Reachable assertion in Open5GS through 2.8.0 allows remote unauthenticated attackers to crash the MME (open5gs-mmed), causing denial of service for all subscribers. Exploitation requires that the malicious GTPv1-C packet originate from or spoof a configured SGSN address and that the attacker know a valid UE IMSI or P-TMSI, conditions that limit the attack to scenarios where trust relationships and subscriber identifiers are known. No public exploit identified at time of analysis; vendor patch available (commit 346ce7a).
Account takeover in Nginx UI versions 2.0.0 through 2.4.x affects accounts configured with a passkey as their only second factor: the POST /api/login handler checks EnabledOTP but never requires a WebAuthn assertion when EnabledPasskey is true and no TOTP secret exists, so a valid password alone yields a fully authenticated session despite the account reporting a second factor. An attacker who already holds the account password can reach administrative Nginx UI functionality without possessing the registered passkey; accounts protected by TOTP, and accounts with no 2FA configured, are unaffected. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the CVSS 3.1 score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the AC:H metric reflecting the hard password precondition rather than any exploit complexity.
Authenticated users of Nginx UI 2.0.0 through 2.4.x who hold permission to create and restore backups can persistently inject modified Nginx configuration or Nginx UI configuration files by crafting a backup archive that carries a symlink pointing at the live configuration path, achieving this even when the restore_nginx and restore_nginx_ui flags are both false. The flaw (CWE-59, link following) stems from the restore path extracting inner archives and materializing symlinks before the restore flags are enforced, so a regular file subsequently written through the staged link lands in the live configuration tree; the resulting tampering takes effect only when those files are later consumed by Nginx, and can produce denial of service. Rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), this requires a valid backup-capable login (PR:L) and is not a remote-unauthenticated attack, and no public exploit code was identified at time of analysis; vendor-released patch: 2.5.0 fully remediates the issue.
Privilege escalation in Vikunja 2.3.0 allows a user who holds a narrowly scoped API token (permissions {"oauth":["authorize"]}) to exchange that token for unrestricted session credentials, defeating the API-token permission boundary. The token holder calls POST /api/v1/oauth/authorize to obtain an OAuth authorization code and then POST /api/v1/oauth/token to trade it for a normal bearer JWT and refresh token that are not bound to the original token's scope - runtime validation showed the scoped token could not read GET /api/v1/user, while the minted token could reach both /api/v1/user and /api/v1/projects. The vulnerability requires an already-issued scoped token from the same user (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, CWE-269), no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV). Version 2.4.0 fixes the issue.
Plaintext storage of password-reset, email-confirmation and account-deletion tokens in Vikunja prior to 2.4.0 allows anyone who already holds read access to the backend database to redeem a pending token and take over the associated account, including administrator accounts, without knowing any password. The vulnerability is a CWE-312 cleartext-storage flaw rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), where the high attack complexity reflects two preconditions rather than any weakness in the exploit itself: the attacker must independently obtain database read access (leaked or misconfigured backups, exposed storage, or a secondary SQL-level exposure), and the victim account must have an unexpired token within its 24-hour lifetime. The vendor advisory publishes proof-of-concept code illustrating the attack (a SQL query harvesting tokens plus a password-reset redemption request); no KEV listing was provided in the available intelligence, so there is no confirmation of active exploitation, and the CVSS vector's PR:N confirms the token-redemption step itself requires no Vikunja application credentials or user interaction.
Protection mechanism bypass in Dell Secure Connect Gateway (SCG) Policy Manager (versions below the vendor-fixed release) lets a remote, low-privileged attacker who already holds valid credentials on the appliance defeat intended authorization controls via a 'failing open' error-handling flaw (CWE-636). Successful exploitation yields high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with no availability impact. EPSS is low at 0.20% (9th percentile), CISA SSVC records no observed exploitation, and no public exploit identified at time of analysis, so priority is elevated-but-not-emergency, driven mainly by exposure of the management interface and the presence of low-privileged accounts.
