Unauthenticated PHP object injection in the String Locator WordPress plugin (versions before 2.6.8) lets an attacker store a crafted serialized PHP object in a database row via the plugin's database editor, with no authentication required (PR:N per the assessed vector). The payload only fires when a site administrator subsequently opens and saves that row in the editor, which is the UI:R precondition, and it escalates to remote code execution, arbitrary file deletion, or sensitive data disclosure only if a suitable POP gadget chain exists in another installed plugin or component, which is why our independent assessment rates attack complexity as High (AC:H) despite the raw CVSS 8.8 vector using AC:L. Publicly available exploit code exists, but the two gating conditions (an admin save action plus a usable gadget chain) meaningfully reduce real-world exploitability, and no CISA KEV listing confirms active exploitation.
Privilege escalation in the Koinonia Link WordPress plugin (versions 1.1.2 through earlier than 1.1.5) lets any authenticated user, including a low-privileged subscriber, grant themselves the Administrator role by tampering with the role value submitted during a profile update. The flaw is a missing authorization check on the role-save routine (CWE-269), not a memory-safety or injection bug, and it is remotely reachable with no user interaction (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8), meaning successful exploitation yields total control of the WordPress site. Publicly available exploit code exists and the vendor has released a fix in 1.1.5; the practical barrier is only the need for a valid account, so sites with open self-service registration are exposed to unauthenticated attackers who simply register first, while sites with registration disabled limit the threat to existing users.
One-click account takeover in Telegram Desktop before 7.2.9, where the Core::Sandbox inter-process communication layer fails to neutralize the semicolon record separator in URLs delivered through tg:// links. An attacker who gets a victim to open a crafted tg:// link can smuggle an extra OPEN: record into the IPC stream; that record is dispatched to the interpret: scheme handler, which uploads attacker-chosen local files - most damagingly the tdata session keys - to an attacker-controlled channel, giving full control of the victim's Telegram account. The issue is unauthenticated and needs no non-default configuration (CVSS PR:N, default install); the sole prerequisite is passive user interaction, namely opening the attacker-supplied link, and publicly available exploit code exists. CISA KEV does not list this issue as confirmed actively exploited.
Unauthenticated payment-result forgery in the Nexi XPay Build WordPress plugin through 7.6.2 lets any remote attacker mark arbitrary orders as paid or failed, cancel those orders at will, and retrieve the order keys that unlock guest buyers' personal details. The vulnerable surface is the plugin's payment-result handling routes, which accept a supplied payment result without verifying it, so no credentials, user interaction, or non-default configuration are needed beyond a site running the plugin as an active Nexi XPay gateway. Publicly available exploit code exists via the WPScan advisory, and although there is no confirmed active exploitation (not listed in CISA KEV), the high integrity impact on order state and the exposure of guest customer data make this an actionable priority; exploitation is limited in practice only by the narrow installed base of this specific gateway plugin.
Denial of service in the Excelize Go library (versions 2.1.0 through 2.11.0) allows an attacker-controlled spreadsheet to pin a CPU core for an arbitrary duration when a Go application calls File.GetRows or iterates Rows.Next/Rows.Columns on the untrusted file. The bug is an inconsistency in the row-number limit: Rows.Next enforces the TotalRows (1,048,576) cap, but Rows.Columns consumes the 'r' attribute of a crafted <row> element located after an ordinary valid row without that cap, so the iterator walks every missing row number instead of rejecting the workbook. Impact is availability-only (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), unauthenticated but requiring the application to accept and parse attacker-supplied XLSX files; no public exploit code was identified at time of analysis and no fixed release exists, though an upstream fix is present in PR #2438/commit 01a9ff32. This is a genuine but bounded denial-of-service issue (CWE-770, uncontrolled resource consumption).
Unauthenticated attackers can forge payment-notification callbacks to the Nexi XPay Build WordPress plugin (through version 7.6.2) and mark arbitrary WooCommerce orders as paid - or downgrade genuinely paid orders to a failed status - because the plugin skips its security-token comparison whenever the targeted order has no stored token. The issue is remotely reachable at low complexity with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5), and the impact is purely integrity-based: no confidentiality loss, but direct tampering with order and payment state on the store. Publicly available exploit code exists; however, no CISA KEV listing or other confirmation of active exploitation is present in the supplied intelligence, and exploitation is constrained to orders that happen to be in the tokenless condition.
