Privilege escalation in MariaDB Server (10.6.1 up to 10.6.28, 10.11.x before 10.11.19, 11.4.x before 11.4.13, 11.8.x before 11.8.9, 12.3.x before 12.3.3, and 13.0.x before 13.0.2) allows an authenticated database user holding the FILE privilege to plant a /run/mysqld/wsrep-new-cluster file when secure-file-priv permits writes into that runtime directory, which the packaged mariadb.service systemd unit subsequently consumes as an EnvironmentFile. On the next administrator-triggered restart of mariadb.service, attacker-controlled environment values are injected into the mariadbd process, escalating from the database user context onto the host/systemd layer (scope change) with full confidentiality, integrity, and availability impact. The vendor rates this 8.4 while our independent assessment uses CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H, reflecting that exploitation requires a high, non-default privilege and a restart gate; no public exploit code has been identified at time of analysis, and patched releases are already available.
RPM-based MariaDB Server packages up to the fixed releases can create the mysql service account with the database data directory as its home, allowing a database user that holds the FILE privilege to write shell startup files such as .bash_profile there. Those files only execute if an administrator later opens an interactive login shell as the mysql account, overriding its usual /sbin/nologin shell, so real-world exploitation requires both a highly privileged database account and a non-default administrator action. No public exploit has been identified at the time of analysis, Debian/Ubuntu packages are not affected because they already use /nonexistent as the account home, and the CVSS base score of 8.4 overstates the realistic likelihood given the required preconditions.
Improper access control in the SendPress Newsletters WordPress plugin (through 1.26.1.20) lets any authenticated subscriber-level user synchronise the entire site user base into a mailing list and drive the newsletter send queue, because several newsletter-management actions omit capability checks. It is scored CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the bar is only a low-privilege account - realistic where the site permits self-registration or the attacker otherwise holds a subscriber credential - and publicly available exploit code exists. EPSS is 0.13% (2nd percentile), indicating low observed exploitation likelihood at time of analysis; no CISA KEV entry is associated with this CVE.
Missing CSRF protection in the GDPR Data Request Form WordPress plugin through 1.7.1 allows a remote attacker to change one plugin setting if they can trick a logged-in administrator into clicking a crafted link. Publicly available exploit code exists, but exploitation is targeted and requires an authenticated admin session plus user interaction, with impact limited to integrity of that single setting and no confidentiality or availability effect. This matches the assessed low-to-moderate real-world risk despite the CVSS 4.3 score.
Keystream reuse in the native one-shot CTR packet cipher of Bouncy Castle for Java LTS before 2.73.13 allows remote attackers to recover plaintext from ciphertext alone, without knowledge of the key. Exploitation is unauthenticated but conditional: the application must use the native one-shot CTR path with a 13-, 14-, or 15-byte IV, leaving only a 1-, 2-, or 3-byte block counter (256, 65,536, or 16,777,216 blocks), and must pass a single input longer than that counter space so the counter wraps and the keystream restarts within the packet. The call returns the full input length with no exception, so the caller receives no signal that some bytes were transformed under a repeated keystream; the resulting two-time-pad condition permits plaintext recovery. No public exploit code has been identified at time of analysis, and the non-default short-IV native deployment requirement keeps realistic exposure narrow, which is why this is assessed as AC:H rather than trivially exploitable.
Memory-exhaustion denial of service in the elixir-protobuf library (protobuf) from 0.8.0 onward allows an unauthenticated remote attacker to crash an Elixir decoding process by supplying a deeply nested JSON document through Protobuf.JSON.decode/3, decode!/3, or from_decoded/3 when the target schema contains a self-referential or cyclic message type. Because the embedded-message clause of decode_singular/3 recurses once per nesting level without touching the decoder's depth counter, the recursion_limit option offers no protection and each level consumes a stack frame plus heap objects until the process runs out of memory; confidentiality and integrity are unaffected, only availability. Exploitation is unauthenticated and requires no user interaction, but is limited to applications that decode untrusted JSON into recursive message definitions, and no public exploit code has been identified at time of analysis (EPSS data not provided).
