A remotely reachable, unauthenticated out-of-bounds write (buffer overflow, CWE-787) in IBM DataPower Gateway can corrupt memory and potentially allow an attacker to fully compromise the affected appliance, as reflected in the assessed CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected firmware spans 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, with the flaw reachable in the normal network-processing path since no authentication, user interaction, or special configuration is required. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, though the unauthenticated network attack surface and memory-corruption impact make this a genuine high-priority issue for exposed deployments; IBM has published a vendor fix via its support advisory.
SQL injection in IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthenticated remote attackers to execute arbitrary SQL commands against the platform's underlying data store, with IBM's own vector (AV:N/AC:L/PR:N/UI:N, C/I/A:H) describing total loss of confidentiality, integrity, and availability for exposed instances. The headline 9.8 CVSS should be tempered by conflicting signals: EPSS is only 0.30% (20th percentile), and CISA's SSVC assessment records exploitation as 'none' with the attack rated non-automatable, with no public exploit code or KEV listing identified at time of analysis. Real-world risk is governed by reachability - exploitation requires network access to a vulnerable Guardium management or collector interface, which is normally confined to restricted internal management networks rather than the internet.
SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 lets remote unauthenticated attackers who can reach the product's network-facing interfaces inject crafted SQL against the back-end database, potentially viewing, adding, modifying, or deleting its contents (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and EPSS is low at 0.27% (17th percentile), so real-world exploitation appears opportunistic rather than widespread despite the maximum severity rating. Impact is exposure-dependent: internet-reachable or broadly accessible management/collector instances carry the full unauthenticated risk, while deployments confined to isolated management networks are substantially less exposed. The vendor has published remediation through IBM Support.
Go's os.Root API on Windows can be tricked into creating a directory outside the sandboxed root when the final path component passed to Root.Mkdir or Root.MkdirAll is a junction that resolves to an empty location, allowing an attacker who can influence filesystem layout or path input to escape the intended root boundary. Only Windows applications built with a vulnerable Go toolchain (os and internal/syscall/windows before 1.26.9, or the 1.27.0 pre-release line before 1.27.2) that actually use os.Root are affected; non-Windows builds and applications not using os.Root are not impacted. The headline CVSS 9.8 overstates real-world risk: our independent assessment scores it AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N because the primitive is confined to directory creation outside the root, with no arbitrary file read, content write, or code execution described. EPSS is 0.21% (10th percentile), no public exploit has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Authentication bypass in the Ultimate Multisite WordPress plugin before 2.17.0 lets an unauthenticated remote attacker (CVSS PR:N) log in as any existing WordPress account, including a Network Super Admin, whose email address they know - but only on sites whose checkout form is configured without a password field and only when the target account has no existing Ultimate Multisite customer record. The root cause is that the plugin's duplicate-account check normalizes the submitted email address differently from the lookup used to create the customer, so a logged-out checkout silently links to and authenticates as the matching existing WordPress user. The 2.15.1 fix for CVE-2026-75957 does not remediate this bypass; vendor-released patch 2.17.0 is available, and no public exploit code has been identified at time of analysis (no CISA KEV entry). Vendor CVSS is 9.8, though our independent assessment applies AC:H (8.1) because both the password-less checkout configuration and the absence of a pre-existing customer record are required.
Unauthenticated account takeover, including full administrator compromise, affects WordPress sites running the Frontend Dashboard plugin versions 3.0.0 up to but not including 3.0.5. Missing authorization and nonce checks on actions available to unauthenticated users allow an attacker to invoke an arbitrary PHP function or class method with attacker-controlled arguments, resulting in complete loss of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV); the vendor has released a patch in version 3.0.5.
Unauthenticated remote code execution in SGLang versions through v0.5.20 arises from unsafe pickle deserialization in the ZMQ message decoder, which processes PickleWrapper payloads via pickle.loads() without type allowlisting or authentication. While default single-node deployments bind the ZMQ control channel to loopback, remote exploitation becomes possible when data-parallel attention is enabled and --dist-init-addr is set to a non-loopback address. Disabling SGLANG_USE_PICKLE_IPC does not eliminate the risk because the msgpack code path still reaches pickle.loads(), and no public exploit code has been identified at time of analysis.
