Reflected cross-site scripting (XSS) in the AcyMailing SMTP Newsletter WordPress plugin, versions through 11.1.0, allows unauthenticated remote attackers to inject malicious script into a generated web page that executes in a victim's browser when they are tricked into following a crafted link (CVSS 7.1, PR:N, UI:R). Because the payload is reflected and not stored server-side, exploitation hinges on luring a user - ideally an authenticated WordPress administrator - into triggering the request; no public exploit code or confirmed active exploitation has been identified at time of analysis. This is a moderate-severity flaw (CWE-79) reported by Patchstack, with the specific vulnerable parameter or feature not named in the available description.
Reflected cross-site scripting in the ThemeGoods Grand Restaurant WordPress theme (all versions before 7.0.11) lets an unauthenticated remote attacker craft a URL that, once a victim clicks it, executes attacker-supplied script in the context of the victim's WordPress site session. The vulnerability is rated CVSS 7.1 via vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, with scope change (S:C) reflecting that the injected code runs in the victim's browser rather than affecting only the vulnerable component, and exploitation depends on social engineering because user interaction is required; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Only sites running this specific commercial theme below version 7.0.11 are exposed, which constrains the risk to targeted rather than automated mass attacks.
Reflected cross-site scripting in the WordPress plugin Kubio AI Page Builder (Extend Themes) affects every release through 2.9.3 and lets a remote, unauthenticated attacker craft a URL that causes the plugin's request-handling endpoint to echo attacker-supplied input back into the generated page without proper neutralization; the payload then executes in the browser of any user who is lured into opening that link, with the scope-change flag indicating the injected script can reach beyond the plugin's own security context (for example, an authenticated WordPress administrator's session). Exploitation requires victim interaction (UI:R) - a targeted user must click the crafted link, and the impact is most meaningful against logged-in or privileged users - while no privileges are needed on the attacker side (PR:N) and complexity is low (AC:L), giving an assessed CVSS 3.1 base score of 7.1 (High). At the time of analysis no public exploit code and no confirmed active exploitation were identified, and no EPSS data was supplied; sites running a release later than 2.9.3 are not affected.
Reflected cross-site scripting in the Basix NEX-Forms WordPress plugin (through version 9.3.1) allows remote attackers to inject script into a page that executes in a victim's browser when that victim opens a crafted link, with user interaction required per the CVSS vector (UI:R) and no authentication required to trigger the flaw (PR:N). Successful exploitation can lead to theft of session cookies or authentication tokens and, because the vulnerable component scores S:C, the resulting script runs in the security context of the affected WordPress site - making a lured privileged administrator a particularly valuable target. The consequences are limited in scope: the payload is not stored and only affects users who follow the attacker's specific link, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Reflected cross-site scripting in the 'Simple Payment' WordPress plugin (yalla ya!, versions through 2.5.4) lets an unauthenticated remote attacker inject script into a page generated by the plugin, which then executes in the browser of any user who clicks an attacker-crafted link while the plugin is active. Because the payload is reflected rather than stored, every victim must be individually social-engineered into following a malicious URL, and the resulting impact is limited to what is accessible within that victim's browser session (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code was identified at time of analysis and the flaw has not been reported as confirmed actively exploited (CISA KEV), so the practical near-term risk is opportunistic rather than mass-exploitation driven.
Reflected cross-site scripting in the Salon Booking System WordPress plugin (all versions through 10.31.5) lets remote, unauthenticated attackers inject and execute arbitrary script by luring a victim to a crafted URL or request. Exploitation requires the victim to load the malicious request (UI:R), so it cannot be triggered silently or server-to-server; the resulting script runs in the victim's browser session and can enable cookie/session theft, credential phishing, or actions performed as the victim. Patchstack rates it CVSS 7.1 (High), while the independent assessment lands at CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N because the impact is browser-scoped rather than server-scoped; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Reflected cross-site scripting (CWE-79) in the BlockStrap Page Builder 'Bootstrap Blocks' plugin for WordPress lets an unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) inject script into a page response by persuading a victim to click a crafted link or load an attacker-controlled request against a vulnerable plugin endpoint. All plugin versions up to and including 0.1.58 are affected; the malicious payload executes in the victim's browser within the victim site's origin, enabling session/token theft, forced actions, or content manipulation on the affected site. Exploitation requires user interaction, so there is no automatic or wormable propagation, and no public exploit code or confirmed active exploitation was identified at time of analysis; the risk is concentrated in sites that run the outdated plugin with untrusted visitors.