Malformed 6LoWPAN fragments can drive an out-of-bounds read in the GNRC network stack of RIOT OS 2026.07 and earlier, crashing the stack and potentially exposing adjacent memory. The flaw sits in _receive() in sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c, which forwards an undersized packet into SFF fragment handling after only a minimal payload check, so gnrc_sixlowpan_frag_recv() then interprets bytes as a sixlowpan_frag_t (or larger fragment header) that the packet snip does not actually contain. Exploitation requires no authentication or user interaction (PR:N/UI:N) and, per this assessment, is bounded by delivery: because 6LoWPAN rides on IEEE 802.15.4, the attacker must be within radio range of the node or able to inject fragments into its mesh (AV:A, assessed vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H; the reporter's AV:N/8.2 rating assumes arbitrary remote reachability that is not generally available unless a border router forwards attacker-controlled fragments inward). Availability is the dominant impact (A:H - crash of the GRNC network stack), with limited secondary memory disclosure (C:L); no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Google Guava 4.0 through 33.7.1 can be triggered by remote unauthenticated attackers who can supply crafted Java serialization streams containing CompactHashMap, CompactHashSet, or MapMakerInternalMap objects, causing Guava to allocate an attacker-controlled backing array without throttling and exhaust memory with OutOfMemoryError. This is a genuine but conditional availability-only risk: exploitation requires the target application to perform Java native deserialization (ObjectInputStream.readObject) on attacker-influenced input, and any authentication or authorization in front of the deserializing endpoint further limits reach; no code execution or data disclosure results. A vendor fix is available in Guava 33.7.2, and no public exploit identified at time of analysis.
Code injection in @tinacms/cli versions up to and including 2.7.0 lets a crafted Git branch name break out of the string literal used for the generated client's API URL and execute arbitrary JavaScript when that generated client module is imported during a preview or CI build. The flaw, rated CVSS 8.2 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N), requires the build to actually run codegen and import the generated client, and requires an attacker able to influence the branch value read from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, so exploitation is gated by meaningful preconditions rather than being trivially remote. Injected code runs with build-process privileges, allowing theft of environment credentials, tampering with deployment artifacts, and outbound network requests; no public exploit tooling identified at time of analysis, though the vendor advisory documents a working proof-of-concept branch-name payload, and there is no evidence of active exploitation (no CISA KEV listing) or EPSS data provided.
Information disclosure in NetApp Trident v25.02.1 through v26.06.1 allows an authenticated local attacker with read access to debug logs to obtain LUKS passphrases or SMB Active Directory credentials. The vulnerability only manifests when debug logging is enabled and the affected features (LUKS-encrypted volumes and/or SMB shares joined to AD) are in use, requiring a low-privilege foothold on the host. No public exploit or active exploitation has been identified, and the attack is configuration-gated, making the real-world risk non-urgent despite a CVSS score of 8.2.
Authentication bypass in Hayat Mobile 3.3.x (from 3.3.0 up to but excluding 3.4.0) lets remote, unauthenticated attackers defeat the application's login/trust checks because those decisions are made on the client side, giving access to data that should require a valid session. The vendor/Turkish CERT rates it CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), so no credentials or victim interaction are stated as prerequisites, with high confidentiality impact but only low integrity impact and no availability impact. There is no CISA KEV listing and no public exploit identified at time of analysis; the exposure is bounded by the fact that Hayat Mobile is a single healthcare provider's app, and upgrading to 3.4.0 removes the bypass.
Reachable assertion in Open5GS through 2.8.0 allows remote unauthenticated attackers to crash the MME (open5gs-mmed), causing denial of service for all subscribers. Exploitation requires that the malicious GTPv1-C packet originate from or spoof a configured SGSN address and that the attacker know a valid UE IMSI or P-TMSI, conditions that limit the attack to scenarios where trust relationships and subscriber identifiers are known. No public exploit identified at time of analysis; vendor patch available (commit 346ce7a).
Account takeover in Nginx UI versions 2.0.0 through 2.4.x affects accounts configured with a passkey as their only second factor: the POST /api/login handler checks EnabledOTP but never requires a WebAuthn assertion when EnabledPasskey is true and no TOTP secret exists, so a valid password alone yields a fully authenticated session despite the account reporting a second factor. An attacker who already holds the account password can reach administrative Nginx UI functionality without possessing the registered passkey; accounts protected by TOTP, and accounts with no 2FA configured, are unaffected. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the CVSS 3.1 score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the AC:H metric reflecting the hard password precondition rather than any exploit complexity.