Authenticated users holding the WordPress Editor role on sites running the WP Coder plugin (versions 4.0 up to but not including 4.5.2) can save and execute arbitrary PHP code on the server, resulting in full site compromise. The flaw is a privilege-boundary failure: the plugin gates its PHP code-execution feature on a content capability that the Editor role holds by default rather than restricting it to administrators, so no plugin misconfiguration is needed. Exploitation requires an existing Editor-level (or higher) account - it is not remote-unauthenticated - but publicly available exploit code exists, and the vendor has released WP Coder 4.5.2 to fix it. No confirmed active exploitation (CISA KEV) has been reported, so risk is concentrated on sites that hand Editor access to semi-trusted contributors.
Reflected cross-site scripting in the Magee Shortcodes WordPress plugin through version 2.1.1 lets unauthenticated attackers inject script into pages by abusing AJAX actions that reflect unsanitised user input back to the browser. Exploitation requires a victim with an active session to be socially engineered into clicking a crafted link pointing at one of the plugin's unauthenticated AJAX endpoints, and the resulting impact is bounded by that victim's privileges - a moderated session yields limited damage, while an administrator session could enable actions such as session or content manipulation. CVSS 3.1 scores the issue 7.1 (AV:N/AC:L/PR:N/UI:R/S:C), WPScan is credited with the report, and publicly available exploit code exists, though there is no evidence of confirmed active exploitation (CISA KEV) and no vendor-released fixed version has been identified at time of analysis.
Reflected cross-site scripting in the If-So Dynamic Content WordPress plugin (versions 1.4.4 through below 1.10.2) lets an unauthenticated attacker supply a value whose URL scheme is not validated, which is then reflected into a link on a plugin admin page and executed as arbitrary JavaScript in the browser of a logged-in administrator who opens a crafted link. Publicly available exploit code exists and is documented in the WPScan advisory (also tracked as ENISA EUVD-2026-94188), so this is a non-persistent, socially-engineered attack that must be delivered to each victim individually rather than mass-exploited. The assessed CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, with no availability impact in our assessment) reflects the scope change inherent to XSS in a privileged admin context, but the practical impact is bounded by the user-interaction prerequisite and by the fact that a privileged WordPress user must be lured into clicking the link.
Insecure direct object reference (IDOR) in Gophish through 0.12.1 lets any authenticated, low-privileged user take over other users' groups, templates, landing pages, and sending profiles by supplying a victim's sequential object ID to the API create endpoints (/api/groups/, /api/templates/, /api/pages/, /api/smtp/). Because the server trusts the client-supplied ID instead of assigning a new one, the attacker can overwrite and reassign the victim's objects, locking the original owner out and exposing their recipient lists. Exploitation requires a valid account on a multi-user deployment (a single-operator install has no victims to hijack), and publicly available exploit code exists; there is no confirmed in-the-wild exploitation (CISA KEV) and no vendor patch was identified at time of analysis.
Authenticated remote code execution affects IBM Langflow OSS 1.0.0 through 1.12.2, where improper control of code generation lets any account with at least low privileges (CVSS PR:L, AV:N, UI:N) cause attacker-supplied code to run server-side on the Langflow host, yielding high confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation is not possible against a default install without valid credentials, and no public exploit code or confirmed active exploitation was identified at time of analysis. The practical exposure therefore concentrates on internet-reachable or multi-tenant instances that permit self-registration or host untrusted users; isolated, single-tenant, network-restricted deployments with trusted operators carry substantially lower risk.
Command injection in GitAhead 2.7.1 and earlier on macOS allows an attacker to execute arbitrary shell commands as the victim user by placing a crafted filename containing a double quote and AppleScript payload into a repository and convincing the victim to select 'Show in Finder' on that file. The flaw requires user interaction (the victim must open an attacker-controlled repository and explicitly trigger the action) and affects only macOS; no public exploit code or active exploitation has been identified at time of analysis. The CVSS 4.0 score is 8.7 with a vector indicating network attack, no privileges required, and passive user interaction.
Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.12.2 allows an authenticated attacker with flow-authoring privileges to inject and execute arbitrary code through Langflow's code-generation mechanism (CWE-94). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates this as high severity (8.8), requiring network reachability, low privileges, and no user interaction; however, in typical deployments where flow creation or modification is broadly granted, the practical barrier may be lower than the PR:L metric implies. No public exploit code or CISA KEV entry has been identified at time of analysis, and EPSS is 0.61% (48th percentile); IBM has released a vendor patch.
LMCache through 0.5.5 ships a multiprocess-mode HTTP management/internal API server that binds to all network interfaces by default with no authentication, letting remote unauthenticated attackers reach management endpoints that should never be exposed. An attacker who can reach the management port can read process environment credentials via GET /env, read configuration via GET /config, clear or delete cached objects, and modify tenant quotas so that other tenants' cached data is evicted. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), but exploitation requires only that LMCache runs in multiprocess mode and that the management port is network-reachable, so exposure is bounded mainly by network segmentation rather than by any authentication or user-interaction barrier (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/C:H/I:L/A:H).
Authenticated code injection in IBM Langflow OSS 1.0.0 through 1.12.2 lets any remote user holding a valid low-privileged account execute arbitrary code on the hosting server, with high impact to confidentiality, integrity, and availability (CVSS 8.8, PR:L, no user interaction required). The attack surface is the code path where special elements used in code are not properly neutralized (CWE-94), so deployments that allow untrusted or self-registered accounts to author and run flows are the most exposed, while instances with closed registration and no internet exposure are materially less at risk. No public exploit code has been identified at time of analysis, EPSS is only 0.58% (46th percentile), and CISA SSVC rates exploitation as 'none', making this a serious-but-not-emergency issue; a vendor patch is available per IBM's advisory.
Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.12.2 allows a low-privileged user to run arbitrary code because the platform improperly controls generation of executable code (CWE-94). Exploitation requires only a valid account on the instance (CVSS PR:L, AV:N, AC:L, UI:N), so an attacker who holds or obtains any credential able to create, import, or execute a flow/component that reaches the vulnerable code-generation path can achieve full confidentiality, integrity, and availability impact on the host. No public exploit code was identified at time of analysis, CISA's SSVC assessment records exploitation as "none", and EPSS is 0.58% (46th percentile), placing this as a genuinely serious but not emergency-tier issue whose real-world risk scales with how exposed the Langflow instance is and how freely low-privilege accounts are provisioned.
Remote code execution affects IBM Langflow OSS versions 1.0.0 through 1.12.2, where improper access control lets an attacker with a valid low-privilege account execute arbitrary code on the server. The flaw is network-reachable with low attack complexity and no user interaction (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), but it is gated by the requirement to hold an authenticated account, so exposure is greatest where the platform offers open self-service registration, uses shared credentials, or is internet-facing without network restrictions. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV) at time of analysis; exploitation status and patch availability should be re-checked against the IBM advisory.
Authenticated remote code execution in the @backstage/plugin-techdocs-node package shipped with the Backstage developer portal framework allows a user who can register or influence an SCM-backed documentation source to execute arbitrary code on the TechDocs backend host. The flaw (CWE-502, CVSS 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) arises because mapping-style markdown_extensions entries in a committed mkdocs.yml were not sanitized, letting an attacker name Python callables such as subprocess:Popen or os:system that MkDocs then imports and instantiates during documentation generation. Exploitation requires a valid account and an instance that performs server-side TechDocs generation of attacker-controlled sources, so risk is highest where generation runs with backend credentials, filesystem access, or internal network reachability; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Remote code execution in IBM Langflow OSS 1.0.0 through 1.12.2 lets a remote attacker who already holds a valid low-privilege session execute arbitrary code on the host by sending a crafted request that bypasses improper input validation. The flaw is network-reachable, low complexity, and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8), so the authentication requirement is the main barrier; deployments with open or self-service sign-up, internet exposure, or multi-tenant use carry the highest risk. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); the vendor has released a fix.
