Remote code execution in the AWP Classifieds WordPress plugin before 4.4.9 allows an authenticated user holding the plugin's management capability to import a crafted ZIP archive whose contents are extracted without file-type validation, planting arbitrary PHP into a publicly accessible, network-shared directory. Because the extraction target is web-reachable, the uploaded PHP can be requested and executed, yielding code execution under the web server account. Exploitation is gated by the required management capability (CVSS PR:L), and a vendor patch is available in 4.4.9; publicly available exploit code exists and EPSS is low at 0.19% (8th percentile), with no CISA KEV listing indicating confirmed active exploitation. CWE-434 (unrestricted upload of a file with a dangerous type) is the root cause class.
Account takeover in the FooSales WordPress plugin before 1.43.3 allows any authenticated user to have the plugin act as an arbitrary other account, including an administrator, exposing that user's account details and enabling full account takeover. The vulnerability is a broken-access-control flaw (CWE-269) in which the plugin never verifies that the caller is entitled to act as the user named in a request; it is remote (AV:N), low-privilege (PR:L), and requires no victim interaction (UI:N), yielding a CVSS score of 8.8. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation and EPSS estimates only a 0.13% (2nd percentile) probability of exploitation. Any site running FooSales prior to 1.43.3 that permits untrusted users to hold accounts - for example, sites with open self-registration - is at meaningful risk.
Authorization bypass in MOVO through 0.2.3 lets any authenticated user read other users' stored private documents and overwrite their presentation blueprints through the chat-api document endpoints, because the server accepts an attacker-supplied object path without verifying that the object belongs to the requester. Exploitation requires a valid MOVO account and advance knowledge or enumeration of the victim's object path, so the attack is bounded by path secrecy rather than being fully attacker-controlled, and no victim interaction is needed. Publicly available exploit code exists, and both the CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) and the independent assessment (CVSS:3.1/AV:N/AC:H/PR:L/UI:N, C/I impact) agree the impact is a high-confidentiality, lower-integrity exposure confined to the vulnerable application rather than a platform-wide compromise; signals are moderately consistent and point to a real but bounded risk.
Path traversal in plugNmeet Server through 2.5.2 allows any authenticated meeting participant to read arbitrary files from the host by supplying crafted ../ sequences in the filePath value passed to the whiteboard document-conversion endpoint; the resulting page images are then retrievable without authentication via /download/uploadedFile/. The assessed impact is confidentiality-only (high file read, no write or availability effect) against the server process's readable files, and publicly available exploit code exists - though there is no CISA KEV listing, so this is best treated as a moderate-priority information-disclosure issue rather than a critical emergency. Risk is highest where the plugNmeet process can read secrets, configuration files, or credentials on the same host.
Unauthenticated access to the openPDC internal data publisher lets any host that can reach the service connect and subscribe without credentials, tokens, or user interaction, retrieving the complete device and measurement topology - the full model of phasor measurement units, devices, and signal names that describes a synchrophasor deployment. The affected software set, per vendor CPE entries, covers openPDC, the openPDC Docker image, and openHistorian, with CISA ICS advisory ICSA-26-281-02 documenting the missing-authentication weakness (CWE-306); the assessed vector requires no authentication (PR:N) and yields a high-confidentiality, read-only exposure with no integrity or availability impact, so an attacker cannot alter or disrupt operations through this flaw alone. No public exploit identified at time of analysis, and realistic risk is dominated by network exposure: properly segmented OT/ICS networks sharply limit reachability, while flat networks or inadvertently internet-exposed publisher endpoints are fully exploitable.
Remote attackers holding low-privilege credentials can crash and reboot Red Lion Controls 700 Series switches by requesting a specific URL on the device's embedded management web server, and because the trigger is a single HTTP request the cycle can be looped with a tool such as curl to hold the switch in continuous reboot (persistent denial of service). The vulnerability is a reachable-assertion flaw (CWE-617) in the web server and is remotely exploitable without user interaction, but requires network reachability to the management interface and, per the assessed CVSS vector (PR:L), a valid low-privilege session; no public exploit code has been identified at time of analysis and no CISA KEV listing is associated with this CVE. Availability impact is high while confidentiality impact is nil, so the practical risk is loss of network switching, management access, and OT/ICS process connectivity rather than data theft.