Reflected cross-site scripting (XSS) in the UpSolution Core (us-core) WordPress plugin through version 8.44 allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's browser session when they click a crafted link, enabling session theft or page defacement. Exploitation requires the plugin to be active and the victim to interact with the malicious URL (UI:R); no public exploit code is identified at time of analysis. The independent assessment rates this as medium severity (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with no availability impact.
Reflected cross-site scripting (CWE-79) in the Welcart e-Commerce WordPress plugin (usc-e-shop) affects all versions up to and including 2.12.3, allowing a remote unauthenticated attacker to inject script that executes in a victim's browser session. Exploitation depends on user interaction (UI:R): an attacker must lure a user - realistically a logged-in WordPress administrator or shop operator - into clicking a crafted link or visiting a page that reflects the malicious parameter, at which point the injected script can act with that user's privileges and, per the CVSS scope change (S:C), potentially affect resources beyond the vulnerable component. The vulnerability carries a CVSS 3.1 base score of 7.1; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patched version was confirmed from the available data.
Reflected cross-site scripting in the codepeople 'Search in Place' WordPress plugin, versions up to and including 1.5.5, lets remote attackers supply input through the plugin's search handling that is echoed back into the generated page without proper neutralization. Because the assessed vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, no attacker authentication is needed, but the payload only executes when a victim follows a crafted link or visits a malicious page; targeting a logged-in administrator maximizes impact since the script runs in the site's origin. No public exploit identified at time of analysis, and the issue is not reported as confirmed actively exploited (CISA KEV); exploitation is limited by the user-interaction requirement.
Reflected cross-site scripting in the VikBooking Hotel Booking Engine & PMS WordPress plugin (all versions through 1.8.14) allows a remote attacker to inject script into a page rendered by the target site, which then executes in the browser of any user who follows a crafted link. According to the independent assessment, exploitation is gated by user interaction (CVSS UI:R, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), meaning the attacker must deliver the link to a victim and have it loaded in that victim's browser - impact is greatest when the victim is a logged-in administrator, whose session could be abused under the changed-scope condition. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied; the reporter (Patchstack) rates the issue 7.1.
Zephyr RTOS running on ARM64 with CONFIG_USERSPACE can lose memory-domain isolation: after an application creates more than 255 memory domains over its lifetime, the bare round-robin ASID allocator in arch_mem_domain_init() wraps and hands the same non-global ASID to two live domains, allowing a user-mode thread in one domain to read and write memory belonging to another domain's partitions and thread stacks using that domain's permissions. Exploitation is constrained rather than trivial - k_mem_domain_init() and k_mem_domain_deinit() are supervisor-only APIs with no syscall surface, so an unprivileged thread cannot drive the counter itself and the vulnerable application must itself create enough domains to wrap the allocator, and the ASID duplication must additionally coincide with a scheduling path that skips the TLB flush in z_arm64_swap_ptables() (for example the A->B->C three-domain sequence, or two aliased domains resident on separate CPUs under SMP). No public exploit code identified at time of analysis, and a vendor fix is available upstream, so this registers as moderate rather than urgent risk.
A heap out-of-bounds read in Open5GS 2.8.0 and earlier (ogs_pfcp_parse_dropped_dl_traffic_threshold() in lib/pfcp/types.c) lets remote unauthenticated attackers send malformed PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805, using a Dropped DL Traffic Threshold IE with the DLPA and DLBY flags set but a too-short IE length, causing the parser to read past the end of the IE buffer and potentially crash the UPF. The assessed impact is availability-only (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L; vendor score 6.9 under CVSS 4.0), so this is a medium-severity denial-of-service issue rather than a top-tier priority. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, though the practical risk depends on exposure of the internal N4 interface.