Remote unauthenticated attackers can disrupt and manipulate LMCache's multiprocess coordinator fleet control API in default deployments through 0.5.5, using the /instances, /quota, /events, and /directory/keys endpoints to deregister instances, overwrite quotas, inject events, and disclose placement metadata. The independent assessment confirms that the only material barrier is network reachability because the API binds to all interfaces with no authentication (PR:N) and no user interaction, resulting in low confidentiality and integrity impact and high availability impact. No public exploit identified at time of analysis and no CISA KEV entry was present, but this is a genuine, actionable priority rather than an inflated CVSS score.
Digest mutual-authentication bypass in AsyncHttpClient (AHC) 3.0.12 allows a rogue or on-path peer to be accepted as the authenticated server: when a Digest challenge advertises qop="auth-int" as the only supported quality-of-protection, the client negotiates it but cannot compute the expected rspauth, treats that as unverifiable-but-nonfatal, and accepts a response whose rspauth value is invalid. The flaw is network-reachable, unauthenticated and requires no user interaction (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, 8.8), with the primary impact on integrity (VI:H) consistent with server impersonation rather than the data theft implied by the 'Information Disclosure' tag. It only affects applications that use AHC's Digest Realm with mutual authentication and connect to a peer offering an auth-int-only challenge; deployments where the server offers 'auth' or 'auth,auth-int' are unaffected because AHC prefers and verifies 'auth'. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor-released patch is version 3.0.13.
Improper neutralization of input in Cisco NX-OS software, NX-OS System Software running in ACI mode, and Cisco Unified Computing System (Managed) allows an authenticated attacker holding low-privilege credentials to reach high confidentiality, integrity, and availability impact against the affected device (CVSS 3.1: 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw surfaced during Cisco's internal security review and is remediated through a software hardening release rather than through an out-of-band emergency fix, which indicates internally discovered rather than customer-reported or externally exploited issues. There is no public exploit code and no confirmed active exploitation at time of analysis, though the network-reachable attack path and the breadth of affected platforms (standalone Nexus switches, ACI-mode fabrics, and UCS Managed systems) make it a credible operational priority despite the absence of exploitation signals.
A stack-based buffer overflow in Zephyr's Bluetooth Mesh On-Demand Private Proxy solicitation handler lets any BLE device within radio range overwrite a target node's stack with attacker-controlled bytes by sending a non-connectable advertisement carrying an oversized mesh Proxy Solicitation. Exploitation requires no pairing, bonding, provisioning, or key material because the vulnerable copy happens before decryption, but it is limited to nodes built with CONFIG_BT_MESH_OD_PRIV_PROXY_SRV that are currently eligible to be solicited (GATT Proxy disabled, On-Demand Private Proxy enabled) and physically within BLE range (CVSS 8.8, AV:A/PR:N/C:H/I:H/A:H, unauthenticated). Impact ranges from a reliable remote denial of service to plausible remote code execution; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and a vendor fix is available.
PHP object injection in the WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) through version 2.0.19 lets an authenticated low-privilege user pass attacker-controlled data into an unsafe PHP deserialization path, resulting in high confidentiality, integrity, and availability impact per the vendor-assigned CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a logged-in WordPress account with at least low privileges on a site running an affected plugin version, and no end-user interaction is needed; realistic exploitation further depends on the presence of a usable POP gadget chain in the plugin, Elementor, or WordPress core, which is not confirmed by the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis, so exposure is driven primarily by sites that permit self-registration or retain low-privilege accounts they do not tightly control.
Remote code execution in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) lets a network-positioned attacker who holds only low-privilege credentials inject and execute code on the appliance, resulting in complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is one of multiple internally discovered code-injection weaknesses (CWE-94) that Cisco addressed in a bundled hardening release for the product, so the specific vulnerable endpoint is not individually itemized in the advisory. There is confirmed actively exploited status neither reported nor any public exploit identified at time of analysis, but the low-complexity, no-user-interaction profile and requirement for only an ordinary authenticated account make rapid patching of internet- or partner-reachable instances important; exploitation status is best described as no public exploit identified at time of analysis.