Firmware and bootloader updates on Red Lion Controls' N-Tron 700 Series industrial Ethernet switches can be pushed or pulled without authentication or image integrity checks, so an attacker running the standard N-Tron management software can scan an OT network over SNMP and TFTP and load arbitrary firmware, taking control of the device image (CWE-494). The published CVSS 4.0 score is 8.4, while the assessed CVSS 3.1 vector (network, scope-changed, High integrity and availability impact) is more severe; the two vectors also disagree on prerequisites, with the published vector encoding PR:L (some privilege) versus PR:N in our assessment, a conflict to confirm with the vendor. Firmware updates are unauthenticated on the update path per the reported description, but there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; exploitation still requires routable access to the switch management plane, typically from inside a segmented, non-internet-facing OT/ICS network.
Stored cross-site scripting in Progress Telerik Report Server versions prior to 12.2.26.1007 allows an authenticated report author to execute arbitrary script in another user's session by embedding javascript: or vbscript: URLs in report navigation actions or HTML text-box links. When a higher-privilege user, such as an administrator, views the malicious report and triggers the embedded navigation, the script runs in the web report viewer's origin, enabling privilege escalation in multi-user deployments. The vulnerability has a CVSS score of 8.9, requires authentication and user interaction, and no public exploit has been identified at time of analysis.
Path traversal in Apache Camel Karavan 3.18.0 through 4.22.0 allows an authenticated user of any role to write arbitrary files outside the project directory by supplying a project file name containing '../' sequences, leading to overwrite of application configuration or classpath files and potential remote code execution in the Karavan container. The flaw is present in default behavior and requires only a valid account (CVSS 8.8, PR:L). No public exploit code or active exploitation has been identified at time of analysis, but the high impact and low privilege requirement make this a genuine high-priority issue.
Heap-based out-of-bounds write in FalkorDB's Bolt/WebSocket handling (all versions before 4.20.0) allows a remote unauthenticated attacker to crash the server and potentially corrupt heap memory by sending a WebSocket frame with a 64-bit extended payload length to the Bolt port. The flaw spans ws_read_frame in src/bolt/ws.c and buffer_apply_mask in src/bolt/buffer.c, where the only length check is an ASSERT() that is compiled out of release builds, so the masked XOR operation runs past the end of the receive buffer. Impact is limited to deployments that explicitly enable the Bolt endpoint via BOLT_PORT, which is disabled by default; no public exploit code has been identified at time of analysis.
Heap memory disclosure and denial of service in FalkorDB before 4.18.4 stem from an out-of-bounds read in the RDB deserialization routine BufferSerializerIOv2_ReadBuffer, which trusts a sub-buffer length field taken from the incoming stream and validates it only with an ASSERT() that is compiled out of release builds. Unauthenticated remote attackers who can drive a Redis replication exchange - for example by acting as a replication master against a network-reachable instance with no requirepass/ACL configured - can supply a crafted RDB stream to read past the end of a heap allocation, crashing the server or leaking heap memory (CVSS 8.8, high confidentiality and availability impact). No public exploit code has been identified at time of analysis, and the vendor has released a fix in FalkorDB 4.18.4, so residual risk is concentrated on unauthenticated, network-exposed deployments that have not yet upgraded.
Any authenticated user of Apache Camel Karavan 4.0.0 up to (but not including) 4.22.1 - regardless of role - can push arbitrary Kubernetes resources into the cluster through the deployment workflow. When a deployment is started, Karavan unmarshals the project's kubernetes.yaml and applies every resource it contains without restricting resource kinds, rejecting security-sensitive pod options (hostNetwork, hostPID, hostIPC, hostPath volumes, host ports, privileged containers, privilege escalation, added capabilities), or pinning a target namespace. The vendor score is 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while the independent assessment scores it scope-changed (S:C) because successful exploitation escapes the Karavan namespace boundary; the practical blast radius is capped by the RBAC permissions granted to Karavan's Kubernetes service account. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the issue is fixed in 4.22.1.
Ordinary authenticated users of clustered Nginx UI deployments can read the cluster node token from the JSON responses of /api/nodes and /api/nodes/:id and replay it in the X-Node-Secret header to be authenticated as a trusted peer node, crossing the node-to-node authentication boundary. Because the leaked secret is accepted by AuthRequired and mapped to the synthetic initUser principal, the attacker can reach sensitive management operations on any network-reachable cluster member, including configuration synchronization and service restarts. Affected versions are 2.0.0 through 2.4.x; the issue is fixed in Nginx UI 2.5.0. No public exploit code or confirmed active exploitation was identified at time of analysis, although the upstream fix commit is publicly visible.