Unauthenticated path traversal in the bookmark-restore handler of Shiny for Python 1.4.0 through 1.6.3 lets a remote attacker supply a crafted _state_id_ query-string value containing parent-directory ('..') segments or an absolute path, causing the server to join it into the server-side shiny_bookmarks directory and open input.json and values.json from outside the bookmark store. On default applications - including those configured with bookmark_store='disable' - this requires no authentication and no opt-in configuration and yields a limited-confidentiality probe of file existence and JSON validity, but when an application is configured with bookmark_store='server' and uses ui.input_file(), the file-input restore handler can copy and expose an attacker-selected file from an attacker-selected directory. The issue is fixed in 1.6.4, and no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote request flooding against MongoDB Ops Manager's monitoring HTTP endpoints can temporarily slow other traffic served by the same process, because those endpoints perform costly work and are not rate limited (CWE-770). Only deployments whose Ops Manager web port is reachable by an attacker are exposed, and exploitation requires no credentials, user interaction, or special configuration per the supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N). The effect is bounded: impact is limited to low availability degradation (VA:L) with no confidentiality or integrity loss and no crash or permanent denial, so an attacker must sustain a continuous request flood to produce any noticeable effect; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Recursive deletion of arbitrary user-writable directories is possible in the LobsterAI desktop application (NetEase Youdao) versions 2026.5.27 through 2026.9.23 because the skills:delete IPC handler trusts the openclawSourceDir path supplied in a skill's _meta.json during uninstall instead of confining cleanup to the skill's own directory. An attacker who persuades a user to install a crafted skill package - the bundled security scanner never inspects _meta.json, so the package passes vetting - can have the victim's home directory or another user-writable location wiped when that skill is later uninstalled, causing high integrity and availability impact (assessed CVSS:3.1 AV:L/AC:L/PR:N/UI:R, vendor CVSS:4.0 6.9, PR:N/UI:P). The attack is not remotely exploitable and requires user interaction twice (install plus uninstall), and no public exploit code has been identified at time of analysis; the issue is patched upstream (commit 82fdfe10d1b85d0ff734aa720e18c866b4be2406) with the fix adding regression tests that confirm bystander and OpenClaw-sourced directories are no longer touched.
Open5GS through 2.8.0 contains a heap out-of-bounds read that lets remote unauthenticated attackers crash the SMF by sending a crafted PFCP Session Report Request to UDP port 8805 carrying a Volume Measurement IE whose flag bits are all set while the IE body is too short to hold the declared fields. The parser in lib/pfcp/types.c walks past the end of the IE buffer by as much as 48 bytes, producing availability-only impact (CVSS 4.0 base 6.9, CWE-125); the over-read bytes are not returned to the attacker, so this is a denial-of-service condition rather than a data leak. No public exploit code has been identified at time of analysis, and practical exploitation presupposes that the attacker can reach the internal N4/PFCP control-plane interface between SMF and UPF, which is not intended to be internet-facing.
Sensitive information disclosure in QA Analytics WordPress plugin versions through 5.3.0.0 allows unauthenticated remote attackers to retrieve embedded sensitive data sent to clients. This medium-severity flaw (CVSS 4.0 6.9, CWE-201) affects sites with the plugin's heatmap/analytics data-collection feature active, and no public exploit has been identified at time of analysis.
Privilege escalation in the Redux Framework WordPress plugin through version 4.5.11 lets an authenticated attacker with only Subscriber-level access escalate to any role, including Administrator, by writing an arbitrary role value during a profile update. The flaw is conditionally exploitable: it only triggers on sites where an active plugin or theme has integrated Redux user-profile fields via Redux_Users::set_profile/set_section/set_field, which is a non-default integration requirement, so having the plugin installed alone is not sufficient. Wordfence rates this 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), the attack requires no victim interaction and is network-reachable, and no public exploit code has been identified at time of analysis; the practical limiting factor is the required third-party profile-field integration.