Authenticated users of Nginx UI 2.0.0 through 2.4.x who hold permission to create and restore backups can persistently inject modified Nginx configuration or Nginx UI configuration files by crafting a backup archive that carries a symlink pointing at the live configuration path, achieving this even when the restore_nginx and restore_nginx_ui flags are both false. The flaw (CWE-59, link following) stems from the restore path extracting inner archives and materializing symlinks before the restore flags are enforced, so a regular file subsequently written through the staged link lands in the live configuration tree; the resulting tampering takes effect only when those files are later consumed by Nginx, and can produce denial of service. Rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), this requires a valid backup-capable login (PR:L) and is not a remote-unauthenticated attack, and no public exploit code was identified at time of analysis; vendor-released patch: 2.5.0 fully remediates the issue.
Privilege escalation in Vikunja 2.3.0 allows a user who holds a narrowly scoped API token (permissions {"oauth":["authorize"]}) to exchange that token for unrestricted session credentials, defeating the API-token permission boundary. The token holder calls POST /api/v1/oauth/authorize to obtain an OAuth authorization code and then POST /api/v1/oauth/token to trade it for a normal bearer JWT and refresh token that are not bound to the original token's scope - runtime validation showed the scoped token could not read GET /api/v1/user, while the minted token could reach both /api/v1/user and /api/v1/projects. The vulnerability requires an already-issued scoped token from the same user (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, CWE-269), no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV). Version 2.4.0 fixes the issue.
Plaintext storage of password-reset, email-confirmation and account-deletion tokens in Vikunja prior to 2.4.0 allows anyone who already holds read access to the backend database to redeem a pending token and take over the associated account, including administrator accounts, without knowing any password. The vulnerability is a CWE-312 cleartext-storage flaw rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), where the high attack complexity reflects two preconditions rather than any weakness in the exploit itself: the attacker must independently obtain database read access (leaked or misconfigured backups, exposed storage, or a secondary SQL-level exposure), and the victim account must have an unexpired token within its 24-hour lifetime. The vendor advisory publishes proof-of-concept code illustrating the attack (a SQL query harvesting tokens plus a password-reset redemption request); no KEV listing was provided in the available intelligence, so there is no confirmation of active exploitation, and the CVSS vector's PR:N confirms the token-redemption step itself requires no Vikunja application credentials or user interaction.
Protection mechanism bypass in Dell Secure Connect Gateway (SCG) Policy Manager (versions below the vendor-fixed release) lets a remote, low-privileged attacker who already holds valid credentials on the appliance defeat intended authorization controls via a 'failing open' error-handling flaw (CWE-636). Successful exploitation yields high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with no availability impact. EPSS is low at 0.20% (9th percentile), CISA SSVC records no observed exploitation, and no public exploit identified at time of analysis, so priority is elevated-but-not-emergency, driven mainly by exposure of the management interface and the presence of low-privileged accounts.
Server-side request forgery in the Kirki WordPress plugin before 6.3.2 allows authenticated users holding editor-level privileges or above to supply a URL that the WordPress server then fetches without validating the target host, letting them probe internal-only services and infer from the responses which of those hosts are live. The issue is rated CVSS 4.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N), so impact is confined to information disclosure with no write, code execution, or denial-of-service capability, and exploitation requires a trusted privileged account rather than anonymous access. Publicly available exploit code exists and WPScan is credited as the reporting source, but there is no CISA KEV confirmation of active exploitation; combined with the high privilege prerequisite, the signals converge on a modest, non-urgent priority appropriate for routine patching alongside other plugin updates.
SessionManager rate-limit bypass in Argo CD v3.0.6 allows unauthenticated remote attackers to issue repeated concurrent crafted login requests and win a race-condition timing window, circumventing the login throttling intended to slow brute-force attempts. The CVSS 3.1 score is 8.1 with High confidentiality, integrity, and availability impact, but High attack complexity reflects the need to reliably win the timing race; follow-on account compromise is further limited by strong credentials, SSO/external identity providers, or secondary lockout controls. EPSS is low at 0.15% (4th percentile), and no public exploit was identified at time of analysis.