Privilege escalation, filesystem access, and remote code execution in Dell Secure Connect Gateway (SCG) Policy Manager allow a low-privileged, authenticated remote attacker to move from limited access to full control of the affected host. Exploitation requires an existing low-privileged foothold on a network-reachable Policy Manager instance running a version prior to the fixed release; no victim interaction is needed and attack complexity is low (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8). There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.33% (24th percentile), so signals are mostly consistent and indicate a serious but not emergency-grade issue, with realistic risk concentrated where Policy Manager is exposed to untrusted networks or low-privilege credentials are easy to obtain.
Credential exposure in Nginx UI 2.0.0 through 2.4.x allows anyone who recovers the Node.Secret master credential to bypass password, JWT, session, and second-factor checks and obtain persistent administrative API access to configuration and secret material. Versions in that range accept the Node.Secret through the node_secret query parameter on HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header, so the credential can leak into access logs, reverse-proxy logs, browser history, Referer headers, configuration URLs, and deployment environment data. Exploitation is conditional rather than trivial: node/cluster authentication must actually be in use, the secret must have been transmitted as a query parameter in practice, and the attacker must have read access to one of those sinks; no public exploit code has been identified at time of analysis, and the vendor rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) while our independent assessment scores it AV:N/AC:H/PR:N/UI:N with the same High confidentiality, integrity, and availability impact.
Missing second-factor step-up enforcement in the Nginx UI cluster API (versions 2.0.0 through 2.4.x) allows anyone holding a valid session token to perform node CRUD operations, read or replace stored node credentials, change namespaces, and trigger cluster-wide Nginx reload or restart actions without re-verifying a one-time password. The api/cluster router is protected by AuthRequired but omits RequireSecureSession, so a stolen or persisted JWT belonging to an OTP-enabled user is sufficient; the flaw is an incomplete fix for CVE-2026-84315 and was corrected in version 2.5.0. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and exposure is limited to clustered/multi-node deployments reachable on the network, so this is a high-priority issue for that specific population rather than a mass-internet emergency.
Memory corruption in the Zephyr RTOS LE Audio Broadcast Sink (subsys/bluetooth/audio/bap_broadcast_sink.c) lets an attacker within Bluetooth radio range write attacker-chosen bytes into static .bss state by broadcasting a crafted Basic Audio Announcement (BASE) with more subgroups or a larger metadata LTV than the sink's fixed arrays can hold. No pairing, bonding, GATT connection, or user interaction is required (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.8); the target must be a build with CONFIG_BT_BAP_BROADCAST_SINK enabled and must be periodic-advertising-synced to the attacker's source, or to an advertiser whose address and SID the attacker impersonates (periodic advertising data is unauthenticated). Impact includes corruption of adjacent Bluetooth-audio state with potential remote code execution in the Bluetooth RX thread, plus out-of-bounds disclosure via the BAS receive-state notification; no public exploit code or confirmed active exploitation was identified at time of analysis. The issue is a genuine high-priority flaw rather than a CVSS-inflated paper risk, and an upstream fix is available.
WordPress sites running the BuddhaThemes ColorFolio theme (directory slug 'colorit') through version 1.3 expose an authenticated PHP object injection path, because the theme deserializes untrusted input without validating it (CWE-502), letting an attacker with a low-privilege account on the site supply crafted serialized data. CVSS 3.1 rates it 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the flaw is network-reachable, low-complexity, and needs no victim interaction, but full confidentiality, integrity, and availability impact is gated on the presence of a usable PHP object-injection (POP) gadget chain in the theme, WordPress core, or another installed plugin - without one the realized impact is substantially reduced. No public exploit code and no confirmed in-the-wild exploitation were identified from the available sources at time of analysis; exploitation also requires that the specific vulnerable ColorFolio version be installed and active.
PHP object injection in the BuddhaThemes Neo | Barber Shop WordPress theme (slug neocut), affecting all versions through 3.5, lets an authenticated attacker with a low-privileged account (subscriber or contributor level) deliver a crafted serialized PHP object to the theme's unsafe deserialization routine, potentially reaching high confidentiality, integrity and availability impact if a usable POP gadget chain exists. The issue carries CVSS 8.8 via vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and no public exploit code has been identified at time of analysis (no CISA KEV listing). Because the required authentication level, the niche deployment of this specific theme, and the dependence on gadget-chain availability all limit practical exploitation, this is a genuine high-priority issue but short of critical-emergency status.