Server-side request forgery in Dell Secure Connect Gateway (SCG) Policy Manager affects versions prior to 5.34.00.16, letting an attacker who already holds high-privilege access to the management interface coerce the appliance into issuing requests to attacker-chosen destinations. Because the CVSS vector carries PR:H, this is not reachable by anonymous or low-privileged users, and the impact is limited to information disclosure (C:H) with no integrity or availability effect; scope is changed (S:C), so the server can be pivoted toward internal or backend resources outside its own security boundary. No public exploit code or confirmed active exploitation was identified at time of analysis, and the underlying high-privilege prerequisite keeps this a moderate-severity, low-urgency issue rather than a top remediation priority.
Kernel memory exhaustion in the illumos name service cache daemon (nscd) lets any local, unprivileged user - including one confined to a non-global zone - drive the daemon's file descriptor table to grow without bound. The nscd door at /var/run/name_service_door accepts passed file descriptors from any user in its zone, and switcher() in nscd_frontend.c never releases descriptors that a request does not consume, so a loop of door_call() invocations against the daemon slowly starves kernel memory and can render processes in every zone on the host unresponsive. Impact is availability-only with no confidentiality or integrity loss, and it is confirmed to affect illumos-gate and OmniOS builds predating illumos-gate commit af810a72, which caps in-flight descriptors and closes unused ones; no CISA KEV listing or public exploit code is documented in the supplied references, and the defect has been latent in the illumos codebase since a 2006 commit (cb5caa98).
Host denial-of-service in illumos bhyve allows a privileged guest user to panic the host by executing a REP-prefixed MOVS or STOS instruction targeting kernel-emulated MMIO regions such as the local APIC. The flaw has existed since 2020 and affects illumos-gate and OmniOS builds prior to commit 696ecf8d, stemming from a failure to clear the VIES_REPEAT flag that leads to a VERIFY assertion in vie_advance_pc(). Publicly available exploit code exists, but no active exploitation has been confirmed.
Code execution and unauthorized filesystem access in Dell Secure Connect Gateway (SCG) Policy Manager are achievable when a locally positioned, highly privileged attacker supplies directory-traversal sequences to a Policy Manager file-path handling feature (CWE-22), with exploitation additionally requiring user interaction and non-trivial conditions to line up (CVSS 6.3, CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Despite the HIGH confidentiality, integrity, and availability impacts in the vector, this is a moderate-severity, low-urgency issue: there is no remote or network vector, an authenticated high-privileged application account on the host is a prerequisite, user interaction is mandatory, and attack complexity is high, so practical risk is largely confined to insider or already-compromised-host scenarios. No public exploit identified at time of analysis, and a vendor patch is available via Dell DSA-2026-385, though the exact fixed version must be confirmed because the CVE description cites 5.34.00.16 while EUVD lists 5.36.00.16.
Cleartext IAM user Management Console passwords can be captured into PowerShell transcripts and other log artifacts by AWS Tools for PowerShell versions prior to 5.0.306, letting a local user who already has read access to those files recover live console credentials. Exploitation requires three conditions to coincide: an operator runs a pre-5.0.306 cmdlet that generates or returns an IAM user's cleartext console password, that command output is written to a persistent artifact such as a Start-Transcript file or redirected log store, and the attacker already holds a local foothold with read rights on the host - conditions that keep this at CVSS 5.9 (AV:L/AC:L/PR:L/UI:R) and make it a moderate-priority, defense-in-depth issue rather than an urgent threat. There is no public exploit identified at time of analysis; the vendor has released 5.0.306 and advises reviewing existing transcripts and rotating any IAM console passwords that may have been exposed.