Incorrect-calculation flaws in Cisco's hardening release for Meraki MR wireless access points, MV cameras, MX security appliances, and Campus Gateway software allow an unauthenticated attacker on an adjacent network segment to achieve high impact to confidentiality, integrity, and availability (CVSS 8.8). Because the vector is AV:A/AC:L/PR:N/UI:N, exploitation requires the attacker to already sit in the same Layer-2 broadcast domain, management VLAN, or directly connected segment as the target device - it is not reachable from an arbitrary internet host, and that adjacency requirement is the principal limiting factor. No public exploit identified at time of analysis, and Cisco states the issues were discovered through its own proactive internal security review rather than through exploitation, so real-world urgency is moderate despite the high base score.
Cross-site request forgery in the Fanvil X7A IP phone web management interface (firmware 2.6.0.1182) allows any state-changing endpoint to be invoked from an attacker-controlled web page, because the request handler enforces no anti-CSRF token and no origin/referer validation. The flaw is network-reachable and requires no attacker authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R), but it can only be triggered while a victim administrator holds an active authenticated management session and is lured into visiting the malicious page; the forged requests succeed silently against the phone. Impact is bounded to what the admin's privileges permit - configuration, account, provisioning, or availability-affecting actions - and, per this assessment (C:N on the assessed vector), no confidential response data can be read back due to same-origin policy. Exploitation likelihood is currently low (EPSS 0.16%, ~5th percentile); there is no CISA KEV listing and no public exploit identified at time of analysis, though a third-party disclosure write-up exists.
Cross-site request forgery in the Fanvil x7a IP desk phone (firmware 2.6.0.1182) lets an attacker who lures an authenticated administrator to attacker-controlled web content silently perform any state-changing action on the device's web management interface, since the request handler enforces no CSRF token, origin, or referer checks. Exploitation is not self-triggering: it requires a live admin session (CVSS vector is PR:N/UI:R, so the attacker needs no credentials of their own but does need the victim's authenticated browser and a reachable management interface, typically on the same LAN). No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; EPSS is 0.16% (5th percentile), and the signals conflict - the high base score and complete absence of cross-origin protection are offset by user-interaction, session and network-reachability prerequisites. A public technical disclosure exists (DarkPoint, February 2026) and references also point to Fanvil PA2S firmware, suggesting the affected web stack may span more than the x7a model.
Kernel crash via a use-after-free read in the Linux kernel TCP retransmission path: tcp_send_synack() frees the cloned SYN skb at the head of the retransmit queue and repairs tp->highest_sack but leaves tp->retransmit_skb_hint pointing at the released skbuff_fclone_cache object, which is later dereferenced during the rbtree walk in tcp_xmit_retransmit_queue(). The assessed vector is local (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H): an unprivileged local process must open a connection using TCP Fast Open (sendmsg(MSG_FASTOPEN)), a crafted ICMP fragmentation-needed message arms the hint, and a simultaneous open must free the armed SYN skb at the right moment - only the resulting UAF read and kernel crash (availability impact) is confirmed by the available sources, with no demonstrated confidentiality or integrity compromise beyond an out-of-bounds read of freed slab memory. No public exploit code was identified at time of analysis, EPSS is low at 0.16% (5th percentile), and the issue is not in CISA KEV; vendor patches ship in the 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55, 7.2.9 and 7.3-rc5 stable releases.
Authenticated low-privilege users with network access to the Splunk Enterprise management/web interface can abuse improper resource lifetime handling to achieve high confidentiality, integrity, and availability impact on deployments running versions below 9.4.15, 10.0.10, 10.2.7, or 10.4.3. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is one of a group of internally discovered issues covered by Splunk advisory SVD-2026-1002, where CVEs are assigned per CWE group, so the specific vulnerable subsystem is not individually named. Real-world likelihood currently appears limited: EPSS is 0.15% (4th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, and the primary gating factor is that an attacker must already hold valid Splunk credentials or a session.
