Stored cross-site scripting (XSS) in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows an attacker who can write to a vulnerable form field to persist malicious JavaScript that executes in a victim's browser when that page is rendered, potentially hijacking an admin or shopper session and gaining elevated access or control over the victim's account. The vendor vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, 9.3 Critical) is driven by the scope change and high confidentiality/integrity impact, but the attack is not self-contained: it requires a second victim (UI:R) to browse the page that renders the payload, and our independent assessment assumes a low-privileged writer account (PR:L) rather than the vendor's unauthenticated (PR:N) reading, which must be confirmed against APSB26-153. No CISA KEV entry and no public exploit code were identified at time of analysis; availability is unaffected (A:N), so impact is bounded to the confidentiality and integrity of the victim's session and account data.
Reflected cross-site scripting in Adobe Experience Manager allows remote attackers to inject malicious scripts into a web page, requiring user interaction (UI:R) and no authentication (PR:N), which could lead to session hijacking or privilege escalation if the victim is an authenticated AEM author or administrator. Affected deployments include AEM 6.5 up to 6.5.25, AEM as a Cloud Service up to 2026.9.28187, and AEM 6.5 LTS up to SP3. The vendor assigned a CVSS of 9.3, but our independent assessment scores it lower (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) because confidentiality and integrity impacts are limited; no public exploit has been identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager allows attackers to inject malicious scripts into vulnerable form fields, which execute in a victim's browser when they visit the poisoned page, potentially leading to session hijacking or elevated access. Affected versions include AEM 6.5 LTS up to SP3 and AEM 6.5 up to 6.5.25. The vendor CVSS score is 9.3 (PR:N), but independent assessment indicates the injection step may require access to a form-authoring or submission surface (PR:L) and victim interaction is mandatory; no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5 LTS (through SP3) and AEM 6.5 (through 6.5.25) lets an attacker persist a malicious JavaScript payload into a vulnerable form field, which then executes in the browser of any user who views the page rendering that field, yielding high confidentiality and integrity impact with a scope change into the victim's session. Adobe rates this Critical at CVSS 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), while independent assessment scores it lower on the privilege axis at PR:L, reflecting the practical requirement that the attacker be able to submit or store content before triggering execution; all versions converge on UI:R, since the payload remains dormant until a victim browses the affected page. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though the high CVSS score and the authoring-console reachability of AEM make prompt patching per Adobe advisory APSB26-152 advisable.
Unauthenticated remote code execution affects Omnispace Agora Project deployments running versions before 26.10.0, where attacker-controlled values are written unescaped into the PHP configuration file config.inc.php through the installer paths File::updateConfigFile() and DbInstall::dbControl(), and where an SQL injection enabled by PDO::ATTR_EMULATE_PREPARES (which permits stacked queries) lets an attacker re-trigger the installer and inject arbitrary PHP that executes on the underlying host. Exploitation requires only a reachable vulnerable instance with no credentials or user interaction (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; vendor score 9.3 under CVSS v4.0), and no public exploit code has been identified at time of analysis, so risk is concentrated in internet-facing, unpatched installations.
Unauthenticated remote code execution in Xorbits Xoscar through 0.11.2 lets any attacker who can reach the actor-pool TCP channel run arbitrary code as the server process, because the receive path hands raw network bytes straight to cloudpickle.loads() before the message type is validated. The CVSS 4.0 vector (AV:N/PR:N/UI:N, 9.3) confirms the bug is remotely reachable and requires no credentials or user interaction, so any deployment exposing an actor pool on a routable interface is exposed at default configuration; impact is worst where the process runs as root, typical of GPU-node deployments. No public exploit code or confirmed active exploitation was identified at time of analysis, and the exposure is bounded by network reachability - installations that bind the actor-pool port to localhost or keep it on an isolated segment are not remotely exploitable.
Unauthorized SCIM API access in Perforce Helix Authentication Service (HAS) versions 2022.1 through 2025.2 arises from a shipped default bearer token that the installer and configuration script fail to rotate, enabling remote, unauthenticated attackers who know the token to perform user and group provisioning operations. Chaining this with CVE-2026-61834 in the scim-patch dependency allows server-side prototype pollution and, under Node.js 24/Express with specific gadget chains, remote code execution. The underlying defect is removed in HAS 2026.1; no public exploit code has been identified at time of analysis.