Cross-site request forgery in Nginx UI versions 2.0.0 through 2.4.x lets a remote attacker drive a logged-in administrator's browser into performing authenticated, state-changing management operations - including rewriting Nginx configuration through POST /api/configs, triggering config reloads, and invoking other admin endpoints - because the AuthRequired middleware accepts the browser-managed JWT cookie as a valid API credential while management routes generally enforce neither a CSRF token nor Origin/Referer validation. Exploitation requires the victim to be a currently logged-in administrator who is induced to visit an attacker-controlled page (UI:R); per the CVSS vector the attacker needs no credentials of their own (PR:N), but a targeted account protected by OTP/Passkey step-up, or an endpoint requiring secure-session proof, is not exploitable. The attacker cannot read cross-origin responses, so impact is blind configuration tampering and service disruption rather than data exfiltration; the issue is fixed in 2.5.0, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authorization bypass in Dell Secure Connect Gateway (SCG) Policy Manager lets an authenticated, low-privileged user tamper with a user-controlled key to reach resources and actions reserved for higher-privileged accounts, resulting in elevation of privileges with high impact to confidentiality, integrity, and availability. Only SCG Policy Manager builds below the vendor-fixed release are affected; exploitation requires an existing valid low-privileged account plus network reachability to the product interface, so fully unauthenticated outsiders cannot trigger it. Risk is real but not emergency-grade: EPSS is low at 0.18 percent (7th percentile), CISA SSVC rates exploitation as none and automatable as no, and no public exploit has been identified at time of analysis. Vendor-released patches are available through Dell advisory DSA-2026-385.
Improper X.509 certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager lets an unauthenticated attacker who has already attained a man-in-the-middle position on the network path to the appliance substitute a forged or untrusted certificate and hijack the affected TLS session, with the potential to disrupt service, expose data, and execute code in the context of the connection. Exploitation is not opportunistic: per the independent assessment the vector is AV:N/AC:H/PR:N/UI:R, so an attacker must both intercept the network path and induce a victim or client to initiate or complete the affected TLS handshake, which meaningfully limits exposure where the Policy Manager sits on a trusted management segment. Risk is currently low-to-moderate in practice - EPSS is 0.18% (7th percentile), no public exploit code has been identified at time of analysis, and CISA SSVC records Exploitation: none - although the vendor CVSS of 8.8 (High) reflects total confidentiality, integrity, and availability impact if the MITM precondition is met.
Privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager allows an authenticated, network-reachable low-privileged user to bypass authorization by manipulating a user-controlled key (object/resource identifier) that the application trusts, escalating to a higher-privileged role with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only installations running versions below the patched build are affected; the vulnerability is not remotely exploitable without credentials, requires no victim interaction, and per available intelligence there is no public exploit code and no confirmed active exploitation (CISA KEV not listed, SSVC exploitation: none, EPSS 0.18% / 6th percentile). The independence assessment rates this a credible but not emergency-level priority: the attacker must first hold valid low-privilege credentials, but once inside can turn a benign identifier into an elevation-of-privilege primitive.
Elevation of privilege in Dell Secure Connect Gateway (SCG) Policy Manager lets an attacker who already holds a valid low-privileged account and network reachability to the appliance invoke privileged functionality that lacks a proper authorization check, producing high confidentiality, integrity, and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). Exploitation is not remote-unauthenticated - a pre-existing low-privileged credential is a hard prerequisite. No public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is 0.16% (5th percentile), CISA SSVC rates exploitation as none and automatable as no, and a vendor patch is available.
Remote code execution in ILIAS LMS versions before 9.24, 10.12, and 11.5 lets an authenticated author who holds question-pool (QTI) import rights upload a crafted question-import archive that writes a .htaccess file plus a PHP payload into the web-served image directory, resulting in code execution as the web server user. The defect is an unrestricted file upload (CWE-434) in the QTI image-handling security class ilQtiMatImageSecurity, reached through the standard question import path with no non-default configuration required. Exploitation requires a legitimate, permissioned authoring account rather than anonymous access, no public exploit code has been identified at time of analysis, and vendor-released fixes are available in 9.24, 10.12, and 11.5; instances that limit QTI import rights to vetted staff face materially lower realistic risk.