Unauthenticated information disclosure in the AKINSOFT WOLVOX Control Panel (versions 26.02.25 up to but not including 26.02.26) lets a remote attacker reach the panel over the network and pull sensitive data from system resources into responses sent back to the client. Because the assessed attack vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed against an internet- or network-reachable instance, and successful exploitation yields high confidentiality impact (C:H), exposing host/system-level information to an unauthorized party. Note that the supplied base vector (9.8) also asserts high integrity and availability impact, whereas the independent assessment scopes the issue to confidentiality only (I:N/A:N); either way the practical effect is data exposure rather than code execution or service disruption. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fix.
Information disclosure in Microsoft's Azure API Center lets remote unauthenticated attackers read sensitive data outside their intended authorization scope, with the changed-scope (S:C) rating indicating the leak can cross the vulnerable component's security boundary - consistent with a multi-tenant, Microsoft-operated cloud service. Microsoft's CNA vector scores 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C), while our independent assessment narrows impact to confidentiality only (I:N) and keeps the high attack complexity, meaning attacker-controlled preconditions such as target-specific knowledge or request sequencing are required; there is no public exploit identified at time of analysis and no CISA KEV listing. Because the service is vendor-operated SaaS, exposure was bounded by the window before Microsoft's server-side fix was deployed, and customers cannot self-mitigate beyond relying on that fix.
Unauthenticated OS command injection in Dromara Skyeye allows remote attackers to execute arbitrary commands as the Skyeye service account on Windows. The flaw resides in the TTS textToSpeech endpoint, where the 'format' parameter is concatenated into a PowerShell string without sanitization; a single quote can break out and run attacker-supplied commands. Exploitation requires the instance to be running on Windows and the endpoint to be network-reachable, but no authentication or user interaction is needed, making default deployments a high-priority target. No public exploit code or confirmed active exploitation was identified at time of analysis.
OS command injection in the image_optimizer Ruby gem versions 1.3.0 through 1.9.0 allows unauthenticated remote attackers to execute arbitrary shell commands with the privileges of the Ruby process by supplying an image path containing shell metacharacters such as ';'. The flaw is reachable only when the consuming application enables the 'identify' option (so that ImageOptimizer#identify_format runs) and the attacker controls the image path argument, typically through an attacker-chosen uploaded file name, which means real-world impact is bounded by the OS privileges of the Ruby/web worker process and by whether user-controlled filenames reach the gem. The CVSS 4.0 base score of 9.3 reflects high confidentiality, integrity and availability impact, and no public exploit identified at time of analysis; the included gist and VulnCheck advisory serve as the primary public technical disclosures.
OS command injection in the ppt2png Node.js library (through version 0.0.6) lets attackers run arbitrary operating system commands by embedding shell metacharacters such as ';' in the input or output path arguments that the library concatenates into a child_process.exec() call in ppt2png.js. The vulnerable code is only reachable when a consuming application forwards attacker-controllable data into those path parameters; exploitation is therefore conditional on the embedding application, but when reachable the injected commands execute with the full privileges of the Node.js process, and no authentication is required per the assessed vector (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, CVSS 4.0 base 9.3). No public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), but the near-maximum severity and trivial injection technique make prompt remediation or strict path sanitization critical for any deployment that exposes these parameters.
Unauthenticated remote command execution in Openfind SecuShare Pro allows attackers to inject and execute arbitrary operating system commands on the server, as described in CVE-2026-107459 (CVSS 9.3, CWE-78). The flaw affects default internet-exposed deployments that are reachable over the network, and no public exploit has been identified at time of analysis. Successful exploitation grants full control over the affected system, enabling data theft, malware installation, or lateral movement.
A heap-based buffer overflow in the PNG metadata reader of Eye of GNOME (eog) allows an attacker to potentially achieve arbitrary code execution or cause a denial of service (application crash) when a user opens a specially crafted PNG file. Exploitation requires user interaction and local access, but the vulnerability is unauthenticated (no privileges required) according to the CVSS vector PR:N. No public exploit code or confirmed active exploitation has been identified at time of analysis; the risk is constrained by the need for a user to open the malicious file on a system with eog installed.
Stump through 0.1.10 allows any authenticated user with the shared AccessSmartList permission to overwrite, delete, or take over other users' smart lists via vulnerable GraphQL mutations. The updateSmartList and deleteSmartList mutations lack a creator check, enabling attackers to set themselves as the new creator and change list visibility to PRIVATE, locking out the original owner. Publicly available exploit code exists, but exploitation requires a multi-user Stump instance and low-privileged credentials, limiting impact to insiders or compromised accounts.