Reflected cross-site scripting in TanStack Start server functions lets an unauthenticated attacker craft a server-function URL that causes the application's own origin to return attacker-controlled HTML, which executes in the browser of any visitor who opens that URL and can then read same-origin data or issue requests with the victim's authority. The flaw affects @tanstack/start-server-core from 1.143.12 through versions before 1.169.39, plus @tanstack/react-start before 1.168.60, @tanstack/solid-start before 1.168.57, and @tanstack/vue-start before 1.168.56 (TanStack Router before release-2026-09-30-1747). Exploitation is unauthenticated (PR:N) but requires victim interaction (UI:R) - the target must open the attacker-supplied URL - and no public exploit code or active exploitation has been identified at time of analysis, so the 9.3 score reflects the high confidentiality and integrity impact of the same-origin script injection rather than confirmed in-the-wild attacks.
Unauthenticated remote attackers can bypass the security controls that are supposed to be enforced during session establishment with an OpenText EnCase SAFE Agent, allowing an unauthorized connection to be created to the agent without any credential or user interaction (CVSS 4.0 base score 9.3; vector reports PR:N, UI:N, AT:N). The affected deployments are OpenText Endpoint Investigator, Endpoint Forensics & Response, Information Assurance, and Endpoint Security installations that embed the SAFE Agents component, with default agents whose listening interface is reachable from an untrusted network facing the greatest risk. No public exploit code has been identified and the flaw is not confirmed as actively exploited (CISA KEV), but the pre-authentication, network-reachable bypass with full confidentiality, integrity, and availability impact makes this a genuine high-priority issue rather than a high-CVSS paper tiger.
Arbitrary file read and write on the Metabase server is possible through H2-backed native queries and actions in Metabase 1.55.0 up to (but not including) 1.58.16, 1.59.13, 1.60.9, and 1.61.4. An authenticated user who has been granted permission to run native SQL queries or SQL actions can embed host-facing H2 built-in functions such as FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, and LINK_SCHEMA inside otherwise ordinary SELECT/CALL statements, allowing them to read or overwrite files on the Metabase host or attach external databases; because Metabase's default bundled sample database is H2, this attack surface is present in default installations without any extra configuration. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the fixed versions are published and the vulnerable privilege is a common analyst-level grant, making this a genuine high-priority issue rather than an inflated score.
Unauthenticated remote command execution in Commvault CVFS, the file system component shipped with Commvault Grid (HyperScale X) deployments and exposed through Commvault Cloud, allows a network-reachable attacker to execute commands on the underlying system with high impact to confidentiality, integrity, and availability - Commvault scores it 9.3 under CVSS 4.0. Per the vendor CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) the issue is remotely triggerable without credentials or user interaction, which makes any internet- or broadly reachable CVFS endpoint a priority exposure; the advisory does not name the specific feature, protocol endpoint, or configuration path that must be reached. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and a fixed maintenance release is available from Commvault.
A path traversal flaw in Adobe ColdFusion's Remote Development Services (RDS) component allows arbitrary file system read outside the intended directory scope, exposing configuration files, credential stores and source code on servers where RDS is reachable. Affected builds are ColdFusion 2023 up to and including 2023.0.25 and ColdFusion 2025 up to and including 2025.0.13; per the CVSS vector (PR:N/UI:N) no credentials or user interaction are required once RDS is accessible, so the practical gate is deployment mode rather than authentication. Adobe scores this 9.3 Critical (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), but our reassessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N because RDS is network-reachable on exposed servers while the integrity and availability components are not supported by the path-traversal-to-file-read primitive; no public exploit code and no confirmed active exploitation were identified at time of analysis, and real-world exposure is limited to dev, staging or legacy servers that have left RDS enabled (Production Secure Profile disables it automatically).
Unauthenticated information disclosure in GitLab CE/EE allows remote attackers to read confidential notes on public projects because of incorrect authorization checks, affecting versions from 17.4 up to specific branch fix releases. The flaw carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so exploitation needs no credentials or user interaction and is confined to confidentiality. Publicly available exploit code exists via a HackerOne report, but there is no confirmed active exploitation (CISA KEV not listed); GitLab states the issue is only exploitable under certain conditions, so not every public project is necessarily affected.