Local file inclusion in the Fuelthemes The Voux WordPress theme through version 6.9.5 lets unauthenticated remote attackers induce the server to include attacker-influenced local files - with possible escalation to PHP code execution if parseable content can be placed or referenced on the host - by reaching an undisclosed include/require code path (CVSS 3.1: 8.1, AV:N/AC:H/PR:N/UI:N). The high attack-complexity value indicates exploitation is not trivial and depends on a condition the Patchstack advisory does not disclose (likely a specific request parameter feeding a theme include/require call, or a particular theme function or page being active). No public exploit code and no confirmed active exploitation were identified at time of analysis, so this should be treated as a genuine but second-tier priority for sites running The Voux 6.9.5 or earlier.
Local file inclusion in the Fuelthemes Werkstatt WordPress theme (all versions through 4.8.3) allows unauthenticated remote attackers to route unsanitized input into a PHP include/require statement, exposing server-side files such as wp-config.php and potentially escalating to code execution if an attacker-controlled file can be placed on the target. The issue is rated CVSS 8.1 (High) under CWE-98; no public exploit code and no confirmed active exploitation were identified at time of analysis. Attack complexity is High (AC:H) because meaningful impact depends on server configuration and on an attacker-controllable includable path, and sites not running Werkstatt or already updated past 4.8.3 are not affected.
Out-of-bounds reads and writes in MariaDB Server's binary FRM (table-definition) parser allow an attacker who can drop a crafted .frm file into the server's data directory and then cause that table to be opened to crash mysqld or potentially execute code in the server process. Affected releases are MariaDB Server from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The published CVSS of 8.0 is driven by high confidentiality, integrity and availability impact once the parser is reached, but the independent assessment rates the practical path as local (AV:L/AC:L) with high privileges required (PR:H), since file placement in the data directory is a host/local operation rather than a remote unauthenticated one; no public exploit identified at time of analysis.
Memory corruption in the Linux kernel's LWT_SEG6LOCAL BPF path can be triggered by a local privileged user who can load and attach a BPF program to an IPv6 segment-routing route; the unsafe sequence invalidates the cached SRH and then reallocates skb->head, leaving a dangling pointer that is later written through. Only systems using the non-default SEG6 LWT feature with attached BPF programs are affected, and the attacker must hold CAP_NET_ADMIN/CAP_BPF, so exposure is bounded. No public exploit identified at time of analysis, and EPSS is low at 0.16% (5th percentile), though vendor patches are available.
Use-after-free in the Linux kernel veth driver can leave stale XDP program pointers on removed RX queues, so a later channel increase may run a freed BPF program and crash or corrupt kernel memory. The flaw is locally reachable (CVSS 7.8, AV:L/PR:L) by an authenticated attacker able to resize veth channels and attach or detach XDP programs, typically requiring CAP_NET_ADMIN unless unprivileged user namespaces grant it. No public exploit was identified at time of analysis, EPSS is low at 0.16% (5th percentile), and vendor patches are available.
A use-after-free in the Linux kernel BPF link iterator lets a local user who can already use the BPF subsystem (CAP_BPF or CAP_SYS_ADMIN) corrupt freed slab memory and potentially escalate privileges or crash the system. The flaw is a race: bpf_link_prime() inserts a link into link_idr before anon_inode_getfile() succeeds and before bpf_link_settle() publishes the link ID, and while bpf_link_by_id() rejects such ID-zero links as unsettled, the link iterator takes a reference to them anyway - if anon_inode_getfile() then fails, the creator frees the still-private link and the iterator is left holding a dangling reference that the next bpf_link_put() writes through. Exploitation is local-only and depends on winning a narrow race window combined with the file-allocation failure path, which is why the assessed severity uses AC:H rather than the raw 7.8; EPSS is 0.16% (5th percentile), there is no CISA KEV entry and no public exploit identified at time of analysis, and vendor patches are available for the affected stable branches.