Stored cross-site scripting in Indico before 3.3.13 lets authenticated users with content-creation privileges - event managers, submitters, and speakers who can upload material or edit minutes - store crafted javascript: URLs and unsanitized HTML in fields that accept custom links, including attachment link URLs, event layout/menu links, and event notes. When another user clicks one of these stored links, the attacker's script runs in the victim's browser within the Indico origin, enabling session-riding or data disclosure in the application context. The issue is rated CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting that it requires a privileged event role plus victim click-through rather than unauthenticated access; no public exploit code has been identified at time of analysis, and the vendor notes the practical risk is relatively low because of these preconditions.
Remote unauthenticated attackers can obtain a fully privileged administrative session on TVU Networks Receiver and Transceiver devices running firmware before 7.9 by sending a crafted HTTP request to the web management login endpoint POST /tvu/Login with an empty or absent UserName parameter; the password value is irrelevant and a valid session cookie is returned. The flaw is rated CVSS 4.0 9.3 (and assessed as CVSS 3.1 9.3 with high confidentiality, integrity, and availability impact), requires no authentication, no user interaction, and no non-default configuration, and because the request is issued directly it defeats the client-side JavaScript validation that would otherwise block it. No public exploit code or confirmed active exploitation was identified at time of analysis; the main practical limiting factor is network reachability of the device's management interface, so segmented or non-exposed management planes are not remotely exploitable.
Unauthenticated attackers can execute arbitrary commands on Dromara Skyeye's bundled xxl-job executor hosts by abusing JobInfoController endpoints that are annotated @PermissionLimit(limit = false). The flaw affects Skyeye deployments through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 and requires the xxl-job-admin console to be network-reachable with at least one registered executor; exploitation allows creating and starting GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-controlled glueSource. No public exploit code has been identified at time of analysis, but the vulnerability carries a CVSS v4.0 base score of 9.3 and our independent assessment rates it as CVSS v3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, making it a genuine high-priority issue.
Command injection in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) lets an authenticated, low-privileged user execute arbitrary operating-system commands as SYSTEM on the primary domain controller emulator (PDCe). Both the vendor CVSS 4.0 vector (9.4) and our independent CVSS 3.1 assessment agree on PR:L with UI:N and changed scope, meaning an attacker who already holds a valid low-privileged tenant account needs no user interaction and faces low attack complexity to pivot from tenant access to domain-controller-level code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the impact is severe and the barrier of entry is only an existing credential, so this should be treated as a high-priority remediation.
Arbitrary memory disclosure and denial of service in Hazelcast allow a client that can reach a cluster member's listening port to read arbitrary data from that member's Java heap, off-heap storage and JVM process address space, to crash members, and - in some Hazelcast Enterprise Edition configurations - to corrupt memory with possible remote code execution. All editions prior to 5.4.5, 5.5.10, 5.6.1 and 5.7.0 are affected in both the slim and full distributions, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a low-privileged client credential where client authorization is enforced, while in default deployments with Hazelcast Security disabled any reachable client can connect without credentials; the vendor's CVSS 4.0 score of 9.3 assumes PR:N. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but vendor-released patches exist (5.4.5, 5.5.10, 5.6.1, 5.7.0) and the vendor's own hardening guidance - enabling security, enforcing client authorization and defining an explicit zero-config Compact serialization allowlist - directly addresses the exposure, making this a genuine high-priority vulnerability rather than an inflated score.
Missing authentication in TVU Networks Receiver/Transceiver firmware before 7.9 exposes the device web-management REST API on TCP port 8288, letting remote unauthenticated attackers read sensitive device information and modify configuration-including rewriting DNS via /Setting3/API/API/v1/LocalNetwork/DNS to enable man-in-the-middle attacks on outbound TVU cloud connections. The issue is scored CVSS 9.3 (v4.0) and independently assessed as AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:N under CVSS 3.1, with practical impact limited mainly by whether port 8288 is reachable from an untrusted network. No public exploit was identified at time of analysis.
OS command injection in @enmaso/node-convert through 1.0.0 lets remote, unauthenticated attackers execute arbitrary operating-system commands with the privileges of the Node.js process by placing shell metacharacters or a single quote into the filepath or convertTo arguments that convert.js concatenates into an ImageMagick command executed via child_process.exec(). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) both frame this as full-impact code execution, but practical exploitation requires a consuming application to pass attacker-influenced data into those two parameters and to have the vulnerable call path (and ImageMagick) reachable - deployments that only pass trusted or internally fixed values are not remotely triggerable. All versions through 1.0.0 are affected, and no public exploit code has been identified at time of analysis.