SessionManager rate-limit bypass in Argo CD v3.0.6 allows unauthenticated remote attackers to issue repeated concurrent crafted login requests and win a race-condition timing window, circumventing the login throttling intended to slow brute-force attempts. The CVSS 3.1 score is 8.1 with High confidentiality, integrity, and availability impact, but High attack complexity reflects the need to reliably win the timing race; follow-on account compromise is further limited by strong credentials, SSO/external identity providers, or secondary lockout controls. EPSS is low at 0.15% (4th percentile), and no public exploit was identified at time of analysis.
Local file inclusion in the Fuelthemes The Voux WordPress theme through version 6.9.5 lets unauthenticated remote attackers induce the server to include attacker-influenced local files - with possible escalation to PHP code execution if parseable content can be placed or referenced on the host - by reaching an undisclosed include/require code path (CVSS 3.1: 8.1, AV:N/AC:H/PR:N/UI:N). The high attack-complexity value indicates exploitation is not trivial and depends on a condition the Patchstack advisory does not disclose (likely a specific request parameter feeding a theme include/require call, or a particular theme function or page being active). No public exploit code and no confirmed active exploitation were identified at time of analysis, so this should be treated as a genuine but second-tier priority for sites running The Voux 6.9.5 or earlier.
Local file inclusion in the Fuelthemes Werkstatt WordPress theme (all versions through 4.8.3) allows unauthenticated remote attackers to route unsanitized input into a PHP include/require statement, exposing server-side files such as wp-config.php and potentially escalating to code execution if an attacker-controlled file can be placed on the target. The issue is rated CVSS 8.1 (High) under CWE-98; no public exploit code and no confirmed active exploitation were identified at time of analysis. Attack complexity is High (AC:H) because meaningful impact depends on server configuration and on an attacker-controllable includable path, and sites not running Werkstatt or already updated past 4.8.3 are not affected.
Out-of-bounds reads and writes in MariaDB Server's binary FRM (table-definition) parser allow an attacker who can drop a crafted .frm file into the server's data directory and then cause that table to be opened to crash mysqld or potentially execute code in the server process. Affected releases are MariaDB Server from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The published CVSS of 8.0 is driven by high confidentiality, integrity and availability impact once the parser is reached, but the independent assessment rates the practical path as local (AV:L/AC:L) with high privileges required (PR:H), since file placement in the data directory is a host/local operation rather than a remote unauthenticated one; no public exploit identified at time of analysis.
Memory corruption in the Linux kernel's LWT_SEG6LOCAL BPF path can be triggered by a local privileged user who can load and attach a BPF program to an IPv6 segment-routing route; the unsafe sequence invalidates the cached SRH and then reallocates skb->head, leaving a dangling pointer that is later written through. Only systems using the non-default SEG6 LWT feature with attached BPF programs are affected, and the attacker must hold CAP_NET_ADMIN/CAP_BPF, so exposure is bounded. No public exploit identified at time of analysis, and EPSS is low at 0.16% (5th percentile), though vendor patches are available.
Use-after-free in the Linux kernel veth driver can leave stale XDP program pointers on removed RX queues, so a later channel increase may run a freed BPF program and crash or corrupt kernel memory. The flaw is locally reachable (CVSS 7.8, AV:L/PR:L) by an authenticated attacker able to resize veth channels and attach or detach XDP programs, typically requiring CAP_NET_ADMIN unless unprivileged user namespaces grant it. No public exploit was identified at time of analysis, EPSS is low at 0.16% (5th percentile), and vendor patches are available.
A use-after-free in the Linux kernel BPF link iterator lets a local user who can already use the BPF subsystem (CAP_BPF or CAP_SYS_ADMIN) corrupt freed slab memory and potentially escalate privileges or crash the system. The flaw is a race: bpf_link_prime() inserts a link into link_idr before anon_inode_getfile() succeeds and before bpf_link_settle() publishes the link ID, and while bpf_link_by_id() rejects such ID-zero links as unsettled, the link iterator takes a reference to them anyway - if anon_inode_getfile() then fails, the creator frees the still-private link and the iterator is left holding a dangling reference that the next bpf_link_put() writes through. Exploitation is local-only and depends on winning a narrow race window combined with the file-allocation failure path, which is why the assessed severity uses AC:H rather than the raw 7.8; EPSS is 0.16% (5th percentile), there is no CISA KEV entry and no public exploit identified at time of analysis, and vendor patches are available for the affected stable branches.