Driver-specialized BPF metadata kfuncs can be executed against the wrong driver's XDP buffer in the Linux kernel's BPF offload matching logic, producing an out-of-bounds read and a kernel panic (observed as a KASAN null-ptr-deref in veth_xdp_rx_timestamp when a veth-bound program is run on a tun device). The flaw requires local access with both CAP_BPF and CAP_NET_ADMIN, plus an offload/dev-bound BPF program configuration, so exposure is concentrated on hosts that delegate these capabilities to containers or namespaces; the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8). No public exploit code was identified at time of analysis and the issue is not in CISA KEV, with EPSS at 0.16% (4th percentile); vendor patches are available in the stable branches listed in the advisories.
Out-of-bounds memory access in the Linux kernel BPF subsystem affects kernels built from Linux 6.10 onward (from commit db69718b8efac802c7cc20d5a6c7dfc913f99c43) where a percpu array is used as an inner map in a map-in-map arrangement. A local attacker who can load eBPF programs and create BPF maps (typically requiring CAP_BPF/CAP_SYS_ADMIN or a configuration permitting such map operations) can replace the template inner map with a differently sized percpu array; because percpu_array_map_ops.map_meta_equal points at the generic bpf_map_meta_equal(), which does not compare max_entries, the replacement is accepted and percpu_array_map_gen_lookup() then performs a lookup using the original template's index_mask baked in as a JIT immediate, indexing pptrs[] out of bounds. No CISA KEV listing and no public exploit code were identified at time of analysis, and EPSS is very low at 0.15% (3rd percentile), consistent with a genuine but non-urgent local privilege issue rather than a mass-exploitation threat.
Arbitrary code execution in Aegisub 3.2.0 through 3.4.2 occurs when a victim opens a crafted .ass subtitle project whose 'Automation Scripts' metadata references an attacker-supplied Lua Automation script, which Aegisub auto-loads without prompting the user to trust the script or its author and runs with the privileges of the Aegisub process. Versions 3.4.0 through 3.4.2 add a single-file attack path in which inconsistent handling of embedded NUL characters between extension validation and filesystem operations lets a crafted ASS/Lua polyglot reference and execute itself, removing the need to deliver a separate script file. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), making it a local, user-interaction-driven issue that does not affect any network service; there is no public exploit identified at time of analysis, so real-world urgency is moderate rather than critical, and Aegisub 3.5.0 fixes the vulnerability.
Local privilege escalation in Zephyr RTOS allows an unprivileged user-mode thread, in builds that enable both CONFIG_USERSPACE and CONFIG_DEVICE_DEINIT_SUPPORT, to pass a user-writable kernel object - most practically a thread stack from k_thread_stack_alloc() or a granted static K_THREAD_STACK - to the device_deinit() syscall and achieve supervisor-mode code execution. The flaw is a type-confusion issue in z_vrfy_device_deinit(): validation with K_OBJ_ANY skips the object type comparison, so z_impl_device_deinit() treats attacker-written bytes as a struct device and follows attacker-controlled state and ops.deinit pointers. The upstream fix is available via commit 1036694889ab33996db41b4141ddf66aa786d267, no public exploit code was identified at time of analysis, and impact is gated by the required build configuration; v4.2.x and v4.3.x defaulted the vulnerable option to y, while v4.4.x is exposed only if explicitly enabled.
Information disclosure in Backdrop CMS 1.34.x before 1.34.5 and 1.35.x before 1.35.1 allows remote unauthenticated attackers to retrieve a previously generated compressed configuration export archive because the archive is not sufficiently protected during delivery. Exploitation is contingent on a configuration export having been previously requested by a user with the 'Synchronize, import, and export configuration' permission, which is the vendor-stated mitigating factor and the reason the assessed attack complexity is high. No public exploit code has been identified at the time of analysis, and the issue is fixed in Backdrop CMS 1.34.5 and 1.35.1.