Improper access control in Cisco Meraki firmware - spanning MR wireless access point software, MX security appliance firmware, MV camera firmware, and Cisco Campus Gateway Software - lets an attacker positioned on an adjacent Layer 2 or wireless segment bypass authentication and reach protected functionality, with the highest impact on confidentiality. No credentials (PR:N) and no user interaction (UI:N) are required, attack complexity is low, and the Cisco-assigned score is 8.8 because the flaw crosses a security boundary (S:C); however, the attack is not routable from the internet, so real-world exposure is limited to whoever already shares a segment with the device, and no public exploit code or confirmed active exploitation was identified at time of analysis. Cisco addressed the issue in a proactive internal hardening release and published advisory cisco-sa-hardening-meraki-os-drbEX9GH, which should be used to confirm exact affected firmware versions because the advisory bundles several internally discovered issues.
Authenticated attackers who already hold low-privileged access to a local or management interface of Cisco Meraki MR wireless access points, MV cameras, MX security appliances, or Cisco Campus Gateway Software can supply crafted input that the affected component fails to neutralize correctly, a CWE-74 injection-class condition rated CVSS 8.8 with scope change (S:C) and high confidentiality, integrity, and availability impact. Because the vector is AV:L with PR:L, the attacker must already be able to reach the device's management or local interface - exposure is tied to the management plane rather than the public internet - and the flaws were identified during a Cisco internal security review rather than through external reporting, with fixes delivered as software hardening releases described in Cisco advisory cisco-sa-hardening-meraki-os-drbEX9GH. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the specific vulnerable feature and exact affected firmware builds are not specified in the available data.
Unauthenticated SQL injection in the Site Search function of Movable Type allows a remote attacker to run arbitrary SQL queries against the affected site's database, producing high confidentiality impact with limited integrity and availability impact (CVSS 8.8; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). Affected deployments are Movable Type and Movable Type Premium (self-hosted) plus the Movable Type Cloud Edition and Premium Cloud Edition services from Six Apart Ltd. This is a genuine high-priority vulnerability: the CVSS vector confirms the attack is network-reachable with no privileges and no user interaction, so any instance exposing the standard public Site Search is in scope, although no public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated remote attackers can cause a persistent denial of service on Absolute Secure Access servers running versions prior to 14.60 by sending specially crafted traffic to the connection setup subsystem. The flaw affects only availability (CVSS 4.0 score 8.7, CVSS 3.1 A:H), with no impact to confidentiality or integrity. A vendor patch is available in version 14.60; no public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in Octopus Server lets an authenticated user who already holds permission to modify roles weaken a built-in role's protections and add their own account to a privileged team, effectively granting themselves administrative reach without ever being assigned those rights legitimately. The flaw stems from improper validation of unsafe equivalence in input (CWE-1289), meaning role/permission data that should not be treated as equivalent is mishandled during validation. The primary limiter is the prerequisite: the attacker must already have been delegated role-modification rights, so environments that keep that permission confined to a small trusted administrator set face materially lower exposure. No public exploit code has been identified at time of analysis, and this CVE is not confirmed actively exploited (CISA KEV); the Octopus vendor advisory SA2026-11 is the authoritative source for affected and fixed builds.
Denial of service in Excelize 2.9.0 through 2.11.0 allows a crafted spreadsheet to panic and terminate a Go process that calls File.GetSlicers. When a worksheet contains an extLst element but the independently optional drawing element is absent, GetSlicers dereferences the nil ws.Drawing pointer while resolving the drawing relationship, producing a runtime panic; the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) indicates remote, unauthenticated triggering with high availability impact but no confidentiality, integrity, or scope impact. Exploitation is not confirmed to be occurring in real-world campaigns and no public exploit code has been identified at time of analysis, though the upstream fix commit and pull request are public, which lowers the bar for crafting a malicious XLSX; the independent assessment rates this as a moderate, impact-limited risk because GetSlicers is not part of the default file-open or parse path and any recover() wrapper neutralizes the crash.
Go slice-bounds panic in the Excelize spreadsheet library versions 2.8.1 through 2.11.0 lets a crafted .xlsx workbook crash any process or request worker that calls GetPivotTables. The library parses pivot-table field indices separately from pivot-cache field names and indexes one slice with the other without bounds checks, so a workbook with a pivot-field count mismatch or an out-of-range/negative dataField fld value triggers an unrecovered runtime panic that escapes the library (CVSS 3.1 assessed 8.7, availability-only; no authentication or user interaction required from the caller's perspective). No fixed release version is confirmed in the advisory data - only the upstream fix commit - and no public exploit code was identified at time of analysis, though exploitation requires no more than delivering a malicious workbook to a service that parses pivot tables.