Driver-specialized BPF metadata kfuncs can be executed against the wrong driver's XDP buffer in the Linux kernel's BPF offload matching logic, producing an out-of-bounds read and a kernel panic (observed as a KASAN null-ptr-deref in veth_xdp_rx_timestamp when a veth-bound program is run on a tun device). The flaw requires local access with both CAP_BPF and CAP_NET_ADMIN, plus an offload/dev-bound BPF program configuration, so exposure is concentrated on hosts that delegate these capabilities to containers or namespaces; the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8). No public exploit code was identified at time of analysis and the issue is not in CISA KEV, with EPSS at 0.16% (4th percentile); vendor patches are available in the stable branches listed in the advisories.
Out-of-bounds memory access in the Linux kernel BPF subsystem affects kernels built from Linux 6.10 onward (from commit db69718b8efac802c7cc20d5a6c7dfc913f99c43) where a percpu array is used as an inner map in a map-in-map arrangement. A local attacker who can load eBPF programs and create BPF maps (typically requiring CAP_BPF/CAP_SYS_ADMIN or a configuration permitting such map operations) can replace the template inner map with a differently sized percpu array; because percpu_array_map_ops.map_meta_equal points at the generic bpf_map_meta_equal(), which does not compare max_entries, the replacement is accepted and percpu_array_map_gen_lookup() then performs a lookup using the original template's index_mask baked in as a JIT immediate, indexing pptrs[] out of bounds. No CISA KEV listing and no public exploit code were identified at time of analysis, and EPSS is very low at 0.15% (3rd percentile), consistent with a genuine but non-urgent local privilege issue rather than a mass-exploitation threat.
Arbitrary code execution in Aegisub 3.2.0 through 3.4.2 occurs when a victim opens a crafted .ass subtitle project whose 'Automation Scripts' metadata references an attacker-supplied Lua Automation script, which Aegisub auto-loads without prompting the user to trust the script or its author and runs with the privileges of the Aegisub process. Versions 3.4.0 through 3.4.2 add a single-file attack path in which inconsistent handling of embedded NUL characters between extension validation and filesystem operations lets a crafted ASS/Lua polyglot reference and execute itself, removing the need to deliver a separate script file. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), making it a local, user-interaction-driven issue that does not affect any network service; there is no public exploit identified at time of analysis, so real-world urgency is moderate rather than critical, and Aegisub 3.5.0 fixes the vulnerability.
Local privilege escalation in Zephyr RTOS allows an unprivileged user-mode thread, in builds that enable both CONFIG_USERSPACE and CONFIG_DEVICE_DEINIT_SUPPORT, to pass a user-writable kernel object - most practically a thread stack from k_thread_stack_alloc() or a granted static K_THREAD_STACK - to the device_deinit() syscall and achieve supervisor-mode code execution. The flaw is a type-confusion issue in z_vrfy_device_deinit(): validation with K_OBJ_ANY skips the object type comparison, so z_impl_device_deinit() treats attacker-written bytes as a struct device and follows attacker-controlled state and ops.deinit pointers. The upstream fix is available via commit 1036694889ab33996db41b4141ddf66aa786d267, no public exploit code was identified at time of analysis, and impact is gated by the required build configuration; v4.2.x and v4.3.x defaulted the vulnerable option to y, while v4.4.x is exposed only if explicitly enabled.
Information disclosure in Backdrop CMS 1.34.x before 1.34.5 and 1.35.x before 1.35.1 allows remote unauthenticated attackers to retrieve a previously generated compressed configuration export archive because the archive is not sufficiently protected during delivery. Exploitation is contingent on a configuration export having been previously requested by a user with the 'Synchronize, import, and export configuration' permission, which is the vendor-stated mitigating factor and the reason the assessed attack complexity is high. No public exploit code has been identified at the time of analysis, and the issue is fixed in Backdrop CMS 1.34.5 and 1.35.1.