Out-of-bounds read of up to roughly 64 KiB in Zephyr's ITE IT8xxx2 SHI host-command backend allows an attacker who drives the SPI host controller to disclose adjacent embedded-controller SRAM to the host, or to fault the controller by reading past the end of SRAM. The root cause is a race: the 8-byte host-command header is copied from the SPI Rx FIFO directly into the shared in_msg buffer before the protocol version and derived packet length are validated, so a second transaction carrying data_len = 0xFFFF can deposit its header into a buffer that verify_rx() has already accepted; if those bytes land before the host-command thread assigns args.input_buf_size = rx_header->data_len, a registered handler is handed a 65535-byte length over a 256-byte buffer. Exploitation requires local control of the inter-processor SHI bus (a compromised host OS driving chip select and clock, or physical access to the SPI lines) plus a timing race the host can retry indefinitely, and is unauthenticated per the CVSS vector (PR:N); no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in pyLoad (pyload-ng) prior to 0.5.0b3.dev101 allows an authenticated API user to crash the server by uploading an oversized file to the /api/rpc endpoint. The rpc handler in api_blueprint.py reads the entire multipart/form-data payload into memory with file.read() before any size check is applied, so a multi-gigabyte upload exhausts available RAM and the process is killed by the kernel OOM killer, interrupting all active downloads and tasks. Exploitation requires an authenticated session or a valid X-API-Key (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5), and no public exploit was identified at time of analysis, though the upstream advisory documents full reproduction steps; the flaw is rated moderate severity because it affects availability only and can be contained at the reverse-proxy layer on unpatched hosts.
Missing authorization in the codemstory SimplePay for WooCommerce payment plugin (slug pgall-for-woocommerce, marketed in Korean as 워드프레스 결제 심플페이) up to and including version 5.5.17 lets unauthenticated remote attackers change the plugin's payment gateway configuration - the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms no login and no user interaction are required. Rated CVSS 3.1 base 6.5 (Medium) with impact sub-scores C:N/I:L/A:L, so the realistic harm is tampering with settings and disruption of the checkout/payment flow rather than data disclosure or code execution, and the plugin's narrow, Korea-focused deployment further limits exposure; no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Missing authorization in WP Rocket for WordPress before 3.23.5 exposes plugin actions that lack proper capability checks, allowing attackers to reach functionality they should not be permitted to use. The reported CVSS vector lists network access with no privileges or user interaction, but the CWE-862 classification and independent assessment indicate the realistic barrier is possession of a valid low-privilege WordPress account, such as Subscriber, which is the key limiter on exploitability. No public exploit code was identified at time of analysis, the issue is moderate risk rather than emergency priority, and it is resolved by updating to 3.23.5 or later.
Stored cross-site scripting in the Crocoblock JetReviews WordPress plugin (versions through 3.1.2) lets an authenticated low-privilege user persist malicious script inside review content, which then executes in the browser of any visitor who later views the affected review page. Successful exploitation requires a valid account with permission to submit JetReviews content plus a victim who loads the poisoned page, so sites that do not allow untrusted users to post reviews are not exposed in practice. CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L); no public exploit code was identified and the flaw is not confirmed as actively exploited (not in CISA KEV).
Stored cross-site scripting (XSS) in the FolioVision FV Flowplayer Video Player plugin for WordPress, affecting all versions through 7.5.54.7212, lets an attacker with sufficient privileges to store content in the plugin (CVSS PR:L) inject JavaScript that later executes in the browser of a second user - typically an administrator or editor - who views the affected page or admin view (CVSS UI:R). Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, CWE-79), impact is confined to the victim's browser session rather than direct server compromise, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. The report originates from Patchstack and the exact input field serving as the injection vector is not specified in the available advisory.
Stored cross-site scripting in the bPlugins HTML5 Audio Player WordPress plugin (versions through 2.8.8) lets an authenticated low-privileged user - for example a contributor or author able to submit content the plugin stores - plant script payloads in plugin-handled data. The injected code persists and executes in the browser of any user who later views the affected page, such as an editor or administrator reviewing content, which can lead to session or credential theft and arbitrary actions in the victim's context; the CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) has been reported, and exploitation requires both an authenticated account on the target site and a victim who loads the tainted content, so sites that limit untrusted user registration are substantially less exposed.
Denial of service in OpenPrinting CUPS before 2.4.20 lets an actor holding @SYSTEM-level class-management privileges crash the cupsd scheduler by triggering a double-free in printer-class handling. The actor submits a CUPS-Add-Modify-Class request that replaces an existing class's member list and then fails subsequent validation, leaving pclass->printers as a dangling pointer, then issues a CUPS-Delete-Class request so cupsdDeletePrinter() frees the same allocation a second time. Impact is confined to availability (scheduler crash) with no confidentiality or integrity effect, and no public exploit identified at time of analysis - the @SYSTEM privilege prerequisite (PR:H) is the dominant limiting factor, keeping overall risk low even though the assessed vector is network-reachable (AV:N/AC:H) when the CUPS listener is exposed.