An incorrect authorization check in GitLab CE/EE allows an unauthenticated remote user to read work item contents from private groups and projects, exposing information that should be restricted to authorized members. All versions from 17.11 before 19.2.8, every 19.3 release, and 19.4 before 19.4.2 are affected, with vendor-released fixes available in 19.2.8 and 19.4.2. The issue carries a moderate CVSS of 5.3 (confidentiality-only impact) and publicly available exploit code exists via a HackerOne report, though exploitation is gated by unspecified 'certain conditions' and there is no confirmed active exploitation (CISA KEV).
Unauthenticated attackers can read internal notes and confidential system notes on public GitLab CE/EE projects through the GraphQL API, which fails to enforce proper authorization checks on affected versions (19.2 through 19.2.7, 19.3 through 19.3.4, and 19.4 through 19.4.1). The flaw carries a CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting a confidentiality-only impact with no integrity or availability effect. Publicly available exploit code exists, with a HackerOne report and a GitLab work item referenced, so unpatched, internet-exposed instances hosting public projects with internal or confidential notes are the highest-priority targets for remediation.
Authenticated EspoCRM users holding Import scope access can read other users' file attachments by abusing an insecure direct object reference in the Import module, allowing disclosure of files they do not own. The flaw affects EspoCRM releases before 10.0.7 and is reachable over the network by any logged-in account that has been granted the administrative Import permission; anonymous users and accounts without Import scope cannot trigger it. Exploitation requires knowledge or guessing of a valid foreign attachmentId, after which the attacker creates an Import record referencing that ID and calls the error-export endpoint to copy the referenced rows into a CSV they control. Publicly available exploit code exists, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms a confidentiality-only, medium-severity impact with no integrity or availability effect; no public exploit identified as confirmed actively exploited (CISA KEV) status was reported in the source data.
Local privilege escalation in Colorful iGameCenter 2.0.0.82 allows an attacker who already holds a low-privileged session on the host to gain full control of the machine by abusing the AMDRyzenMasterDriver.sys kernel driver. The driver's Dispatch Handler passes an attacker-supplied SystemBuffer straight into MmMapIoSpace, so a crafted IOCTL lets a user-mode caller map arbitrary physical memory, breaking the kernel/user boundary and yielding high confidentiality, integrity, and availability impact across the security scope. Exploitation is strictly local (the assessed vector is AV:L/AC:L/PR:L/UI:N/S:C with all impacts High), no public exploit code has been identified at time of analysis, and the vendor was contacted but did not respond, so no vendor patch is confirmed.
Cross-site scripting in Microsoft Exchange Server (CWE-79) lets an unauthenticated, network-positioned attacker inject script that executes in the browser context of an Exchange web user, enabling spoofing of trusted Exchange/OWA content and access to data and actions available to that victim's session. The flaw carries a 9.3 CVSS base score (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N): no attacker credentials are required, but exploitation depends on the targeted user rendering the crafted content, so it cannot be triggered silently or automatically. Every deployment running below the fixed builds - Exchange Server 2016 CU23, 2019 CU14 and CU15, and Subscription Edition RTM - is exposed; no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records no observed exploitation activity and no automatable attack path.
An access-control bypass in EspoCRM 4.0.0 through 10.0.6 lets any authenticated user who already holds Stream access to a parent record read historical 'was'/'became' values of fields protected by field-level security, by calling the REST endpoint GET /Note/{id} directly, which skips the NoteAccessControl filter. Impact is limited to confidentiality (CVSS 4.0 base 5.3, VC:L with VI:N/VA:N; independently assessed as CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and is meaningful only in deployments that actually use field-level security to hide audited fields from lower-privilege users. Publicly available exploit code exists (GitHub advisory GHSA-mr36-xx82-qf6h, VulnCheck advisory), while there is no evidence of active exploitation or CISA KEV listing at time of analysis.
EspoCRM versions 4.0.0 through 10.0.6 allow authenticated users to read email addresses that Role-based field-level restrictions are supposed to conceal, because the address-book search API does not enforce the emailAddress field permission. An attacker only needs a valid account with record access plus a deployment that relies on Roles to hide emailAddress from that user; environments that do not restrict the field have nothing to leak. Publicly available exploit code exists, though the impact is read-only disclosure and the issue has been assessed as a medium-severity, low-urgency information exposure (CVSS 5.3) with no indication of confirmed active exploitation in the wild.