Stored cross-site scripting and potential remote code execution in HortusFox (hortusfox-web) through version 6.3 allow authenticated users to upload files with client-supplied extensions via the plant attachment feature, which are stored under the web-accessible public/attachments/ directory. Uploaded HTML or SVG files lead to stored XSS when a victim opens them, while uploaded PHP files can execute code on servers where .htaccess restrictions are unenforced, though this RCE path requires a non-default misconfiguration. No public exploit code has been identified at time of analysis, although a public technical write-up demonstrating the stored XSS is referenced. The CVSS 4.0 base score is 7.7 (High), and an independent CVSS 3.1 assessment rates it High with C:H/I:H/A:H.
Type confusion in FalkorDB versions before 4.20.0 allows an authenticated client that can issue GRAPH.QUERY to crash the server and, depending on heap layout, potentially disclose or corrupt memory. The flaw lives in the _read_flags handler in src/commands/cmd_dispatcher.c, which accepts a --bolt argument from any client and blindly casts the following Redis string object to a bolt_client_t structure without verifying its origin, so result-set code later dereferences attacker-influenced pointers; the argument is parsed even when the Bolt endpoint is disabled, meaning default installations are exposed. Exploitation requires valid credentials with query-execution rights, and because of the high attack complexity (AC:H) a denial-of-service crash is the most reliable outcome, with memory disclosure or corruption being layout-dependent and not guaranteed; no public exploit code has been identified at time of analysis and the vendor has released a fixed version. This is assessed as a moderate-priority issue rather than an emergency.
Remote code execution in AstronRPA through 1.1.6 is possible when the desktop client's smart-component chat processes attacker-controlled content and renders unsanitized LLM output through v-html, allowing HTML event handlers to call an unrestricted open-path IPC handler with shell metacharacters and run OS commands as the desktop user. The issue is remote and unauthenticated per the CVSS 4.0 vector (PR:N), but practical exploitation requires user interaction (UI:P), depends on reliably coercing non-deterministic LLM output (AC:H/AT:P), and is limited to the logged-in user's privileges. The CVSS 4.0 base score is 7.7 (High) with VC:H/VI:H/VA:H; no public exploit or CISA KEV active exploitation is identified in the provided data.
Remote code execution on the AstronRPA desktop client through version 1.1.6 is achievable by an on-path attacker who intercepts the client's plaintext HTTP auto-update check and serves a malicious update manifest with an unsigned NSIS installer, which electron-updater installs without verifying a publisher signature. The weakness is CWE-494 (download of code without integrity check), rated 7.7 under CVSS 4.0 with High attack complexity and attack requirements Present because the attacker must already hold a man-in-the-middle position and the client must run an update check; there is no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, so this is a conditional, non-scalable threat rather than a mass-exploitation emergency.
Arbitrary constructor code execution in Grid Protection Alliance openPDC and openHistorian is reachable by an authenticated user who is also able to place a file on the host filesystem, because the component-loading routine instantiates any type name it is given without validating that the type is a legitimate component (CWE-470, unsafe reflection). Successful abuse executes attacker-supplied constructor code with the privileges of the affected service account, giving high confidentiality, integrity and availability impact on the affected instance. Exploitation is conditional rather than trivial - CVSS 4.0 scores it 7.7 with attack requirements present (AT:P) and low privileges required (PR:L), an independent assessment agrees on AV:N/AC:H/PR:L with high C/I/A impact, and no public exploit was identified at time of analysis (no CISA KEV listing, no PoC reported).
Stored cross-site scripting in TinaCMS's @tinacms/web-components package (all versions up to and including 0.2.0) lets an authenticated content author save a rich-text link whose URL uses a script-capable scheme such as javascript:, which the tina-markdown element then writes straight into an anchor href; a visitor who clicks the rendered link executes attacker-controlled script in the site's origin. Because the payload persists in CMS content and runs in the victim's origin, an editor or administrator who clicks it can expose TinaCMS admin credentials held on that site (CVSS 7.6, AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, CWE-79). Key prerequisites are an author-level account, a deployment that renders content via the web-components renderer rather than the sanitizing React, static, or Astro renderers, and a victim click; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Remote unauthenticated attackers can trigger a buffer overflow in the OpENer EtherNet/IP stack's GetAttributeList() implementation, causing a denial of service (crash) on devices running version 2.3 or master commit 76b95cf. The flaw is reachable over the network via the EtherNet/IP service (typically TCP/UDP 44818 and UDP 2222) and requires no authentication or user interaction, as indicated by CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N with availability-only impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the issue is publicly documented in the project's GitHub issue tracker.