Authenticated SQL injection in ProcessMaker's task listing API (GET /api/1.0/tasks) allows any low-privilege user with a valid session to inject a malicious column name through the order_by parameter and extract data from the underlying database using blind, time-based queries. All ProcessMaker builds prior to 2026.14.3 that expose the default core REST API are affected (CPE cpe:2.3:a:processmaker:processmaker:*:*:*:*:*:*:*:*); because the injection is blind and extraction is bounded by the privileges of the ProcessMaker database account, this is assessed as a genuine but moderate-priority issue rather than an urgent one. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the vulnerability is trivially reachable once credentials are obtained and does not require user interaction or non-default configuration.
Stored cross-site scripting in the WPFunnels WordPress plugin, affecting all versions through 3.13.3, lets an authenticated low-privileged user persist malicious JavaScript into funnel content that then executes in the browser of any higher-privileged user who later views the affected page. The flaw is rated CVSS 6.5 (Medium) under vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating an authenticated attack path (PR:L) with a required victim interaction (UI:R) and a scope change (S:C) but only low confidentiality, integrity and availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis; exploitation is realistically limited to sites that grant untrusted or low-privileged accounts the ability to write to WPFunnels funnel fields.
Missing authorization in the Magepeople 'Deposits and Partial Payments for WooCommerce' plugin (CWE-862) through version 4.0.1 lets an authenticated low-privilege user - such as a registered customer or subscriber on a store with self-registration enabled - invoke plugin functionality that should be restricted to higher-privileged roles, resulting in a high integrity impact while confidentiality and availability are unaffected (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Exploitation requires only a valid low-privilege session and needs no user interaction, making it practical on typical storefronts where customer accounts are freely creatable. No public exploit code and no confirmed active exploitation were identified for this CVE at time of analysis; the flaw is reported by Patchstack and tracked in the EU ENISA database as EUVD-2026-95623.
Stored cross-site scripting in the Classified Listing WordPress plugin through version 6.1.2 allows an authenticated attacker with listing-creation privileges to inject persistent JavaScript that executes when an administrator or other user views the affected listing. Exploitation requires a low-privileged account (PR:L) and victim interaction (UI:R), and no public exploit code or active exploitation has been identified at time of analysis. This is a moderate-risk, low-urgency issue; practical impact depends on whether untrusted users can submit listings and whether those listings are rendered to privileged viewers.
Missing authorization in the ProfilePress (wp-user-avatar) WordPress plugin through 4.17.3 allows an authenticated user with only low privileges to perform state-changing actions that should require higher-level capabilities, resulting in unauthorized modification of site data. The flaw is exploitable remotely over the network with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base score 6.5), with impact confined to integrity; confidentiality and availability are unaffected per the assessed vector. No public exploit code and no active exploitation have been identified at time of analysis, and exposure is meaningfully reduced on sites that restrict or disable open user registration, since the attacker must first hold a valid low-privilege WordPress account.
Stored cross-site scripting in Crocoblock's JetBlocks For Elementor WordPress plugin (all versions through 1.5.2.1) allows an authenticated user with low-level privileges to plant persistent JavaScript inside plugin widget content, which then executes in the browser of any administrator or other viewer who loads the affected page - CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Because the payload is stored rather than reflected, a single successful injection can fire for every subsequent visitor until the content is cleaned, though it requires both a plugin-reachable account to inject (PR:L) and a victim to view the poisoned page (UI:R), so it does not self-propagate. No public exploit code and no confirmed active exploitation were identified in the available data; severity is driven mainly by the scope change (S:C) and the low-complexity, network-reachable attack path.
Authenticated database users can trigger a heap out-of-bounds read in the MariaDB Server qc_info plugin (information_schema.query_cache_info), potentially disclosing adjacent process memory or crashing the server. The flaw affects MariaDB releases from 10.6.1 up to the fixed versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, and requires the optional qc_info plugin to be loaded plus an enabled query cache before a query containing embedded null bytes is cached and the query_cache_info table is then read. Rated 6.4 (Medium) with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L; there is no public exploit identified at time of analysis and the impact is limited to partial memory disclosure or denial of service rather than code execution.