Privilege escalation in Dockhand before 1.0.50 allows an attacker who holds administrative rights in a different tenant of a shared OIDC provider such as Microsoft Entra ID to obtain Dockhand administrator access by recreating the group Dockhand maps to its admin role and signing in, because the application fails to validate the OIDC iss, aud, nonce, and exp claims. The issue is rated CVSS 4.0 9.2 (critical) on network reach, no privileges required on Dockhand itself, no user interaction, and full confidentiality, integrity, and availability impact once admin access is obtained, though exploitation requires a shared multi-tenant IdP deployment and knowledge of the mapped group name, so single-tenant or isolated IdP deployments are not affected. No public exploit identified at time of analysis and the vulnerability is not in CISA KEV; a vendor patch is available in 1.0.50.
Arbitrary code execution is achievable in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source by an attacker who already holds a high-privilege backend account, exploiting an improper input validation flaw (CWE-20) that a single crafted, network-delivered request can trigger without any user interaction. The CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects complete compromise of confidentiality, integrity, and availability with a changed scope, but the PR:H metric means the attacker must first obtain administrative or equivalently privileged credentials - stolen admin or API credentials, or a pre-existing privileged foothold. Adobe reported the issue directly (APSB26-153); no public exploit code has been identified and there is no confirmed active exploitation (not in CISA KEV) at time of analysis, so the practical risk is concentrated in organizations whose admin panels are internet-exposed with weak credential controls.
Arbitrary code execution in Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13) allows an unauthenticated remote attacker to execute code in the context of the ColdFusion service account. The flaw is a code-injection issue (CWE-94) rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning no credentials, no user interaction, and no unusual complexity are needed - only network reachability of a vulnerable instance. No public exploit code or confirmed active exploitation was identified at time of analysis, but given the severity and the historical targeting of ColdFusion, this warrants expedited patching.
Memory corruption in Microsoft .NET's System.Net.Sockets component allows an unauthorized attacker to execute code over a network on Windows hosts, but only against applications that reuse a single SocketAsyncEventArgs instance across both IPv4 and IPv6 UDP datagram sockets. The flaw (CVSS 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) manifests as an out-of-bounds write in the ReceiveFromAsync path once an undersized cached native address buffer is retained; no authentication or user interaction is required, though the high attack complexity reflects the non-default coding pattern required to reach the vulnerable state. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as none and non-automatable, and no KEV listing applies; Microsoft has shipped fixed runtime builds, making this a meaningful but non-emergency patching priority.
Arbitrary code execution in Adobe Experience Manager (AEM) allows an attacker with a high-privilege account (e.g., administrator or author-level) to run malicious code on the server, potentially affecting resources beyond the vulnerable component due to changed scope. The improper input validation flaw (CWE-20) affects AEM as a Cloud Service ≤2026.9.28187, AEM 6.5 ≤6.5.25, and AEM 6.5 LTS ≤6.5 LTS SP3, and requires network access but no user interaction. No public exploit or active exploitation has been identified at time of analysis; patches are available per the Adobe advisory (apsb26-152).
Account takeover is possible in applications built on ASP.NET Core Identity because the framework's password-reset and email-confirmation flows can dispatch mail to the unvalidated address supplied in the incoming request rather than the user's stored canonical address, allowing a remote unauthenticated attacker who can influence that request address to intercept recovery tokens and reset victim credentials. The issue affects Microsoft.AspNetCore.Identity and Microsoft.AspNetCore.Identity.UI deployments running on ASP.NET Core 8.0 before 8.0.32, 9.0 before 9.0.21, and 10.0 before 10.0.13, as well as certain Visual Studio 2022 and Visual Studio 2026 builds that bundle the affected runtime; it carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) under CWE-640. No public exploit code was identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this should be treated as a high-priority patching item rather than an active-exploitation emergency.
Unauthorized privilege elevation in Microsoft SharePoint is possible through improper verification of cryptographic signatures, allowing unauthenticated remote attackers to forge authentication tokens and gain elevated access. Rated CVSS 8.1, the flaw requires high attack complexity but no user interaction, and the JWT-attack tag indicates it likely involves defeating JSON Web Token signature checks. No public exploit has been identified at time of analysis.
FearlessCMS 0.1.2b and earlier lets an authenticated administrator supply an arbitrary Git repository URL to the dashboard updater (admin/updater-handler.php → perform_update → update.sh), which clones the repository and overwrites the live plugins/, admin/, and includes/ directories without validating the repository's identity, signatures, or contents. Because router.php allows existing PHP files under plugins/ to be executed by the PHP built-in development server - the project's documented run mode - the injected update content runs as arbitrary PHP under the web server account and can persist as a backdoor, yielding full compromise of confidentiality, integrity, and availability. Exploitation is gated on high-privilege (administrator) authentication and affects only versions at or below 0.1.2b; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was provided.
