Crafted input sent over the network to a reachable DeepSeek V4 instance or API can cause the service to return sensitive information to the requester, with the assessed vector requiring no authentication, no privileges, and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - confidentiality-only impact). Publicly available exploit code exists: the CVE record links a public GitHub gist alongside the vendor homepage, and CISA's SSVC assessment marks the issue automatable with total technical impact, although the record's 9.1 score implies an integrity impact our own assessment does not confirm. Defenders cannot yet scope exposure precisely because no affected build, version, or deployment mode is published, so the practical risk is highest for any DeepSeek V4 endpoint or API that is reachable from untrusted networks.
Account takeover in Omnispace Agora Project before 26.10.0 is enabled by predictable default and temporary account passwords: Txt::defaultPassword() derives those passwords from PHP's uniqid(), which is seeded on microsecond server time rather than a cryptographically secure random source. An attacker who can observe or closely approximate the moment an account was created can reconstruct the uniqid() value, compute the generated password, and authenticate as that user before the legitimate owner first logs in and changes it. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:N) describes a network-reachable, unauthenticated attack that severely compromises confidentiality and integrity but carries high attack complexity because the timing reconstruction and the pre-first-login race must both succeed; no public exploit code identified at time of analysis, and the input contains no CISA KEV listing, so active exploitation is not confirmed.
Authentication bypass in IBM WebSphere Application Server - Liberty (17.0.0.3 through 26.0.0.10) allows remote, unauthenticated attackers to subvert the SAML 2.0 web single sign-on flow when the samlWeb-2.0 feature is explicitly enabled, resulting in a session fixation condition that yields high confidentiality and integrity impact with no availability impact (CVSS 3.1 base 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Because samlWeb-2.0 is an opt-in Liberty feature rather than a default, only deployments that have configured SAML SSO are in scope; in practice exploitation is most credible when a legitimate user subsequently authenticates through an attacker-influenced session, which is a practical limiting factor relative to the raw vector. There is no public exploit identified at time of analysis, no confirmed active exploitation (no CISA KEV listing), and no EPSS score was supplied with the available intelligence.
Account takeover in Omnispace Agora Project before 26.10.0 is possible because the password-recovery feature mints reset tokens as the deterministic value sha1(login.password) instead of a random secret, so any party who knows or can guess a target's login and password pair can recompute a valid token and forge a reset request. The flaw is network-reachable and unauthenticated (CVSS 9.1, CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N, CWE-640) with high confidentiality and integrity impact, though the practical severity is tempered by the requirement to derive the credentials needed to compute the token, which is why the assessed AC is High. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor has released 26.10.0 as the fixed version.
Remote unauthenticated authorization bypass in IBM WebSphere Application Server Liberty 20.0.0.12 through 26.0.0.10 can let attackers reach resources or operations beyond their intended privileges, with high confidentiality and integrity impact and no availability impact. The defect is CWE-863 incorrect authorization, and the supplied sources do not describe the specific trigger, feature, or configuration involved. No public exploit identified at time of analysis; EPSS is 0.33% (24th percentile), while the vuln.today decision label is act_now and CISA SSVC records exploitation none with total technical impact.
Plaintext server-side storage of persistent remember-me tokens in Omnispace Agora Project before 26.10.0 allows anyone who obtains the stored token, such as through database or backup disclosure, to replay it as a bearer credential and authenticate as the victim without the victim's password. The replay step requires no password and, per the assessed CVSS vector with PR:N, no authentication, but exploitation depends on first reading the token from server-side storage and on the victim having used the persistent remember-me feature. It is not confirmed actively exploited (CISA KEV); no public exploit identified at time of analysis. The vendor addressed the issue in Agora Project 26.10.0.
SAP MII's administrative account-provisioning function fails to enforce proper authorization boundaries, enabling an attacker who already holds MII administrator privileges to craft a request that provisions an account with elevated privileges on the underlying Java application server. This can extend compromise beyond MII to the host, with high confidentiality, integrity, and availability impact, and is reflected in a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). No public exploit code or confirmed active exploitation was identified at time of analysis.
Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be induced to make server-side requests to restricted addresses when an application enables remote URL image fetching and accepts attacker-controlled image URLs, because DNS rebinding can bypass UrlImageConverter's address validation. The attacker must control DNS for the hostname and win a check-to-use race; impact is assessed as high confidentiality and low integrity rather than the critical 9.1 NVD score, because the feature is operator-enabled and default deployments are not exposed. No public exploit was identified at time of analysis, and EPSS is low at 0.18% (7th percentile); the issue is fixed in 2.1.0-incubating, which disables remote URL image fetching by default and requires an exact-host allowlist when enabled.
Firefox DevTools does not correctly enforce the same-origin policy before version 158, allowing a remote attacker to cross origin boundaries and read as well as alter data belonging to other origins (C:H/I:H, no availability impact). All Firefox builds prior to 158 are in scope per the vendor CPE, and Mozilla rates the flaw 9.1 with a network-reachable, no-privilege vector; no public exploit code has been identified at time of analysis and EPSS is low at 0.16% (4th percentile), but the vuln.today decision label is act_now, so treat patching as urgent despite the quiet exploitation signal. Note the vector discrepancy: Mozilla's published vector asserts UI:N while the independent assessment scores UI:R, consistent with a victim having to load attacker-controlled content - the exact trigger is not described in the available sources.
Improper input validation in Adobe ColdFusion 2023 (2023.0 through 2023.0.25) and ColdFusion 2025 (2025.0 through 2025.0.13) can let an unauthenticated remote attacker execute arbitrary code in the context of the affected service, with no user interaction required and a scope change that extends impact beyond the vulnerable component. The assessed CVSS is 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H); the high attack-complexity score reflects that exploitation depends on conditions beyond the attacker's control - a race or specific server state - so successful compromise is not guaranteed on demand. No public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation, but the internet-facing nature of ColdFusion and the fully unauthenticated attack path make this a high-priority patch target.
Arbitrary PHP code execution can be achieved against OpenCATS deployments prior to 0.10.0 through an unrestricted file upload in the Import module: an authenticated user holding Import privileges can stage a PHP file whose original, attacker-controlled name is preserved on disk in the web-accessible CATS_TEMP_DIR. Exploitation only works where that temporary directory is served by the web server with PHP execution enabled, so the practical risk is conditional rather than universal; there is no public exploit identified at time of analysis, and the issue is fixed in version 0.10.0. The vulnerability carries a CVSS score of 9.1 (assessed as CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting high impact but requiring authenticated access and a non-default server configuration.
Unauthenticated remote attackers can tamper with token state and disrupt service availability in NVIDIA AIStore for Linux by sending crafted token-revocation lists to a token-revocation endpoint that performs no authentication check (CVSS 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). Because the vector shows PR:N and UI:N, no credentials, privileges, or user interaction are needed - any network-reachable deployment of the affected endpoint is directly exploitable, with the only practical limiting factor being firewall or segmentation controls around the AIStore management/control interface. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the missing authentication control (CWE-306) is the defect itself, so the issue should be treated as a genuine high-priority exposure rather than an inflated score.
Stored cross-site scripting in Cronicle (all releases prior to 0.9.119) lets a user-controlled account field - the full_name value - be written into the administrator Activity Log as raw HTML, so JavaScript planted by one user executes inside an administrator's authenticated browser session and can lead to full administrator takeover and command execution through Cronicle's privileged scheduling features. According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, 9.0), the attacker needs a valid low-privileged session to set the name via /api/user/update with the current password, or alternatively can plant it anonymously only when the non-default free_accounts self-registration option is enabled, and an administrator must then open the Activity Log for the payload to fire. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the flaw is fixed in 0.9.119, and exploitation is not possible on single-admin installations with free_accounts disabled.
Arbitrary code execution is possible in JFrog CLI when specific, non-default configurations are combined with an argument-injection weakness (CWE-88) that allows attacker-influenced input to be incorporated into arguments passed to an underlying command. The flaw carries a 9.0 base score with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, meaning the vector formally allows unauthenticated, no-interaction network exploitation, but the High attack complexity reflects the configuration preconditions that gate it rather than ease of use. Only environments running JFrog CLI are in scope - typically developer workstations and CI/CD pipelines that interact with JFrog Artifactory/Platform - and no public exploit has been identified at time of analysis.