Remote code execution in dot-access versions 0.0.3 through 1.0.0 allows unauthenticated attackers to execute arbitrary JavaScript and operating system commands when a consuming application passes attacker-controlled input as the path argument to the get() function. The vulnerability arises from unsanitized path concatenation into a dynamically constructed Function body, enabling access to constructor.constructor and child_process. No public exploit code was identified at time of analysis, but the CVSS 4.0 score of 9.3 reflects high confidentiality, integrity, and availability impact. Exploitation is conditional on untrusted input reaching get().
Unauthenticated SQL execution in mJobTime (all builds through 15.7.3.32) allows any remote attacker who can reach Login.aspx to submit arbitrary SQL that executes with DBA/sysadmin privileges on the backing Sybase SQL Anywhere database and, via xp_cmdshell and xp_read_file, achieve remote code execution as LocalSystem in a single HTTP request. The runQueryButton postback and exportSqlQuery_Server PageMethod are gated only by a client-side sessionStorage flag, so no credentials, user interaction, or non-default configuration are required (independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, consistent with the reported CVSS 4.0 score of 9.3 under AV:N/AC:L/AT:N/PR:N/UI:N). There is no CISA KEV listing for this CVE and no public exploit identified at time of analysis, though the technique is documented in the VulnCheck advisory and Sprocket Security write-up.
An authentication bypass in EspoCRM versions before 10.0.6 allows an attacker who already possesses a valid username and password for a two-factor-enabled account to stop at the second-factor prompt and still reach routes that do not enforce full authentication, exposing configuration parameters that are not otherwise publicly available. The CVSS vector carries PR:L, confirming the attack presupposes previously obtained first-factor credentials, so it provides no initial access on its own and the demonstrated impact is read-only confidentiality loss with no write, code execution, or account takeover. Publicly available exploit code exists and the vendor has released EspoCRM 10.0.6 as the fix, while CISA's SSVC assessment rates exploitation as none and the vulnerability as not automatable, consistent with a medium-severity issue that is not urgent in the absence of prior credential compromise.
Stored HTML injection in EspoCRM before 10.0.6 allows unauthenticated attackers to plant arbitrary markup through the public Lead Capture form, which is persisted in LeadCaptureLogRecord.data and rendered unescaped when an administrator later opens the log record in the admin UI; the practical impact is limited to content and interface spoofing because the application's Content Security Policy blocks JavaScript execution, preventing classic script-based XSS or session theft. Exploitation requires the Lead Capture public form to be enabled and externally reachable, and the payload stays inert until a privileged administrator views the affected entry, so there is no immediate attacker-controlled trigger. Vendor-released patch 10.0.6 is available, publicly available exploit code exists, and no active exploitation has been confirmed (CISA KEV). The independently assessed severity is low-to-moderate (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), consistent with the limited integrity-only, interaction-gated impact.
Cross-site scripting in the IBM DataPower Gateway 10.6.0 Web UI (builds 10.6.0.0 through 10.6.0.10) lets an unauthenticated attacker inject arbitrary JavaScript that executes in the browser of an operator who is already logged into the appliance management console, potentially leading to credential or session disclosure within that trusted session. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, 9.3) confirms the attacker needs no credentials but the victim must interact with attacker-supplied content, so this is a lure-driven, high-impact issue rather than silent mass exploitation; no public exploit has been identified at time of analysis. A vendor patch is available, and only the 10.6.0.x range up to 10.6.0.10 is affected, so upgrading the fixed build removes exposure.
Unauthenticated attackers can bypass disabled user registration in Easy Digital Downloads WordPress plugin versions before 3.7.1 to create a WordPress account and obtain a logged-in session, with the new user assigned the site's default role. Publicly available exploit code exists, and the independent assessment rates this as a moderate-priority issue (CVSS 5.3) rather than a critical emergency, because the impact is largely determined by the default role-typically a low-privilege Subscriber. Sites that rely on disabled registration for protection are directly exposed, while those with registration already enabled see little added risk.