Unauthenticated remote denial of service in the OWASP Coraza WAF Go library (versions 3.0.0 through 3.8.0) allows any client that can deliver a JSON request or response body to crash the entire hosting process with an unrecoverable fatal stack overflow. The flaw is reachable with default configuration - the payload stays under the recommended SecRequestBodyLimit and within the default SecArgumentsLimit of 1000 - because the body processor's bounded flattening walk stops early on argument truncation and then unconditionally hands the complete raw body to gjson.Valid, which recurses once per nesting level with no depth bound and cannot be intercepted by recover(). Impact is availability only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-674); no public exploit code identified at time of analysis and no KEV listing, though the vendor advisory documents a working repro payload of roughly 13 MB.
Remote denial of service against devices running the OpENer EtherNet/IP adapter stack v2.3.0 (commit 76b95cf): an out-of-bounds read in the unconnected explicit messaging path lets a remote, unauthenticated attacker crash or destabilize the CIP stack by sending crafted unconnected explicit requests to an exposed EtherNet/IP interface. The assessed vector (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms network-reachable, unauthenticated exploitation with high availability impact and no confidentiality or integrity impact, so the outcome is a process crash/denial of service rather than data disclosure or code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical limiter is whether the device's CIP/encapsulation port (typically TCP/UDP 44818) is reachable across network segmentation.
Remote, unauthenticated attackers can crash devices running the EIPStackGroup OpENer EtherNet/IP stack (v2.3.0 and master up to commit 76b95cf) by sending a crafted Connection Manager request that triggers an out-of-bounds read during parsing. The flaw requires only network reachability to the stack's EtherNet/IP service on its default operating mode - no credentials, no special configuration, and no user interaction - and yields availability-only impact (CVSS 7.5, C:N/I:N/A:H), meaning denial of service rather than code execution or data disclosure. No public exploit identified at time of analysis, and the issue is tracked upstream as GitHub issue #577; exploitability is mainly bounded by the fact that affected devices typically sit on segmented OT/ICS networks rather than being internet-exposed.
Unauthenticated remote attackers can cause denial of service in Yopass versions prior to 14.7.0 by sending many HTTP requests with unique, arbitrary method tokens, which are used as Prometheus metric labels and cause unbounded memory growth until the process is OOM-killed. The issue is availability-only with no confidentiality or integrity impact, requires network access to a default-configured Yopass instance with the metrics middleware active, and exploitation is cumulative rather than instantaneous; no public exploit code was identified at time of analysis. The vendor fixed the cardinality issue in version 14.7.0, and the CVSS 3.1 score is 7.5 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Unauthenticated remote clients that can reach the Nginx UI node-signature authentication API on versions 2.5.0 through pre-2.6.0 can force the server to stage attacker-controlled request bodies to temporary files and flush them to disk before any digest or cryptographic signature validation occurs, allowing exhaustion of temporary filesystem capacity, disk I/O, and request-processing resources. The impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) - authentication is not bypassed and there is no confidentiality or integrity impact. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); vendor-released patch: 2.6.0, which caps staged node request bodies at 128 MiB and adds a pre-read ContentLength check.
Unauthenticated remote attackers can reach a critical function in Dell Secure Connect Gateway (SCG) Policy Manager without any authentication check, bypassing protection mechanisms to read sensitive information and gain unauthorized access; instances running versions prior to 5.34.00.16 are affected. The vulnerability carries a CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with impact limited to confidentiality and access bypass - no integrity or availability impact is indicated. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) or EPSS signal in the supplied data, so real-world risk is primarily gated by whether the management service is reachable from an untrusted network.
