible to the web server's system account, exposing configuration or confidential data. The issue is scored CVSS 7.1 with a CVSS 4.0 vector of AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, and the independent assessment rates it a moderate-severity confidentiality issue rather than a top-priority emergency. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical risk is highest where the device web interface is reachable from untrusted networks or where default, shared, or weak portal credentials are in use.
Persistent denial of service in Absolute Secure Access servers before 14.60 can be triggered by an authenticated remote attacker who sends malformed data to the client registration process, causing availability impact that outlasts the triggering request. The flaw requires network reachability and valid credentials, as reflected by PR:L in the vendor and independent vectors, so it is not an unauthenticated attack; no public exploit identified at time of analysis. The vendor rates it CVSS 7.1 High, while the independent assessment characterizes it as a genuine but moderate-priority availability issue because of the authentication prerequisite and availability-only impact.
Reflected cross-site scripting in the WordPress plugin 'Disable and Remove Google Fonts | GDPR & DSGVO friendly' through version 2.0.2 allows remote attackers to inject arbitrary script into a victim's browser session, rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The flaw is unauthenticated from the network perspective but requires a victim to follow a crafted link or otherwise trigger the malicious request (UI:R), with the scope change reflecting that the injected script executes in the context of the victim's browser against the affected site. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or CISA KEV data was supplied with this report; the vulnerability was disclosed by Patchstack.
Reflected cross-site scripting in the Everest Forms WordPress plugin through version 3.6.1 lets remote, unauthenticated attackers run arbitrary script in a victim's browser when that victim opens a specially crafted URL. Successful exploitation requires the victim to actively click or open the malicious link (UI:R) on a site running an affected version, and because the payload is reflected rather than stored it must be re-triggered per victim per click; the impact is confined to the browser session and the site's origin (scope changed) rather than server-side compromise. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), exploitation requires no attacker credentials, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting (CWE-79) in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, affecting all versions through 2.0.19, allows an attacker to persist malicious JavaScript that executes in the browser of any user - including administrators - who later views the affected page, widget, or template. The vendor advisory rates this 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), but our independent assessment applies PR:L: realistic exploitation requires an authenticated account with content-editing capability (contributor/author or higher) to submit and store the payload, and the UI:R condition means a separate victim must load the poisoned page before the script fires - so this is not a zero-interaction, unauthenticated attack against default configurations. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied.
Account-deactivation privilege escalation in wger before 2.6 lets an authenticated user who holds only the gym_trainer role disable higher-privileged accounts - including gym_manager and general_gym_manager - within the same gym, locking those users out of the application entirely. Access control on UserDeactivateView (and the mirror-image UserActivateView) uses OR logic across gym.manage_gym, gym.manage_gyms and gym.gym_trainer, with no privilege-hierarchy check and only a same-gym membership check in dispatch(), so the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - an insider/lower-privileged-role escalation, not a remote unauthenticated attack, and one that cannot cross gym boundaries. Publicly available exploit code exists (the vendor advisory itself publishes a working PoC of the GET request), but there is no confirmed active exploitation (CISA KEV) and no EPSS score was supplied in the intelligence feed; a gym manager provisioning a trainer account, which get_permission_list() always allows, is the amplifying path by which a trainer can then turn around and disable the manager who created it.
Cross-tenant information disclosure in wger allows an authenticated trainer account that holds both the gym.gym_trainer and gym.add_adminusernote permissions but has no gym assignment (userprofile.gym = None) to read private admin notes, uploaded documents, gym contracts, user configuration and permission data belonging to any other unassigned (gym = None) user on the same instance. The root cause is an authorization guard that fails open: the five affected views compare gym objects with the Python operator '!=', and 'None != None' evaluates to False, so HttpResponseForbidden is never reached and the following queryset is filtered only by the attacker-supplied member_id. Rated CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, authenticated, low privilege), the bug is amplified because gym = None is the default state for newly registered users, so any instance with public registration plus delegated trainer permissions is exposed; a detailed proof-of-concept is documented in the published GitHub advisory and the permission-edit endpoint is also reachable, giving a possible privilege-escalation path, though no confirmed in-the-wild exploitation has been reported.
MISP instances configured to force TOTP enrolment (Security.otp_required) could be used indefinitely by an authenticated user who never completed second-factor setup, because the enrolment guard in AppController::__verifyUser was enforced only for standard browser requests; AJAX/XHR calls, REST API requests, .json format URLs, restSearch queries and automation actions bypassed the check since those request shapes cannot follow the redirect to the TOTP page. The affected range is MISP versions below 2.5.48, and exploitation requires a valid authenticated session for an account that has not enrolled in TOTP and whose role lacks perm_skip_otp, with identities authenticated by API key explicitly exempt (logged_by_authkey). Assessed impact is high for confidentiality and integrity (CVSS 3.1 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), with no public exploit identified at time of analysis; risk is real but conditional on the non-default otp_required hardening setting, so patched builds should be applied on a normal, prioritized schedule rather than as an emergency.
Obot versions 0.12.0 through 0.26.1 return admin- and power-user-supplied static secrets (API keys, tokens) on MCP catalog entries in plaintext to any user who has been granted that entry through Obot's access-control rules, exposing credentials for abuse against backend services. Affected users need a valid Obot account at basic privilege plus an explicit grant on the target entry, and the entry must actually carry admin-set static configuration values, so anonymous exploitation is not possible and only a subset of catalog entries is reachable in practice; the assessed severity is moderate (CVSS 7.1, confidentiality-only impact with no integrity or availability loss). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); the vendor has released a fix in Obot v0.26.2.
Denial of service in MiniUPnPd through 2.3.11: an unauthenticated attacker on the adjacent/local network can terminate the UPnP IGD daemon by sending a single multicast SSDP M-SEARCH datagram to UDP port 1900 containing an 'MX: 0' header together with a known/valid ST value, which trips a divide-by-zero (SIGFPE) inside ProcessSSDPData() and takes down UPnP IGD service. The flaw is reachable only in builds compiled with the non-default --strict option, which is the principal limiting factor; the result is a crash with no data exposure, integrity loss, or code execution. Exploitation status per available data: no public exploit identified at time of analysis, and no CISA KEV entry confirming active exploitation.
Path traversal in the BugTracker.NET file download component allows an authenticated remote attacker to read files outside the intended download directory by supplying a manipulated filename parameter, exposing any file readable by the account running the web application. Exploitation requires a valid BugTracker.NET session (any account able to reach the download handler that accepts a user-supplied filename) and no user interaction; the blast radius is bounded by the operating-system permissions of the application's service account, so a hardened, least-privilege IIS identity materially limits the disclosure. The issue is rated 7.1 (CVSS 4.0) with high confidentiality impact and no integrity or availability effect, and there is no public exploit identified at time of analysis, though the low attack complexity and widespread wildcard CPE coverage make the class of bug attractive to post-authentication attackers who already hold a low-privileged account.