Sandbox escape and kernel-level out-of-bounds write in the Zephyr RTOS userspace subsystem: an unprivileged user-mode thread that holds an assigned resource pool can pass a size near SIZE_MAX to the k_object_alloc_size() syscall (or the thread-stack branch via k_thread_stack_alloc()), causing an unsigned integer wrap-around in dynamic_object_create() so that a few-byte heap chunk is allocated while the object descriptor is registered under the caller's requested type. The subsequent init syscall (for example k_mutex_init(), k_sem_init(), or k_thread_create()) then writes a full kernel object over the truncated allocation, giving a supervisor-mode heap overflow of attacker-influenced size and content that corrupts sys_heap chunk metadata and adjacent kernel objects, and - when CONFIG_GEN_PRIV_STACKS is set - plants an attacker-influenced wild pointer as a user thread's privileged stack base. This is a local, high-priority privilege-escalation issue (CVSS 8.8, AV:L/PR:L/S:C) rather than a remotely reachable one: exploitation requires code execution as an unprivileged thread inside the CONFIG_USERSPACE sandbox on a build that also enables CONFIG_DYNAMIC_OBJECTS (or CONFIG_DYNAMIC_THREAD under userspace) and that assigns a resource pool to the calling thread; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV. The vendor has published a fix that rejects both overflowing computations and frees the partially built descriptor.
Command injection in the Argo CD repo-server allows anyone holding repository create/update privileges to execute arbitrary shell commands on the repo-server by configuring an SSH Git repository with a proxy URL whose hostname contains shell metacharacters. The flaw affects all Argo CD releases from v2.11.0 onward (v2.10.20 and earlier are not vulnerable) and carries a CVSS v3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires delegated repository or repository-credential-template write access (PR:L), not anonymous access, and no user interaction is needed once the malicious proxy is stored. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available in v3.3.15, v3.4.10, v3.5.4, and v3.6.0-rc2.
PHP Object Injection in the Quiz And Survey Master plugin for WordPress (versions up to 11.2.7) allows an authenticated attacker with low privileges to execute arbitrary code or manipulate files via crafted serialized input. The vulnerability is network-reachable with low complexity and no user interaction, and can lead to full site compromise if a suitable gadget chain is present. No public exploit code has been identified at the time of analysis.
Attackers can forge state-changing requests in the Featured Image from URL WordPress plugin through 6.0.7, allowing them to cause an authenticated administrator to perform unintended actions, but only if the administrator interacts with attacker-controlled content (UI:R). The input CVSS of 8.8 overstates impact; independent assessment rates confidentiality and integrity as Low and availability as None. No public exploit code identified at time of analysis; consult the Patchstack advisory for remediation.
Unbounded memory allocation in Xerial snappy-java before 1.1.10.9 lets unauthenticated remote attackers exhaust the JVM heap by declaring an oversized uncompressed length in a compressed stream header, triggering OutOfMemoryError and denial of service. Any application that passes externally supplied bytes to Snappy.uncompress, Snappy.uncompressString, SnappyInputStream or SnappyFramedInputStream - for example Kafka, Hadoop/Spark or other services using snappy-java transitively - is in scope, and a handful of crafted bytes can force allocations of up to 2 GB before decompression validates the data. Impact is limited to availability (CVSS:4.0 base 8.7; assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no data disclosure or modification, and no public exploit was identified at time of analysis; the practical constraint is reachability, since applications that only decompress trusted internal data are not meaningfully exposed.
SmarterMail before build 9777 fails to revalidate the role claim embedded in JWT access and refresh tokens when a token is redeemed at POST /api/v1/auth/refresh-token, so an authenticated attacker (PR:L) who holds a refresh token issued before an administrator demotion can replay it to mint a new access token that still carries the higher-privilege role, such as DomainAdmin or SysAdmin. The exposure is bounded by the token's natural expiry and only matters in environments where privileged accounts are actually demoted or revoked, since the attacker must either be the demoted user or have captured their pre-demotion token. No public exploit code has been identified at time of analysis, there is no KEV listing, and the independent assessment rates this a credible mid-to-high priority issue rather than an emergency.