Credential disclosure in the AsyncHttpClient (AHC) Java library allows a malicious or compromised origin server or proxy to capture plaintext-recoverable usernames and passwords from applications that configure HTTP credentials via Realm.Builder. When the attacker returns a WWW-Authenticate or Proxy-Authenticate challenge labeled 'Digest' but with the nonce parameter omitted or empty, versions prior to 3.0.13 (3.x) and 2.16.1 (2.x) silently fall back to Basic authentication and resend the credentials in reversible Base64, defeating the entire purpose of Digest. Exploitation is unauthenticated from the network (CVSS v4.0 8.7, AV:N/PR:N, independent assessment CVSS v3.1 C:H/I:N/A:N), but requires the attacker to control or tamper with the authentication challenge, so it is not exploitable against arbitrary endpoints; no public exploit code or CISA KEV entry was identified at time of analysis.
Remotely triggerable denial-of-service conditions in Cisco NX-OS Software - including NX-OS System Software running in ACI mode and managed Cisco Unified Computing System deployments - can cause an affected device to reload or otherwise become unavailable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 8.6) describes an unauthenticated, low-complexity, network-reachable flaw with availability-only impact and scope change, meaning the affected process can degrade resources beyond its own security boundary, but there is no confidentiality or integrity impact and no public exploit code identified at time of analysis. The issue was found during Cisco's own internal security review and is delivered as a grouped software hardening release rather than a single named feature fix, so the precise triggering traffic or configuration is not disclosed; the practical risk is loss of availability of data-center switching and fabric devices that are reachable from an untrusted network segment.
Out-of-bounds read issues in Cisco NX-OS, NX-OS in ACI mode, and managed Cisco UCS software can be triggered by remote, unauthenticated attackers to cause a denial-of-service condition (process crash/restart) on affected devices. The CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), and exploitation is limited by reachability to the vulnerable management/control-plane service, which is often segmented on management VLANs or trusted networks. No public exploit code or confirmed active exploitation was identified in the provided data, and Cisco's advisory does not name a specific protocol, port, or feature beyond the hardening release.
Unauthenticated, network-reachable input-validation flaws in Cisco NX-OS Software command processing can disrupt affected devices, and the same hardening advisory covers Cisco NX-OS System Software running in ACI mode as well as the NX-OS component of Cisco Unified Computing System (managed). Cisco scores it 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), so the assessed impact is availability-only with a scope change and no confidentiality or integrity effect. The issue was discovered during Cisco's internal security review and is addressed by a hardening release rather than by any observed attack activity, and no public exploit code or CISA KEV entry is associated with it at time of analysis.
Hard-coded cryptographic key material embedded in Johnson Controls ADVMS builds prior to 3.10 lets a locally authenticated, low-privileged user read sensitive constants out of the application executable and recover a key that was never meant to be exposed. Because the key is static across affected installations, anything protected by it - encrypted data, authentication material, or inter-component trust - can be decrypted, spoofed, or reused by anyone who extracts it, producing high confidentiality, integrity, and availability impact on the affected host. The issue is local-only (CVSS v4.0 AV:L/AC:L/PR:L/UI:N), is not confirmed actively exploited (not in CISA KEV), and has no public exploit identified at time of analysis; upgrading to 3.10 or later removes the condition.
OS command injection in patool's Windows argument-quoting routine lets a crafted archive filename (for example report&calc.gz) break out of quoting and run arbitrary commands through cmd.exe with the privileges of the patool process. All patool releases before 4.0.6 are affected, but only when patool runs on a Windows host and processes an attacker-supplied archive; the vulnerable path is the single-file-format extraction flow that invokes the shell, and exploitation requires the victim to actively run patool against the malicious file (passive user interaction). No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and the CVSS 4.0 base score of 8.5 (High) reflects total confidentiality, integrity and availability impact within the local execution context, tempered by the Windows-only, user-assisted attack preconditions. Authentication is not required to trigger the flaw (CVSS 4.0 vector PR:N).