Denial of service in EIPStackGroup OpENer 2.3 and master up to commit 76b95cf allows unauthenticated remote attackers to crash the EtherNet/IP stack by sending a crafted Common Packet Format (CPF) message that triggers dereference of an expired pointer in the encapsulation parsing path, yielding availability loss (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H). Any device exposing the stack's default encapsulation service (TCP/UDP 44818, plus UDP 2222 for implicit messaging) is reachable without authentication or user interaction, so exploitation requires only network reachability to the control network. No public exploit code was identified at time of analysis and there is no CISA KEV entry, so the practical urgency depends more on whether the device is exposed beyond a segmented OT network than on the raw CVSS 'High' rating; impact is limited to a crash/restart of the stack, not code execution or data disclosure.
Remote denial of service affects devices running the OpENer server-side EtherNet/IP adapter stack (v2.3, up to and including commit 76b95cf), where an out-of-bounds read in the ForwardOpen connection-path parser can crash the service. The flaw is reachable over the network with no authentication, privileges, or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5 HIGH), and publicly available exploit code exists; there is no CISA KEV listing and no confirmed active exploitation, so the practical risk is driven by exposure of EtherNet/IP endpoints on reachable networks. CISA's SSVC assessment rates the issue automatable with partial technical impact, consistent with an unauthenticated crash of an embedded industrial adapter rather than a full compromise.
Unauthenticated path traversal in ZealousWeb's Generate PDF using Contact Form 7 WordPress plugin, affecting all releases through 4.2.1, lets a remote attacker read arbitrary files from the web server, an impact mirrored by the CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N - confidentiality only, no integrity or availability impact). Any WordPress site with this add-on installed, active, and reachable is exposed if its PDF generation/download endpoint accepts unauthenticated requests; the practical limiting factor is the plugin's comparatively small install base rather than any authentication or configuration barrier. At time of analysis no public exploit code has been identified and there is no CISA KEV listing, but the low-complexity, unauthenticated nature of the flaw makes it a natural candidate for automated mass scanning.
Remote unauthenticated denial of service in ageLANServer prior to 1.15.2 lets any network-reachable client crash or hang the bundled AoE3 game server by sending an oversized request to the POST /game/cloud/getFileURL endpoint. Because the handler enforces neither a request body size cap nor a bound on the attacker-controlled JSON 'names' array, and sizes response allocations directly from that array length, a single large payload drives excessive memory allocation, processes crash or stall, active players are disconnected, and the service stays down until it is restarted. The default self-registration flow is enabled out of the box, so no credentials or non-default configuration are required; impact is confined to availability, and no public exploit code or active exploitation (CISA KEV) was identified at time of analysis. The issue is fixed in version 1.15.2.
Remote, unauthenticated denial of service in RIOT OS 2023.07 through 2026.07: the nanocoap_fileserver in sys/net/application_layer/nanocoap/fileserver.c ignores the failure returned by _resp_init() when coap_build_reply() cannot fit a response header into the response buffer. On builds with the non-default nanocoap_token_ext option enabled, a client can send a CoAP request carrying a sufficiently large extended token so that response initialization fails while _get_file()/_get_directory() proceeds with stale response state, eventually hitting the _calc_szx2() assertion (pdu->payload_len > reserve) and aborting the affected service or device task. Exploitation is gated on the token-ext configuration, network reachability of the fileserver, and assertions being compiled in; there is no confidentiality or integrity impact, no public exploit identified at time of analysis, and no fixed release was available as of this review.
Denial-of-service condition in WP Rocket versions before 3.23.5 can be triggered by unauthenticated remote attackers with no user interaction, according to the assessed CVSS vector; however, the advisory and CWE-624 label also carry a 'Code Injection' claim that conflicts with the availability-only impact and remains unverified. The affected product is the WP Rocket WordPress plugin from WP Media, and the supplied intelligence does not indicate CISA KEV active exploitation; no public exploit code identified at time of analysis. Because the vector scores C:N/I:N/A:H, treat the confirmed impact as resource-exhaustion/DoS rather than data compromise or site takeover unless code-injection evidence emerges.