Unauthenticated account creation in the TutorStarter WordPress theme (all versions before 4.0.4) allows any remote visitor to create a WordPress user account through the theme's AJAX registration handler even when the site has disabled user registration. The flaw bypasses the users_can_register setting administrators rely on as a safety control, but created accounts receive WordPress's default registration role, typically a low-privilege Subscriber, with no confidentiality or availability impact (CVSS 5.3, PR:N per the assessed vector). Publicly available exploit code exists and the WPScan advisory documents the vector, but there is no confirmed active exploitation (not in CISA KEV); exposure lasts only while an affected theme version is active. This is a low-to-moderate priority issue despite its network/unauthenticated profile.
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 accepts forged payment notifications and marks orders as paid when no webhook secret has been configured, allowing unauthenticated remote attackers to obtain goods or services without completing payment. The flaw is a business-logic integrity issue rather than a system-compromise bug: CVSS 3.1 scores it 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), with impact limited to falsified order/payment state. It is exploitable only on stores that have left the webhook secret empty, and publicly available exploit code exists (WPScan); there is no evidence of confirmed active exploitation in the wild.
Privilege escalation in Microsoft Azure SRE Agent lets an authenticated, low-privileged user exploit a missing authorization check in a server-side request-forwarding (SSRF) path to reach resources and act with the agent's higher-privileged identity, yielding high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Because the flaw sits in a Microsoft-managed cloud service, no customer-side configuration is required to trigger it - the only real gate is that the attacker must already hold a valid, authorized low-privileged identity in the service (PR:L, matching the advisory's 'authorized attacker' wording). Risk signals are moderate rather than urgent: EPSS is 0.39% (31st percentile), CISA SSVC records Exploitation: none and Automatable: no, and no public exploit has been identified at time of analysis; a vendor patch is available per Microsoft's advisory.
IBM Guardium Data Protection 12.1 and 12.2.2 contain a path traversal flaw (CWE-22) that lets a remote, unauthenticated attacker delete arbitrary files on the appliance by supplying traversal-laden input to an affected file-handling function, giving a high-integrity and availability impact with no confidentiality exposure (CVSS 3.1: 9.1, AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:H). No public exploit code has been identified at time of analysis, EPSS is low at 0.36% (28th percentile), and CISA's SSVC decision framework rates exploitation as 'none' with a total technical impact, so this reads as a serious but not emergency-priority issue. Practical risk is bounded by reachability: Guardium is a management-plane appliance normally confined to privileged database and security administrators behind the enterprise perimeter, which narrows the realistic attacker population despite the network-vector rating.
Unauthenticated server-side request forgery and missing authorization in Dromara Skyeye let remote attackers drive the server to fetch attacker-chosen internal URLs and overwrite any user's stored file through the OnlyOffice save callback editUploadOfficeFileById, then retrieve the modified content via queryFileToShowById. The flaw carries a CVSS 4.0 base score of 9.1 (PR:N, UI:N), although the assessed high attack complexity (AC:H/AT:P) reflects that a valid file id/key and an active OnlyOffice document-editing/callback flow are likely prerequisites, and SSRF reach is bounded by what internal addresses the server can resolve. No public exploit code was identified and the issue is not listed in CISA KEV at time of analysis.
Authentication bypass in HPE Intelligent Management Center (iMC) prior to v7.3 E0713 lets unauthenticated remote attackers reach functionality that should require a valid login, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, with high impact on confidentiality and integrity (C:H/I:H/A:N) and no reported availability impact. Any iMC instance running a build older than v7.3 E0713 and reachable over the network is exposed, and because iMC is an enterprise network management platform, compromise can expose managed-device credentials and configuration data and allow unauthorized changes. No public exploit code was identified at time of analysis and the CVE is not confirmed as actively exploited (CISA KEV), though the vendor advisory and the 9.1 base score warrant urgent patching on internet- or broadly reachable deployments.
Unauthenticated attackers can recursively delete arbitrary directories - including the WordPress installation root - on sites running the Super Forms - Drag & Drop Form Builder plugin for WordPress in all versions up to and including 6.3.316. The flaw is reachable by sending crafted JSON field declarations to the submit_form function that are not validated against the actual form schema, and it is compounded by an ABSPATH guard that dirname() trivially defeats by stripping the trailing slash. Exploitation is remote, unauthenticated (PR:N) and requires no user interaction, but is gated by a configuration prerequisite: an administrator must have enabled the documented 'Delete files from server after form submissions' setting, without which the vulnerable deletion code path is never reached; no public exploit identified at time of analysis.