Stored cross-site scripting and potential remote code execution in HortusFox (hortusfox-web) through version 6.3 allow authenticated users to upload files with client-supplied extensions via the plant attachment feature, which are stored under the web-accessible public/attachments/ directory. Uploaded HTML or SVG files lead to stored XSS when a victim opens them, while uploaded PHP files can execute code on servers where .htaccess restrictions are unenforced, though this RCE path requires a non-default misconfiguration. No public exploit code has been identified at time of analysis, although a public technical write-up demonstrating the stored XSS is referenced. The CVSS 4.0 base score is 7.7 (High), and an independent CVSS 3.1 assessment rates it High with C:H/I:H/A:H.
Type confusion in FalkorDB versions before 4.20.0 allows an authenticated client that can issue GRAPH.QUERY to crash the server and, depending on heap layout, potentially disclose or corrupt memory. The flaw lives in the _read_flags handler in src/commands/cmd_dispatcher.c, which accepts a --bolt argument from any client and blindly casts the following Redis string object to a bolt_client_t structure without verifying its origin, so result-set code later dereferences attacker-influenced pointers; the argument is parsed even when the Bolt endpoint is disabled, meaning default installations are exposed. Exploitation requires valid credentials with query-execution rights, and because of the high attack complexity (AC:H) a denial-of-service crash is the most reliable outcome, with memory disclosure or corruption being layout-dependent and not guaranteed; no public exploit code has been identified at time of analysis and the vendor has released a fixed version. This is assessed as a moderate-priority issue rather than an emergency.
Remote code execution in AstronRPA through 1.1.6 is possible when the desktop client's smart-component chat processes attacker-controlled content and renders unsanitized LLM output through v-html, allowing HTML event handlers to call an unrestricted open-path IPC handler with shell metacharacters and run OS commands as the desktop user. The issue is remote and unauthenticated per the CVSS 4.0 vector (PR:N), but practical exploitation requires user interaction (UI:P), depends on reliably coercing non-deterministic LLM output (AC:H/AT:P), and is limited to the logged-in user's privileges. The CVSS 4.0 base score is 7.7 (High) with VC:H/VI:H/VA:H; no public exploit or CISA KEV active exploitation is identified in the provided data.
Remote code execution on the AstronRPA desktop client through version 1.1.6 is achievable by an on-path attacker who intercepts the client's plaintext HTTP auto-update check and serves a malicious update manifest with an unsigned NSIS installer, which electron-updater installs without verifying a publisher signature. The weakness is CWE-494 (download of code without integrity check), rated 7.7 under CVSS 4.0 with High attack complexity and attack requirements Present because the attacker must already hold a man-in-the-middle position and the client must run an update check; there is no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, so this is a conditional, non-scalable threat rather than a mass-exploitation emergency.
Arbitrary constructor code execution in Grid Protection Alliance openPDC and openHistorian is reachable by an authenticated user who is also able to place a file on the host filesystem, because the component-loading routine instantiates any type name it is given without validating that the type is a legitimate component (CWE-470, unsafe reflection). Successful abuse executes attacker-supplied constructor code with the privileges of the affected service account, giving high confidentiality, integrity and availability impact on the affected instance. Exploitation is conditional rather than trivial - CVSS 4.0 scores it 7.7 with attack requirements present (AT:P) and low privileges required (PR:L), an independent assessment agrees on AV:N/AC:H/PR:L with high C/I/A impact, and no public exploit was identified at time of analysis (no CISA KEV listing, no PoC reported).
Stored cross-site scripting in TinaCMS's @tinacms/web-components package (all versions up to and including 0.2.0) lets an authenticated content author save a rich-text link whose URL uses a script-capable scheme such as javascript:, which the tina-markdown element then writes straight into an anchor href; a visitor who clicks the rendered link executes attacker-controlled script in the site's origin. Because the payload persists in CMS content and runs in the victim's origin, an editor or administrator who clicks it can expose TinaCMS admin credentials held on that site (CVSS 7.6, AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, CWE-79). Key prerequisites are an author-level account, a deployment that renders content via the web-components renderer rather than the sanitizing React, static, or Astro renderers, and a victim click; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Remote unauthenticated attackers can trigger a buffer overflow in the OpENer EtherNet/IP stack's GetAttributeList() implementation, causing a denial of service (crash) on devices running version 2.3 or master commit 76b95cf. The flaw is reachable over the network via the EtherNet/IP service (typically TCP/UDP 44818 and UDP 2222) and requires no authentication or user interaction, as indicated by CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N with availability-only impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the issue is publicly documented in the project's GitHub issue tracker.