Privilege confusion in MariaDB Server (10.6.1 through the 10.6.x, 10.11.x, 11.4.x, 11.8.x, 12.x and 13.0.x lines prior to the fixed releases) allows an authenticated attacker who already holds the CREATE USER privilege to create a principal whose name collides with an existing role or localhost user in the database-privilege ACL cache, then exercise database privileges belonging to that other account. Because roles and localhost users were both cached with an empty IP component, the cache key could resolve to the wrong principal once the legitimate account's database privileges had already been cached through normal use, matching the assessed CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N (high confidentiality and integrity impact, no availability impact). Exploitation is not reachable by unauthenticated or low-privilege users and depends on non-trivial account-naming collisions plus ACL-cache timing state, so the practical risk is concentrated in privileged insiders or already-compromised administrative accounts. Vendor-released fixes are available in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2; no public exploit identified at time of analysis.
Double-release of pooled decompression buffers in Xerial snappy-java 1.1.7.4 through 1.1.10.9 lets a crafted Snappy framed stream corrupt or expose data belonging to another, concurrently active stream. An attacker-supplied frame that declares an oversized chunk length forces the replacement buffer allocation to fail with OutOfMemoryError, after which the failed path still treats the already-released pooled buffer as live and returns it to the pool a second time, so the same backing array can be handed to a second stream. The flaw is remote and unauthenticated (CVSS:4.0 vector PR:N) but opportunistic rather than deterministic, requires the target to decompress untrusted framed input through SnappyFramedInputStream while drawing from a shared buffer pool, and carries no public exploit identified at time of analysis; overall risk is medium severity rather than urgent emergency.
Local privilege escalation and arbitrary code execution in the BusyBox tar applet (CVE-2026-108119) allow an attacker who supplies a crafted tar archive to create or replace files outside the extraction directory when the archive is extracted with elevated privileges. The flaw is a CWE-59 link-following issue in the applet's deferred symlink/hardlink creation path, with a CVSS 3.1 base score of 6.3 (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H), affecting BusyBox as shipped in Red Hat Enterprise Linux 6 and Red Hat Hardened Images. No public exploit identified at time of analysis; exploitation requires a privileged user or process to actively extract the malicious archive, and the specific archive construction plus directory-reuse timing makes this high-complexity and local-only.
Insecure default resource initialization in Dell SCG Policy Manager versions prior to 5.34.00.16 allows a high-privileged, local attacker to cause denial of service, disclose information, and bypass protection mechanisms. Exploitation requires local access, high privileges, and a specific high-complexity condition; no public exploit code has been identified at time of analysis. Dell has released patch 5.34.00.16 via advisory DSA-2026-385.
Crux Agent versions 1.9.0 through 2.0.2 mishandle the WireGuard preshared key derived from the Crux SKA bilocation key: when a peering session negotiates SHA-512 the derived key is 64 bytes rather than the 32 bytes WireGuard requires, and the agent neither validates the size nor detects that its `wg set` command failed, so it writes an invalid key to the WireGuard configuration and only surfaces the problem when the tunnel is restarted. The confidentiality-relevant variant applies to peers that have never successfully negotiated a valid 32-byte bilocation key in a Crux C2 organization where the "Enforce SKA Use" setting is turned off, resulting in no preshared key being applied at all, which exposes intercepted tunnel traffic to decryption by an adversary holding (or later acquiring) a cryptographically relevant quantum computer - a harvest-now-decrypt-later exposure, not an immediately realizable attack. Rated CVSS 6.3 (CVSS:4.0/AV:N/AC:H/PR:N/UI:N/VC:H/VI:N/VA:N/S:N/AU:Y/R:A/V:C, unauthenticated), with no public exploit identified at time of analysis.