Server-side request forgery in Dell Secure Connect Gateway (SCG) Policy Manager allows a remote attacker who already holds high-privilege (administrative) credentials to coerce the appliance into issuing requests to attacker-chosen destinations, causing information disclosure, unauthorized access, and bypass of protection mechanisms (CWE-918; CVE-2026-78024). The scope-change metric (S:C) indicates forged requests can affect systems beyond the vulnerable component, and the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N confirms the exploitation prerequisite is authenticated administrator access - this is the primary limiting factor and means unauthenticated or low-privileged remote users cannot trigger it. At time of analysis there is no public exploit identified and no confirmed active exploitation (CISA KEV: no; SSVC exploitation: none), EPSS is only 0.20% (9th percentile), and a vendor patch is available, so this ranks as a moderate, non-urgent priority despite its 8.7 'High' base score.
Remote code execution in SmarterMail builds before 9777 allows an attacker who already holds a SysAdmin-scoped access token to escape the Volume Mount script-directory containment and execute code as the SmarterMail service account with SYSTEM-level privileges. The chain abuses administrative endpoints - domain-put to provision a mail domain with an arbitrary FileStore root inside the trusted Scripts directory, AddOrUpdateMount to disclose the Scripts path, and global-mail to clear the upload extension blacklist - then uploads a malicious script through the ordinary mail file-storage upload API so that saving a CommandMount triggers RunScript before validation, yielding a reverse shell. Exploitation is post-authentication and access-gated by the required high-privilege token, no public exploit has been identified at time of analysis, and the vendor has released a fix in build 9777 (Oct 8, 2026).
An out-of-bounds stack write in the MariaDB CONNECT storage engine's DOS table type lets an authenticated user crash the server and potentially achieve code execution by supplying a crafted column definition and value. The flaw is an incorrect boundary check in the CONNECT value conversion routine that permits a one-byte null write past a stack buffer at an attacker-controlled offset (CWE-787), and it affects MariaDB from 10.6.1 up to the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2. Exploitation requires the non-default CONNECT engine to be installed and enabled plus privileges to create CONNECT tables of table_type 'dos' with a crafted numeric definition such as double(255,30); the vendor rates it CVSS 8.5 while the independent assessment is slightly lower (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because authentication, a non-default engine, and high attack complexity are needed, and no public exploit code was identified at time of analysis.
Blind SQL injection in the tagDiv Opt-In Builder WordPress plugin (slug td-subscription) through version 1.7.6 allows remote authenticated attackers with low privileges to extract sensitive data from the site's database via inference-based queries. The flaw is a CWE-89 improper neutralization of special elements in SQL commands; exploitation requires a valid low-privilege account (e.g., subscriber or contributor) and no user interaction, making sites with open registration the primary exposure. Assessed severity is high for confidentiality (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and no public exploit identified at time of analysis.
Bluetooth authentication bypass in SwitchBot Door Lock Series allows an attacker within BLE range to manipulate the lock's communication protocol and bypass electronic lock and access controls without valid credentials, a PIN, or app pairing (PR:N, UI:N). The root cause is CWE-1204 cryptographic misuse, specifically weak initialization vector or related BLE protocol weaknesses, and exploitation is non-remote and does not scale because it requires per-target physical proximity within roughly 10 meters and interaction with live Bluetooth traffic. No public exploit identified at time of analysis; the risk is a targeted physical-intrusion issue that is narrower in reach than the 8.5 score alone suggests.
Code execution inside the gVisor sentry process is achievable by a local attacker holding standard container privileges on any platform running a gVisor build prior to release 20260831.0, due to a use-after-free/double-free of the MemoryFile backing an in-sandbox overlay filesystem in the virtual filesystem (VFS) mount layer. The issue is local-only and requires authenticated in-sandbox access (CVSS 4.0 vector AV:L/PR:L), and the resulting code execution lands in the sentry, which remains confined by host-level Linux seccomp and namespace boundaries rather than directly in the host kernel, so a single exploitation does not automatically yield host-kernel compromise or cross-tenant escape. No public exploit code was identified at time of analysis, but the trigger path is documented in the upstream fix's regression tests.
Blind SQL injection in the Metagauss ProfileGrid WordPress plugin (all versions through 6.0.0.2) lets an authenticated low-privilege user, such as a self-registered member of a community site, inject arbitrary SQL into a vulnerable plugin query and infer database contents through response timing or boolean differences. The issue is network-reachable, low complexity, and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N, reported base score 8.5), with the practical barrier lowered because ProfileGrid is a user-profile/community plugin that frequently permits open self-registration; the independent assessment rates confidentiality impact as High, integrity Low, availability None. No public exploit code and no confirmed active exploitation were identified at time of analysis. The specific vulnerable endpoint and parameter are not named in the available data, so defenders cannot pin the trigger to a specific setting.