Unauthenticated remote denial of service in the OWASP Coraza WAF Go library (versions 3.0.0 through 3.8.0) allows any client that can deliver a JSON request or response body to crash the entire hosting process with an unrecoverable fatal stack overflow. The flaw is reachable with default configuration - the payload stays under the recommended SecRequestBodyLimit and within the default SecArgumentsLimit of 1000 - because the body processor's bounded flattening walk stops early on argument truncation and then unconditionally hands the complete raw body to gjson.Valid, which recurses once per nesting level with no depth bound and cannot be intercepted by recover(). Impact is availability only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-674); no public exploit code identified at time of analysis and no KEV listing, though the vendor advisory documents a working repro payload of roughly 13 MB.
Remote denial of service against devices running the OpENer EtherNet/IP adapter stack v2.3.0 (commit 76b95cf): an out-of-bounds read in the unconnected explicit messaging path lets a remote, unauthenticated attacker crash or destabilize the CIP stack by sending crafted unconnected explicit requests to an exposed EtherNet/IP interface. The assessed vector (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms network-reachable, unauthenticated exploitation with high availability impact and no confidentiality or integrity impact, so the outcome is a process crash/denial of service rather than data disclosure or code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical limiter is whether the device's CIP/encapsulation port (typically TCP/UDP 44818) is reachable across network segmentation.
Remote, unauthenticated attackers can crash devices running the EIPStackGroup OpENer EtherNet/IP stack (v2.3.0 and master up to commit 76b95cf) by sending a crafted Connection Manager request that triggers an out-of-bounds read during parsing. The flaw requires only network reachability to the stack's EtherNet/IP service on its default operating mode - no credentials, no special configuration, and no user interaction - and yields availability-only impact (CVSS 7.5, C:N/I:N/A:H), meaning denial of service rather than code execution or data disclosure. No public exploit identified at time of analysis, and the issue is tracked upstream as GitHub issue #577; exploitability is mainly bounded by the fact that affected devices typically sit on segmented OT/ICS networks rather than being internet-exposed.
Unauthenticated remote attackers can cause denial of service in Yopass versions prior to 14.7.0 by sending many HTTP requests with unique, arbitrary method tokens, which are used as Prometheus metric labels and cause unbounded memory growth until the process is OOM-killed. The issue is availability-only with no confidentiality or integrity impact, requires network access to a default-configured Yopass instance with the metrics middleware active, and exploitation is cumulative rather than instantaneous; no public exploit code was identified at time of analysis. The vendor fixed the cardinality issue in version 14.7.0, and the CVSS 3.1 score is 7.5 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Unauthenticated remote clients that can reach the Nginx UI node-signature authentication API on versions 2.5.0 through pre-2.6.0 can force the server to stage attacker-controlled request bodies to temporary files and flush them to disk before any digest or cryptographic signature validation occurs, allowing exhaustion of temporary filesystem capacity, disk I/O, and request-processing resources. The impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) - authentication is not bypassed and there is no confidentiality or integrity impact. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); vendor-released patch: 2.6.0, which caps staged node request bodies at 128 MiB and adds a pre-read ContentLength check.
Unauthenticated remote attackers can reach a critical function in Dell Secure Connect Gateway (SCG) Policy Manager without any authentication check, bypassing protection mechanisms to read sensitive information and gain unauthorized access; instances running versions prior to 5.34.00.16 are affected. The vulnerability carries a CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with impact limited to confidentiality and access bypass - no integrity or availability impact is indicated. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) or EPSS signal in the supplied data, so real-world risk is primarily gated by whether the management service is reachable from an untrusted network.