Access control bypass in IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 allows an unauthenticated remote attacker to call gRPC service methods while evading configured Liberty access controls. This is a genuine high-priority issue by multiple signals, with CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), but practical impact is deployment-specific: it matters mainly where gRPC services are deployed and method-level access controls are relied upon. No public exploit identified at time of analysis and no CISA KEV confirmation was provided.
Authentication bypass in Omnispace Agora Project before 26.10.0 allows anyone holding a user's stored bcrypt password hash to log in as that user - including administrators - by replaying the hash inside the legacy AGORAP_LOG/AGORAP_PASS cookies, never needing the plaintext password. The flaw maps to CWE-836 (use of a password hash instead of the password) and is scored 9.1 in CVSS 4.0 with PR:N, meaning no application login is required to launch the attack; however, the practical gate is a prerequisite credential disclosure, since the attacker must first obtain a valid hash from the Agora credential store (database compromise, exposed backup, or SQL injection), which is why the AC:H assessment applies. The vendor addressed it in release 26.10.0 (vendor-released patch: 26.10.0); no public exploit code has been identified at time of analysis and no EPSS score was supplied.
Authenticated OS command injection in the odt2spip plugin for SPIP before 4.4.0 allows author-level users to execute arbitrary commands as the web-server user by uploading a document with a crafted non-.odt filename through the document import form. The flaw survives sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), then triggers during LibreOffice conversion; exploitation requires a working LibreOffice backend and an author account. No public exploit was identified at time of analysis.
Crafted input sent over the network to a reachable DeepSeek V4 instance or API can cause the service to return sensitive information to the requester, with the assessed vector requiring no authentication, no privileges, and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - confidentiality-only impact). Publicly available exploit code exists: the CVE record links a public GitHub gist alongside the vendor homepage, and CISA's SSVC assessment marks the issue automatable with total technical impact, although the record's 9.1 score implies an integrity impact our own assessment does not confirm. Defenders cannot yet scope exposure precisely because no affected build, version, or deployment mode is published, so the practical risk is highest for any DeepSeek V4 endpoint or API that is reachable from untrusted networks.
Account takeover in Omnispace Agora Project before 26.10.0 is enabled by predictable default and temporary account passwords: Txt::defaultPassword() derives those passwords from PHP's uniqid(), which is seeded on microsecond server time rather than a cryptographically secure random source. An attacker who can observe or closely approximate the moment an account was created can reconstruct the uniqid() value, compute the generated password, and authenticate as that user before the legitimate owner first logs in and changes it. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:N) describes a network-reachable, unauthenticated attack that severely compromises confidentiality and integrity but carries high attack complexity because the timing reconstruction and the pre-first-login race must both succeed; no public exploit code identified at time of analysis, and the input contains no CISA KEV listing, so active exploitation is not confirmed.
Authentication bypass in IBM WebSphere Application Server - Liberty (17.0.0.3 through 26.0.0.10) allows remote, unauthenticated attackers to subvert the SAML 2.0 web single sign-on flow when the samlWeb-2.0 feature is explicitly enabled, resulting in a session fixation condition that yields high confidentiality and integrity impact with no availability impact (CVSS 3.1 base 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Because samlWeb-2.0 is an opt-in Liberty feature rather than a default, only deployments that have configured SAML SSO are in scope; in practice exploitation is most credible when a legitimate user subsequently authenticates through an attacker-influenced session, which is a practical limiting factor relative to the raw vector. There is no public exploit identified at time of analysis, no confirmed active exploitation (no CISA KEV listing), and no EPSS score was supplied with the available intelligence.
Account takeover in Omnispace Agora Project before 26.10.0 is possible because the password-recovery feature mints reset tokens as the deterministic value sha1(login.password) instead of a random secret, so any party who knows or can guess a target's login and password pair can recompute a valid token and forge a reset request. The flaw is network-reachable and unauthenticated (CVSS 9.1, CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N, CWE-640) with high confidentiality and integrity impact, though the practical severity is tempered by the requirement to derive the credentials needed to compute the token, which is why the assessed AC is High. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor has released 26.10.0 as the fixed version.