Blind SQL injection in the Taskbuilder WordPress plugin (all versions up to and including 6.0.5) allows an attacker who holds a valid low-privilege account to inject SQL through a plugin endpoint or parameter that fails to neutralize special elements, potentially exposing arbitrary data from the site's WordPress database. The vulnerability requires authentication (CVSS vector PR:L) and the plugin installed and active; the specific vulnerable feature, endpoint, and parameter are not named in the available advisory text, which limits targeted exploitation somewhat. At time of analysis there is no public exploit identified, no indication of confirmed active exploitation (not in CISA KEV), and no exact patched version confirmed, so this is a credible-but-not-urgent remediation priority - sites that allow open registration or host many low-privilege accounts carry the highest relative risk.
Blind SQL injection in the VibeThemes WPLMS WordPress e-learning theme, affecting all releases through version 4.973, lets an attacker with a logged-in low-privilege account inject SQL into backend queries and extract database contents through inference-based techniques. The authentication requirement (PR:L in the CVSS vector) is the main limiting factor, but it is a weak barrier in practice because many WPLMS-based learning sites allow open student or subscriber self-registration, effectively lowering the entry cost to near-anonymous. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); independent assessment classifies it as a genuine, elevated-priority problem rather than an emergency, with high confidentiality impact (C:H), limited integrity exposure (I:L), and no confirmed availability impact (A:N).
Blind SQL injection in the UpSolution Core WordPress plugin (us-core) through version 9.3 lets an attacker who already holds a low-privilege authenticated WordPress session inject SQL through a vulnerable parameter and extract database contents by inference (boolean/time-based) rather than by reading query output directly. Our independent assessment is more conservative than the vendor-advisory score of 8.5: with impact confined to confidentiality (C:H/I:N/A:N) and a mandatory PR:L session prerequisite, the effective severity is closer to 6.5, making this a genuine but conditional priority rather than a drop-everything emergency. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Privilege escalation in MariaDB Server (10.6.1 up to 10.6.28, 10.11.x before 10.11.19, 11.4.x before 11.4.13, 11.8.x before 11.8.9, 12.3.x before 12.3.3, and 13.0.x before 13.0.2) allows an authenticated database user holding the FILE privilege to plant a /run/mysqld/wsrep-new-cluster file when secure-file-priv permits writes into that runtime directory, which the packaged mariadb.service systemd unit subsequently consumes as an EnvironmentFile. On the next administrator-triggered restart of mariadb.service, attacker-controlled environment values are injected into the mariadbd process, escalating from the database user context onto the host/systemd layer (scope change) with full confidentiality, integrity, and availability impact. The vendor rates this 8.4 while our independent assessment uses CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H, reflecting that exploitation requires a high, non-default privilege and a restart gate; no public exploit code has been identified at time of analysis, and patched releases are already available.
RPM-based MariaDB Server packages up to the fixed releases can create the mysql service account with the database data directory as its home, allowing a database user that holds the FILE privilege to write shell startup files such as .bash_profile there. Those files only execute if an administrator later opens an interactive login shell as the mysql account, overriding its usual /sbin/nologin shell, so real-world exploitation requires both a highly privileged database account and a non-default administrator action. No public exploit has been identified at the time of analysis, Debian/Ubuntu packages are not affected because they already use /nonexistent as the account home, and the CVSS base score of 8.4 overstates the realistic likelihood given the required preconditions.
Keystream reuse in the native one-shot CTR packet cipher of Bouncy Castle for Java LTS before 2.73.13 allows remote attackers to recover plaintext from ciphertext alone, without knowledge of the key. Exploitation is unauthenticated but conditional: the application must use the native one-shot CTR path with a 13-, 14-, or 15-byte IV, leaving only a 1-, 2-, or 3-byte block counter (256, 65,536, or 16,777,216 blocks), and must pass a single input longer than that counter space so the counter wraps and the keystream restarts within the packet. The call returns the full input length with no exception, so the caller receives no signal that some bytes were transformed under a repeated keystream; the resulting two-time-pad condition permits plaintext recovery. No public exploit code has been identified at time of analysis, and the non-default short-IV native deployment requirement keeps realistic exposure narrow, which is why this is assessed as AC:H rather than trivially exploitable.