Denial of service in EIPStackGroup OpENer 2.3 and master up to commit 76b95cf allows unauthenticated remote attackers to crash the EtherNet/IP stack by sending a crafted Common Packet Format (CPF) message that triggers dereference of an expired pointer in the encapsulation parsing path, yielding availability loss (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H). Any device exposing the stack's default encapsulation service (TCP/UDP 44818, plus UDP 2222 for implicit messaging) is reachable without authentication or user interaction, so exploitation requires only network reachability to the control network. No public exploit code was identified at time of analysis and there is no CISA KEV entry, so the practical urgency depends more on whether the device is exposed beyond a segmented OT network than on the raw CVSS 'High' rating; impact is limited to a crash/restart of the stack, not code execution or data disclosure.
Remote denial of service affects devices running the OpENer server-side EtherNet/IP adapter stack (v2.3, up to and including commit 76b95cf), where an out-of-bounds read in the ForwardOpen connection-path parser can crash the service. The flaw is reachable over the network with no authentication, privileges, or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5 HIGH), and publicly available exploit code exists; there is no CISA KEV listing and no confirmed active exploitation, so the practical risk is driven by exposure of EtherNet/IP endpoints on reachable networks. CISA's SSVC assessment rates the issue automatable with partial technical impact, consistent with an unauthenticated crash of an embedded industrial adapter rather than a full compromise.
Unauthenticated path traversal in ZealousWeb's Generate PDF using Contact Form 7 WordPress plugin, affecting all releases through 4.2.1, lets a remote attacker read arbitrary files from the web server, an impact mirrored by the CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N - confidentiality only, no integrity or availability impact). Any WordPress site with this add-on installed, active, and reachable is exposed if its PDF generation/download endpoint accepts unauthenticated requests; the practical limiting factor is the plugin's comparatively small install base rather than any authentication or configuration barrier. At time of analysis no public exploit code has been identified and there is no CISA KEV listing, but the low-complexity, unauthenticated nature of the flaw makes it a natural candidate for automated mass scanning.
Remote unauthenticated denial of service in ageLANServer prior to 1.15.2 lets any network-reachable client crash or hang the bundled AoE3 game server by sending an oversized request to the POST /game/cloud/getFileURL endpoint. Because the handler enforces neither a request body size cap nor a bound on the attacker-controlled JSON 'names' array, and sizes response allocations directly from that array length, a single large payload drives excessive memory allocation, processes crash or stall, active players are disconnected, and the service stays down until it is restarted. The default self-registration flow is enabled out of the box, so no credentials or non-default configuration are required; impact is confined to availability, and no public exploit code or active exploitation (CISA KEV) was identified at time of analysis. The issue is fixed in version 1.15.2.
Remote, unauthenticated denial of service in RIOT OS 2023.07 through 2026.07: the nanocoap_fileserver in sys/net/application_layer/nanocoap/fileserver.c ignores the failure returned by _resp_init() when coap_build_reply() cannot fit a response header into the response buffer. On builds with the non-default nanocoap_token_ext option enabled, a client can send a CoAP request carrying a sufficiently large extended token so that response initialization fails while _get_file()/_get_directory() proceeds with stale response state, eventually hitting the _calc_szx2() assertion (pdu->payload_len > reserve) and aborting the affected service or device task. Exploitation is gated on the token-ext configuration, network reachability of the fileserver, and assertions being compiled in; there is no confidentiality or integrity impact, no public exploit identified at time of analysis, and no fixed release was available as of this review.
Denial-of-service condition in WP Rocket versions before 3.23.5 can be triggered by unauthenticated remote attackers with no user interaction, according to the assessed CVSS vector; however, the advisory and CWE-624 label also carry a 'Code Injection' claim that conflicts with the availability-only impact and remains unverified. The affected product is the WP Rocket WordPress plugin from WP Media, and the supplied intelligence does not indicate CISA KEV active exploitation; no public exploit code identified at time of analysis. Because the vector scores C:N/I:N/A:H, treat the confirmed impact as resource-exhaustion/DoS rather than data compromise or site takeover unless code-injection evidence emerges.
Authentication bypass in WPMU DEV Forminator (versions up to 1.57.2) allows unauthenticated remote attackers to spoof identity and bypass payment or other identity-dependent workflows on WordPress sites. The vulnerability requires a publicly reachable form-typically a payment-enabled or identity-verifying form-to be active. No public exploit identified at time of analysis; the primary impact is integrity, as attackers can forge trusted state but cannot read data or cause service disruption.