Authentication bypass in WPMU DEV Forminator (versions up to 1.57.2) allows unauthenticated remote attackers to spoof identity and bypass payment or other identity-dependent workflows on WordPress sites. The vulnerability requires a publicly reachable form-typically a payment-enabled or identity-verifying form-to be active. No public exploit identified at time of analysis; the primary impact is integrity, as attackers can forge trusted state but cannot read data or cause service disruption.
An integer underflow in OpENer's server-side EtherNet/IP ForwardOpen connection-path parser lets an unauthenticated remote attacker crash the affected adapter, causing a denial of service. OpENer v2.3 and commit 76b95cf are affected; exploitation requires only that the ENIP/CIP service (typically TCP 44818) be reachable, since the vector is AV:N/AC:L/PR:N/UI:N with availability-only impact (C:N/I:N/A:H). No public exploit code identified at time of analysis and no KEV listing; EPSS is low at 0.19% (8th percentile), so the practical risk is bounded by how exposed the device's ENIP port is on the network.
Attackers who control the Nginx UI upgrade mirror - or hold a man-in-the-middle position on the path to it - can get arbitrary code installed and executed by Nginx UI 2.0.0 through 2.4.x, because the self-upgrade routine verifies the downloaded binary only against a same-origin digest fetched from that same mirror, leaving no independent trust anchor. Exploitation requires two simultaneous conditions: the attacker's mirror/network position must let them alter BOTH the binary and its digest response, and an operator must manually trigger the self-upgrade, at which point the swapped payload is installed and runs in the Nginx UI process context. The issue is rated CVSS 7.5 (AV:N/AC:H/PR:N/UI:R) and is fixed in 2.5.0, which introduces minisign signature verification; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the high network-position prerequisite plus the required operator action substantially narrow realistic exploitation.
XML signature wrapping in Apache CXF's JAX-RS XML Security module allows remote, unauthenticated attackers to have unsigned content accepted as if it were covered by a trusted XML signature. Only deployments that consume inbound XML through CXF's XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor, or the streaming XmlSecInInterceptor) are exposed, and the attacker must first hold any XML document signed by a key the target trusts; that signed document can then be wrapped in forged content and repeatedly presented. Fixed versions 4.2.4, 4.1.9, and 3.6.13 address the issue; no public exploit code has been identified and EPSS is low (0.17%, 6th percentile), though integrity impact is rated High (CVSS 7.5).
Trust bypass in Apache CXF's STSTokenValidator allows a remote, unauthenticated attacker to have a forged SAML assertion signed with an untrusted certificate accepted as trusted without the assertion ever being validated by the Security Token Service. Only deployments that use STSTokenValidator to validate SAML tokens while leaving alwaysValidateToSts unset are affected, and exploitation additionally requires a race window in which the result of a concurrent legitimate request's successful trust check is read from shared state. No public exploit code or CISA KEV listing has been identified at time of analysis, EPSS is 0.17% (6th percentile), and vendor fixes are available in Apache CXF 4.2.4, 4.1.9 and 3.6.13.
A remote, unauthenticated attacker can exhaust server heap memory in Apache CXF by submitting a small (kilobyte-scale) DEFLATE payload that inflates to gigabytes when the framework decompresses it without any output-size cap. The flaw is reachable through two deployment-specific paths: JWE decryption when the 'zip=DEF' compression header is present (for example a JoseSessionTokenProvider configured with RSA-OAEP key wrap), and SAML token inflation over the HTTP redirect or POST binding - in both cases decompression occurs before or independently of any trust, signature, or key validation, so no credentials or valid keys are needed. Impact is availability only (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), with confirmed exploitation limited to reachable configurations; EPSS is 0.16% (4th percentile), no CISA KEV listing, and no public exploit identified at time of analysis. Vendor-released patches are available in 4.2.4, 4.1.9, and 3.6.13, which introduce a configurable 10 MiB inflation cap.