Authenticated users holding only Viewer privileges on Satel Netco Design can degrade availability of the application by submitting specially crafted search input that drives excessive processing in the product's regular-expression handling. The issue affects all versions prior to v2.1.7 and is rated CVSS 7.1 (CVSS 4.0) / High under CVSS 3.1 for availability impact alone - there is no confidentiality or integrity loss. Exploitation requires a valid, low-privileged account and network reachability to the search functionality; no public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV).
An out-of-bounds read in the TDS7 LOGIN7 protocol parser of IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows unauthenticated remote attackers to deliver a crafted LOGIN7 packet with invalid offset or length values, causing denial of service and limited memory disclosure. The published CVSS 3.1 score is 9.1, but our independent assessment reduces confidentiality to Low (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H), and with EPSS at only 0.29% (20th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world priority is lower than the headline score suggests even though technical impact is rated total. The dominant limiting factor is network reachability: only deployments whose TDS/database-interception listener is exposed to untrusted networks are practically at risk.
Signals conflict: the original CVSS rates integrity and availability impact as high (9.1), but independent assessment determines only low availability impact. A logic error in Go's HTTP/2 server allows unauthenticated remote attackers to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection) by resetting streams to trigger a double refund of flow control credit. The practical impact is limited because total buffered data remains bounded by concurrent stream limits and stream-level flow control; no public exploit identified at time of analysis, and patches are available as upstream commits.
Remote, unauthenticated account takeover is possible in MyRezzta (AKIN Software) versions 2.06.03 through 2.07.00 because the application's forgotten-password recovery mechanism is implemented weakly (CWE-640). Per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, an attacker who can reach the account-recovery endpoint needs no credentials, no user interaction, and no special configuration, and can gain high confidentiality and integrity impact - effectively seizing control of targeted user accounts - with no availability impact. No public exploit code has been identified at time of analysis and CISA KEV does not list this CVE, but the flaw is rated 9.1 and was reported by TR-CERT; the practical risk is concentrated on internet-exposed MyRezzta deployments within the affected version range.
Argument injection in Infoblox NIOS troubleshooting commands allows an authenticated high-privilege administrator to escalate to root-level shell access on the appliance. The flaw resides in the maintenance-mode diagnostic interface where user-supplied arguments are passed to underlying system commands without proper sanitization, and exploitation requires a pre-existing administrative credential (PR:H) rather than being reachable by anonymous or low-privilege users. No public exploit code or confirmed active exploitation was identified at time of analysis, and realistic risk is confined to malicious insiders or attackers who have already compromised NIOS admin credentials.
OS command injection in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an authenticated, low-privilege administrative user with adjacent-network access to the management plane to break out of the restricted management environment and execute arbitrary shell commands with elevated privileges by supplying a crafted timezone string to the time and zone management subsystem via the REST API or configuration download routines. No user interaction is required, and the reporter scores it 8.6 under CVSS 4.0, while our independent assessment concurs on high confidentiality, integrity, and availability impact under AV:A/AC:L/PR:L/UI:N/S:U. There is no public exploit identified at time of analysis and no confirmed active exploitation; because valid management credentials and adjacency to the switch management network are both mandatory, this is a credible elevated-priority issue rather than an emergency.
Unrestricted file upload in the Super Forms - Drag & Drop Form Builder WordPress plugin (all versions up to and including 6.3.316) lets an attacker write attacker-controlled file types to the server, which can be turned into remote code execution. Exploitation is a two-step chain: an authenticated Subscriber-level user poisons the _super_elements post meta with a crafted extensions string through the super_save_form AJAX handler, which lacks capability and nonce checks, and then the super_upload_files endpoint - which requires no authentication at all - applies that string verbatim as its allowed MIME-type map and accepts an executable file. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with the practical barrier being acquisition of a low-privileged account, which is trivial on sites with open registration; no public exploit identified at time of analysis.
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galaxy collection install` against a crafted collection tarball, because the archive extractor validates member paths with lexical normalization (os.path.abspath) instead of resolving symlinks (os.path.realpath) and performs no containment check on symlink-typed directory members before creating them, letting chained symlink entries redirect a subsequent file member outside the destination directory. The flaw (CWE-59, CVSS 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is a bypass of the fix for CVE-2020-10691 and requires the victim to actively install the malicious collection, so an attacker can write arbitrary files with the privileges of the ansible-galaxy user and potentially achieve code execution on the control node. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; affected deployments include ansible-core 2.x as shipped in Red Hat Ansible Automation Platform 2 and numerous other Red Hat products, and no patched version is identified in the supplied intelligence, which currently cites only the Red Hat CVE page and Bugzilla 2531646.