Open redirect in Apache CXF's OIDC relying-party component lets remote, unauthenticated attackers steer users to an attacker-controlled site by planting external URLs inside OIDC state parameters that the RP preserves and later reuses as a post-authentication redirect target. Only deployments that actually enable the OIDC relying-party code path are exposed, and a victim must be lured into initiating and completing an authentication flow through an attacker-supplied link, so exploitation is not fully automatic. Both directly encoded and double-encoded external URLs can slip past origin validation depending on which validation path runs; there is no public exploit identified at time of analysis, vendor-released fixes are available in 4.2.4, 4.1.9, and 3.6.13, and the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N reflects a low-severity redirect impact gated by mandatory user interaction.
Information disclosure in the Ash framework for Elixir (versions 2.6.0 up to but not including 3.34.6) lets an authenticated actor infer the existence and attribute values of related records they are not authorized to read. Because the aggregate code path (Ash.Actions.Aggregate.run/4) applied only the root resource's read policy and skipped the per-related-resource read policies that the normal read path enforces, a caller who can influence filter or sort input on Ash.count/2, Ash.exists/2, or Ash.aggregate/3 can probe conditions against hidden rows and recover their contents one query at a time. Concrete exposure paths named in the advisory are Ash.Query.filter_input/2, ash_lua scripts, and AshAi tools that expose count or exists results; the vendor rates this 6.0 under CVSS 4.0 and our independent assessment places it at CVSS 3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, and no public exploit identified at time of analysis.
An authenticated member of a MongoDB Ops Manager organization can retrieve another organization or project member's pending authenticator enrollment seed by querying user-listing endpoints while that victim's enrollment remains unconfirmed, exposing secret authentication material (CWE-201, information disclosure into sent data). Only Ops Manager Server deployments earlier than 8.0.27 are affected, and exploitation requires valid same-tenant credentials plus the narrow precondition that the victim has an enrollment in progress that has not yet been confirmed, so risk is real but moderate rather than urgent. No public exploit identified at time of analysis, and the issue is resolved in Ops Manager Server 8.0.27.
CPU exhaustion in OWASP Coraza WAF versions 3.0.0 through 3.7.x allows a remote, unauthenticated network attacker to pin a server CPU core by causing an inspected JSON response body to be deeply nested, because the response-side JSON body processor recurses without an effective depth limit. The flaw is availability-only (CWE-674, uncontrolled recursion, CVSS 3.1 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) and is bounded by the default 512 KiB ResponseBodyLimit, which still permits roughly 87,000 nesting levels and about 12 seconds of single-core work per response. Exploitation is indirect and requires response-body inspection to be enabled (SecResponseBodyAccess On plus application/json in SecResponseBodyMimeType) and a backend whose JSON nesting depth the attacker can shape; the request-body JSON path is unaffected because it uses the configured request recursion limit. No public exploit is identified at time of analysis, and no evidence of active exploitation was provided; vendor-released patch 3.8.0 fixes the issue.
Credential disclosure in MariaDB Connector/C (libmariadb) 3.4.1 through 3.4.9 lets an active man-in-the-middle attacker who holds a validly-trusted certificate issued for a different hostname capture the cleartext database password: the library checked certificate trust, but failed to reject a TLS hostname mismatch before proceeding with a non-hashing authentication plugin switch, allowing the attacker to request mysql_clear_password over the attacker-controlled TLS session. Exploitation requires the client to run in Zero-Configuration SSL mode (no ssl_ca, ssl_capath, ssl_crl, ssl_crlpath, tls_fp, or tls_fp_list configured) on a non-local connection, plus a MITM position and a trusted-but-wrong-hostname certificate, so this is a genuine but conditional CWE-297 flaw rated moderate rather than urgent (CVSS 5.9, AC:H); no public exploit identified at time of analysis. It is fixed in version 3.4.10, and other MariaDB connectors are not affected.
ProfilePress versions up to and including 4.17.3 contain a missing authorization vulnerability (CWE-862) that allows unauthenticated remote attackers to bypass incorrectly configured access control checks, potentially leading to unauthorized modification of site data. The flaw requires a specific high-complexity configuration condition (CVSS AC:H) to be exploitable, but when present, it can compromise integrity; confidentiality and availability are unaffected. No public exploit code or active exploitation has been identified at the time of analysis, and the CVSS score is 5.9, reflecting a moderate-severity, high-CVSS-but-tempered-real-risk issue.