Remote unauthenticated authorization bypass in IBM WebSphere Application Server Liberty 20.0.0.12 through 26.0.0.10 can let attackers reach resources or operations beyond their intended privileges, with high confidentiality and integrity impact and no availability impact. The defect is CWE-863 incorrect authorization, and the supplied sources do not describe the specific trigger, feature, or configuration involved. No public exploit identified at time of analysis; EPSS is 0.33% (24th percentile), while the vuln.today decision label is act_now and CISA SSVC records exploitation none with total technical impact.
Plaintext server-side storage of persistent remember-me tokens in Omnispace Agora Project before 26.10.0 allows anyone who obtains the stored token, such as through database or backup disclosure, to replay it as a bearer credential and authenticate as the victim without the victim's password. The replay step requires no password and, per the assessed CVSS vector with PR:N, no authentication, but exploitation depends on first reading the token from server-side storage and on the victim having used the persistent remember-me feature. It is not confirmed actively exploited (CISA KEV); no public exploit identified at time of analysis. The vendor addressed the issue in Agora Project 26.10.0.
SAP MII's administrative account-provisioning function fails to enforce proper authorization boundaries, enabling an attacker who already holds MII administrator privileges to craft a request that provisions an account with elevated privileges on the underlying Java application server. This can extend compromise beyond MII to the host, with high confidentiality, integrity, and availability impact, and is reflected in a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). No public exploit code or confirmed active exploitation was identified at time of analysis.
Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be induced to make server-side requests to restricted addresses when an application enables remote URL image fetching and accepts attacker-controlled image URLs, because DNS rebinding can bypass UrlImageConverter's address validation. The attacker must control DNS for the hostname and win a check-to-use race; impact is assessed as high confidentiality and low integrity rather than the critical 9.1 NVD score, because the feature is operator-enabled and default deployments are not exposed. No public exploit was identified at time of analysis, and EPSS is low at 0.18% (7th percentile); the issue is fixed in 2.1.0-incubating, which disables remote URL image fetching by default and requires an exact-host allowlist when enabled.
Firefox DevTools does not correctly enforce the same-origin policy before version 158, allowing a remote attacker to cross origin boundaries and read as well as alter data belonging to other origins (C:H/I:H, no availability impact). All Firefox builds prior to 158 are in scope per the vendor CPE, and Mozilla rates the flaw 9.1 with a network-reachable, no-privilege vector; no public exploit code has been identified at time of analysis and EPSS is low at 0.16% (4th percentile), but the vuln.today decision label is act_now, so treat patching as urgent despite the quiet exploitation signal. Note the vector discrepancy: Mozilla's published vector asserts UI:N while the independent assessment scores UI:R, consistent with a victim having to load attacker-controlled content - the exact trigger is not described in the available sources.
Improper input validation in Adobe ColdFusion 2023 (2023.0 through 2023.0.25) and ColdFusion 2025 (2025.0 through 2025.0.13) can let an unauthenticated remote attacker execute arbitrary code in the context of the affected service, with no user interaction required and a scope change that extends impact beyond the vulnerable component. The assessed CVSS is 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H); the high attack-complexity score reflects that exploitation depends on conditions beyond the attacker's control - a race or specific server state - so successful compromise is not guaranteed on demand. No public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation, but the internet-facing nature of ColdFusion and the fully unauthenticated attack path make this a high-priority patch target.
Arbitrary PHP code execution can be achieved against OpenCATS deployments prior to 0.10.0 through an unrestricted file upload in the Import module: an authenticated user holding Import privileges can stage a PHP file whose original, attacker-controlled name is preserved on disk in the web-accessible CATS_TEMP_DIR. Exploitation only works where that temporary directory is served by the web server with PHP execution enabled, so the practical risk is conditional rather than universal; there is no public exploit identified at time of analysis, and the issue is fixed in version 0.10.0. The vulnerability carries a CVSS score of 9.1 (assessed as CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting high impact but requiring authenticated access and a non-default server configuration.
Unauthenticated remote attackers can tamper with token state and disrupt service availability in NVIDIA AIStore for Linux by sending crafted token-revocation lists to a token-revocation endpoint that performs no authentication check (CVSS 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). Because the vector shows PR:N and UI:N, no credentials, privileges, or user interaction are needed - any network-reachable deployment of the affected endpoint is directly exploitable, with the only practical limiting factor being firewall or segmentation controls around the AIStore management/control interface. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the missing authentication control (CWE-306) is the defect itself, so the issue should be treated as a genuine high-priority exposure rather than an inflated score.