Memory-exhaustion denial of service in the elixir-protobuf library (protobuf) from 0.8.0 onward allows an unauthenticated remote attacker to crash an Elixir decoding process by supplying a deeply nested JSON document through Protobuf.JSON.decode/3, decode!/3, or from_decoded/3 when the target schema contains a self-referential or cyclic message type. Because the embedded-message clause of decode_singular/3 recurses once per nesting level without touching the decoder's depth counter, the recursion_limit option offers no protection and each level consumes a stack frame plus heap objects until the process runs out of memory; confidentiality and integrity are unaffected, only availability. Exploitation is unauthenticated and requires no user interaction, but is limited to applications that decode untrusted JSON into recursive message definitions, and no public exploit code has been identified at time of analysis (EPSS data not provided).
Malformed 6LoWPAN fragments can drive an out-of-bounds read in the GNRC network stack of RIOT OS 2026.07 and earlier, crashing the stack and potentially exposing adjacent memory. The flaw sits in _receive() in sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c, which forwards an undersized packet into SFF fragment handling after only a minimal payload check, so gnrc_sixlowpan_frag_recv() then interprets bytes as a sixlowpan_frag_t (or larger fragment header) that the packet snip does not actually contain. Exploitation requires no authentication or user interaction (PR:N/UI:N) and, per this assessment, is bounded by delivery: because 6LoWPAN rides on IEEE 802.15.4, the attacker must be within radio range of the node or able to inject fragments into its mesh (AV:A, assessed vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H; the reporter's AV:N/8.2 rating assumes arbitrary remote reachability that is not generally available unless a border router forwards attacker-controlled fragments inward). Availability is the dominant impact (A:H - crash of the GRNC network stack), with limited secondary memory disclosure (C:L); no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Google Guava 4.0 through 33.7.1 can be triggered by remote unauthenticated attackers who can supply crafted Java serialization streams containing CompactHashMap, CompactHashSet, or MapMakerInternalMap objects, causing Guava to allocate an attacker-controlled backing array without throttling and exhaust memory with OutOfMemoryError. This is a genuine but conditional availability-only risk: exploitation requires the target application to perform Java native deserialization (ObjectInputStream.readObject) on attacker-influenced input, and any authentication or authorization in front of the deserializing endpoint further limits reach; no code execution or data disclosure results. A vendor fix is available in Guava 33.7.2, and no public exploit identified at time of analysis.
Code injection in @tinacms/cli versions up to and including 2.7.0 lets a crafted Git branch name break out of the string literal used for the generated client's API URL and execute arbitrary JavaScript when that generated client module is imported during a preview or CI build. The flaw, rated CVSS 8.2 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N), requires the build to actually run codegen and import the generated client, and requires an attacker able to influence the branch value read from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, so exploitation is gated by meaningful preconditions rather than being trivially remote. Injected code runs with build-process privileges, allowing theft of environment credentials, tampering with deployment artifacts, and outbound network requests; no public exploit tooling identified at time of analysis, though the vendor advisory documents a working proof-of-concept branch-name payload, and there is no evidence of active exploitation (no CISA KEV listing) or EPSS data provided.
Information disclosure in NetApp Trident v25.02.1 through v26.06.1 allows an authenticated local attacker with read access to debug logs to obtain LUKS passphrases or SMB Active Directory credentials. The vulnerability only manifests when debug logging is enabled and the affected features (LUKS-encrypted volumes and/or SMB shares joined to AD) are in use, requiring a low-privilege foothold on the host. No public exploit or active exploitation has been identified, and the attack is configuration-gated, making the real-world risk non-urgent despite a CVSS score of 8.2.
Authentication bypass in Hayat Mobile 3.3.x (from 3.3.0 up to but excluding 3.4.0) lets remote, unauthenticated attackers defeat the application's login/trust checks because those decisions are made on the client side, giving access to data that should require a valid session. The vendor/Turkish CERT rates it CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), so no credentials or victim interaction are stated as prerequisites, with high confidentiality impact but only low integrity impact and no availability impact. There is no CISA KEV listing and no public exploit identified at time of analysis; the exposure is bounded by the fact that Hayat Mobile is a single healthcare provider's app, and upgrading to 3.4.0 removes the bypass.