Heap-based buffer overflow in X.Org X server and Xwayland GLX RenderLarge request handling allows an authenticated local X client to write past the allocated heap buffer, potentially achieving arbitrary code execution or causing denial of service. Affected versions are xorg-server prior to 21.1.25 and Xwayland prior to 24.1.14; the attacker must already be able to open an X display with GLX available, which by default means local Unix-socket access rather than remote unauthenticated access. No public exploit identified at time of analysis.
Certain ASUS router models write DDNS (dynamic DNS) account credentials into the readable system log, so an attacker who already holds high-privilege administrative access and sits on the same or an adjacent network segment (LAN/Wi-Fi) can harvest those secrets from the log and potentially redirect DNS settings. The exposure is confirmed by the vendor (ASUS) and rated 8.4 High under CVSS 4.0, but the prerequisite of authenticated management access plus network adjacency makes it a context-dependent, moderate-priority issue rather than a mass-exploitable one; no public exploit code has been identified at time of analysis and no CISA KEV listing applies. The leak only yields credentials on devices where DDNS is actually configured and enabled.
Authenticated Cloud Connect tenants can read arbitrary files on the Veeam Backup & Replication service provider host through a path traversal flaw (CWE-22). This affects service providers that deploy the Cloud Connect feature and serve tenants; standalone installations without Cloud Connect are not reachable via this tenant path. The attack is network-reachable and low-complexity with no user interaction, but impact is limited to read-only disclosure and no public exploit code or confirmed active exploitation has been identified at time of analysis. This is a credible, above-average priority for Veeam Cloud Connect service providers, though not a drop-everything emergency on current signals.
Denial of service in Absolute Secure Access servers before version 14.60 allows unauthenticated remote attackers to cause a persistent outage by sending a malformed response during the authentication handshake. The attack requires network access to the authentication interface and no authentication, but its high complexity (AC:H) means specific conditions must be met, limiting trivial exploitation; no public exploit code has been identified at time of analysis. Impact is confined to availability with no confidentiality or integrity consequences.
Improper input validation in Cisco Meraki MR wireless access point, MV camera, and MX security appliance firmware - together with Cisco Campus Gateway Software - allows unauthenticated remote attackers to feed crafted input that the affected device fails to validate, producing a high integrity impact and a limited availability impact (C:N/I:H/A:L) under the assessed CVSS 3.1 vector. The issue is one of a set of CWE-20 weaknesses remediated in a single Cisco internal-hardening firmware release, so the specific vulnerable feature, protocol, or interface is not named and the affected version boundaries must be taken from the Cisco advisory. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); note that the 'Information Disclosure' tag does not align with the assessed vector, which shows no confidentiality impact.
ImageMagick's CUT image decoder fails to enforce the configured security policy (policy.xml) when it derives and opens the companion '.PAL' palette file next to a processed CUT image, so an unauthenticated remote attacker who can get a crafted CUT file into an image-processing pipeline can read a palette file that policy explicitly denies and can also crash the process. All releases before 7.1.2-31 (including the entire 7.0.0 line) and before 6.9.13-56 are affected; the flaw is only meaningful when a restrictive read policy is actually in place, since the practical impact is limited to policy bypass for one adjacent file plus a denial-of-service crash, with no write or code-execution capability. Advisory GHSA-r868-pmwh-fv2c has been published with upstream commits and fixed release tags, EPSS is low at 0.12% (2nd percentile), and CISA's SSVC assessment rates exploitation as none and automatable as no, so no public exploit code has been identified at time of analysis.
SQL injection in the Homer coordinator's POST /api/v4/statistics/query endpoint allows a remote attacker to execute arbitrary DuckDB SQL against the FlightSQL backend, exposing or altering all stored VoIP call records, SIP messages and metadata. The V4StatisticsQuery handler forwards the caller-supplied rawquery field verbatim to DuckDB without the sqlvalidator.ValidateRawSQL() neutralization applied in sibling handlers, so any authenticated user is sufficient (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1); the vendor notes that on default deployments an empty JWT secret collapses this to pre-authentication reachability. Publicly available exploit code exists (the advisory ships a working curl PoC, and DuckDB INSTALL/LOAD is reachable for extension-based exfiltration); no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.