Stored cross-site scripting in Cronicle (all releases prior to 0.9.119) lets a user-controlled account field - the full_name value - be written into the administrator Activity Log as raw HTML, so JavaScript planted by one user executes inside an administrator's authenticated browser session and can lead to full administrator takeover and command execution through Cronicle's privileged scheduling features. According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, 9.0), the attacker needs a valid low-privileged session to set the name via /api/user/update with the current password, or alternatively can plant it anonymously only when the non-default free_accounts self-registration option is enabled, and an administrator must then open the Activity Log for the payload to fire. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the flaw is fixed in 0.9.119, and exploitation is not possible on single-admin installations with free_accounts disabled.
Arbitrary code execution is possible in JFrog CLI when specific, non-default configurations are combined with an argument-injection weakness (CWE-88) that allows attacker-influenced input to be incorporated into arguments passed to an underlying command. The flaw carries a 9.0 base score with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, meaning the vector formally allows unauthenticated, no-interaction network exploitation, but the High attack complexity reflects the configuration preconditions that gate it rather than ease of use. Only environments running JFrog CLI are in scope - typically developer workstations and CI/CD pipelines that interact with JFrog Artifactory/Platform - and no public exploit has been identified at time of analysis.
An origin validation error (CWE-346) in Microsoft Power Apps allows an authenticated attacker to achieve remote code execution against affected client deployments by inducing a legitimate user to interact with attacker-controlled content. Only Microsoft Power Apps for Android before 3.26085.7 and Power Apps 1710 (9.2.23071.136) before 2608.5 are affected; patched builds are not vulnerable. Exploitation requires a valid authorized identity in the Power Apps environment (PR:L) plus victim interaction (UI:R), CISA's SSVC assessment records no observed exploitation and rates the attack as not automatable, and no public exploit identified at time of analysis; treat this as an elevated-priority but non-emergency patch item.
Authenticated privilege escalation in Microsoft WebDAV lets a low-privileged network user bypass authorization by supplying an alternate but equivalent path representation, causing access-control checks to be evaluated against the wrong canonical path; successful exploitation yields high confidentiality, integrity, and availability impact (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing authorized account on the target plus network reach to the WebDAV service - it is not exploitable by a fully unauthenticated attacker - but needs no user interaction and has low attack complexity. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified; patch availability was not specified in the provided intelligence and should be confirmed against the Microsoft MSRC advisory.
Komodo's periphery agent container-management operations allow authenticated low-privileged users with Execute, or Read plus Logs, permission to execute arbitrary commands as root on managed hosts by placing shell metacharacters in a container name processed by DestroyContainer or SearchContainerLog. Affected builds are Komodo 1.19.1 through versions before 2.3.0, and the attacker does not need Komodo's Terminal permission, which is the privilege-escalation crux. EPSS is 1.10% (65th percentile), and no public exploit was identified at time of analysis.
Remote code execution in the Windows Background Intelligent Transfer Service (BITS) affects a default-enabled component present on Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8), an attacker who already holds a low-privilege account or foothold can send crafted requests to BITS over the network without user interaction and achieve high confidentiality, integrity, and availability impact within the service's own privilege context (scope unchanged); note that the vendor description's 'unauthorized attacker' phrasing conflicts with the PR:L rating and should be reconciled against the MSRC advisory. There is no confirmed active exploitation and no public exploit identified at time of analysis (CISA SSVC exploitation: none, automatable: no), but technical impact is rated total and a vendor patch is available, making this a high-priority patch target.
Authenticated, privileged remote attackers on affected Siemens Industrial Edge Device Kit installations (arm64 and x86-64, versions 1.5 through 1.28) and the listed SIMATIC/SIPLUS HMI Unified Comfort panels can reach internal APIs and file paths that the software fails to restrict, exposing sensitive internal information and - per the vendor's description - potentially enabling further unauthorized system access or deletion of data. Siemens rates this CVSS 4.0 8.9 High (AV:N/AC:L/AT:P/PR:H/UI:N with full VC/VI/VA:H on the vulnerable system plus SC/SI/SA:H on subsequent systems); our independent assessment concurs with the high impact rating but emphasizes that the score is driven by impact breadth rather than ease of access, because exploitation requires a valid privileged session and an additional attack precondition is signalled by the AT:P metric. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.