Out-of-bounds read in the server-side ForwardOpen connection-path parser of the OpENer EtherNet/IP stack (v2.3, commit 76b95cf) lets unauthenticated remote attackers crash the server, producing a denial-of-service condition. Affected deployments are those that expose the OpENer EtherNet/IP server on TCP/UDP 44818 or UDP 2222 to a reachable network; because these stacks typically sit on segmented OT/ICS networks, realistic exposure depends on attacker access to the industrial segment rather than on any special configuration. Impact per the assessed CVSS 3.1 vector is availability-only (A:H, C:N/I:N); EPSS is 0.14% (3rd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Unauthenticated account takeover in Vikunja 1.0.0 through 2.3.0 lets an attacker who can obtain an OpenID Connect token carrying a victim's email address log in as that victim with a full session and no victim interaction. The flaw only manifests when an administrator has enabled the non-default per-provider emailfallback option, under which Vikunja resolves an unknown (issuer, subject) pair to a pre-existing local username/password account using the email claim alone - it never inspects email_verified (or Microsoft's xms_edov) and never asks for the matched account's password. Practical exposure is narrow but real: it additionally requires an IdP that will assert a victim's unverified email (a self-service or multi-tenant issuer) and a victim local account that has no TOTP, which the 2.3.0 enforceTOTPIfRequired gate protects; there is no public exploit identified at time of analysis, and no KEV/EPSS signal has been provided, so this is a high-priority fix for the specific vulnerable configuration rather than an ongoing mass-exploitation event.
Unauthenticated remote attackers can read arbitrary files from the underlying web server by exploiting a path traversal flaw in the WordPress plugin PDF for Contact Form 7 (slug pdf-for-contact-form-7) affecting all versions through 7.1.0. Supplying crafted directory-traversal input to the plugin's PDF file-handling/download path lets an attacker escape the intended directory and retrieve files readable by the web server account, a high confidentiality impact with no integrity or availability effect (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N). No public exploit code, CISA KEV listing, or EPSS score was identified in the supplied intelligence, so exploitation has not been confirmed as active and the practical attack surface depends on the plugin being installed and activated; note that WordPress core does not ship this plugin, so exposure is limited to sites running it.
Remote unauthenticated attackers can exploit a missing authorization flaw (CWE-862) in the TMS Amelia WordPress booking plugin versions up to and including 2.4.10, allowing unauthorized modification of data on affected sites (CVSS 7.5, integrity-only impact). The vulnerability stems from an endpoint that fails to enforce proper access control, and no public exploit code has been identified at time of analysis; WordPress installations running the plugin and reachable over the network are at risk.
Payment bypass in GiveWP WordPress plugin through 4.16.8.1 allows unauthenticated remote attackers to have donations accepted without a legitimately cleared payment. This CWE-290 spoofing flaw has a CVSS score of 7.5, but impact is limited to donation/transaction integrity; it does not grant WordPress authentication, admin access, or server control. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and EPSS data is not provided.
Unauthenticated information disclosure in the Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router (firmware v1.3.241114.024540 and earlier) allows a remote attacker to retrieve sensitive data from the device with no credentials and no user interaction, consistent with the supplied CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5, confidentiality-only impact). The weakness is classified as CWE-200 exposure of sensitive information; no public exploit code was identified at time of analysis, no EPSS score was supplied, and the CVE is not listed in CISA KEV, so active exploitation is not confirmed. Practical risk is bounded by deployment exposure: only the specific B11 model and firmware range is affected, and the attacker must be able to reach the router's management/web interface (for example exposed on the WAN side or from the same LAN segment).
An out-of-bounds read in EIPStackGroup's OpENer EtherNet/IP stack (v2.3 through master commit 76b95cf) allows remote, unauthenticated attackers to crash the service by sending a Common Packet Format message whose optional socket address information item (type 0x8000 or 0x8001) is truncated. The parser routine CreateCommonPacketFormatStructure() then reads a fixed-size sockaddr structure past the end of the supplied buffer, faulting the process - this is an availability-only impact with no confidentiality or integrity effect, consistent with the assessed CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit code or active exploitation was identified at time of analysis, and practical risk is bounded by the requirement that the attacker reach the EtherNet/IP TCP service on the affected device.