Remote code execution is possible in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including the containerized editions of both products, because a protection mechanism fails to prevent an authenticated principal from influencing code execution paths. Successful exploitation requires only a valid low-privilege account and network access to the product interface (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) - no user interaction or race condition is needed - and yields full compromise of confidentiality, integrity and availability of the affected instance. At the time of analysis, no public exploit code has been identified for this CVE and there is no confirmed active exploitation, but the low attack complexity and the fact that the affected systems are identity and access management infrastructure make the issue a high-priority patching target; IBM has published a vendor remediation advisory.
Remote code execution is possible in IBM Guardium Data Protection 12.0, 12.1, and 12.2 through a buffer overflow (CWE-119) triggered over the network, but exploitation requires valid low-privileged credentials (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, base 8.8) - this is not an unauthenticated flaw, so an attacker must already hold an account or captured credential on the appliance. A successful exploit yields full compromise of confidentiality, integrity, and availability of the affected system, making privileged accounts and network reachability the key gating factors. Exploitation status is benign-to-moderate: no public exploit code has been identified and no confirmed in-the-wild activity is reported (EPSS 0.42%, 34th percentile; CISA SSVC exploitation: none), and IBM has published an advisory with a vendor fix, so patching is the decisive control.
Arbitrary command execution in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including their container images) allows a remote attacker holding a valid low-privilege account to run commands on the underlying system by slipping argument delimiters into data that is passed to a backend process without neutralization (CWE-88). The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) means the attack is network-reachable with no user interaction and yields full loss of confidentiality, integrity, and availability, but exploitation is not possible fully unauthenticated - the attacker must already have credentials, which narrows the realistic threat to insiders, compromised low-privilege accounts, and post-compromise escalation. There is no public exploit identified at time of analysis, though the vendor has published a patch, so unpatched deployments within the affected ranges should be treated as exposed to any authenticated user.
Authenticated argument injection in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including the containerized editions) allows a remote attacker who already holds valid credentials to slip crafted parameters into command or process arguments and trigger unauthorized actions, with high impact to confidentiality, integrity, and availability (CVSS 8.8). Exploitation requires authenticated access (CVSS vector PR:L) and no user interaction (UI:N), so the exposed population is limited to existing platform users rather than anonymous internet traffic. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but a vendor patch is available and the affected systems are typically high-value identity infrastructure, making prompt remediation worthwhile.
SQL injection in the generated reactive entity-list endpoints of JHipster-produced applications (generator-jhipster versions 7.0.0 up to, but not including, 9.4.0) lets an authenticated user inject arbitrary SQL through the attacker-controlled `sort` request parameter on `GET /api/<entity>?sort=...` endpoints. Because the generated R2DBC code passes the sort property into the SQL ORDER BY clause unvalidated and unquoted, and the driver runs it over the simple query protocol, semicolon-separated statements are executed as well - enabling reads of sensitive tables such as `jhi_user` password hashes, modification or deletion of data, and table drops (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires the app to be the reactive WebFlux + Spring Data R2DBC + SQL stack, and an account is needed, though the default self-registration flow lets a low-privileged one be self-provisioned; the vendor-released fix is version 9.4.0, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Prototype pollution in dot-access through 1.0.0 allows remote attackers to modify Object.prototype when a consuming application passes an attacker-influenced dotted path to set(). By injecting __proto__ path segments, attackers can alter authorization flags or option defaults across all objects and may crash the process; the flaw is CWE-1321, rated 8.8 in CVSS 4.0, and assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L with high integrity and low availability impact. No public exploit identified at time of analysis and no CISA KEV confirmation; exploitation is integration-specific because the path argument must be attacker-controlled.
PHP object injection in the MainWP Child plugin through version 6.2.1 allows unauthenticated remote attackers to fully compromise confidentiality, integrity, and availability, though exploitation requires user interaction and a viable PHP gadget chain. The vulnerability is a deserialization of untrusted data (CWE-502) issue with a CVSS 3.1 base score of 8.8, rated high risk. No public exploit code or active exploitation has been identified at time of analysis.