Authenticated users holding only subscriber-level accounts can modify, corrupt, or delete media-library attachments owned by other users-including administrators-through the Classified Listing WordPress plugin before 6.1.1. The defect is a missing-authorization flaw (CWE-862) triggered specifically when a gallery request references an unattached media item, which the plugin fails to check for ownership or edit capability. Publicly available exploit code exists and the plugin is a confirmed target for the WPScan research team, but there is no KEV listing or independent evidence of active exploitation, and EPSS is a low 0.17% (6th percentile); impact is confined to integrity and partial availability with no confidentiality loss (C:N).
Unauthenticated privilege escalation in the SimpleForm WordPress plugin up to and including version 3.10.0 allows any remote visitor to create an Administrator-level WordPress account by submitting crafted registration data. The vulnerable AJAX action wp_ajax_nopriv_simpleform_wp_register lacks a capability check for role assignment, and related meta-saving logic fails to exclude wp_capabilities, while the required nonce is publicly emitted on every front-end page. No public exploit code is confirmed at time of analysis, but the flaw is trivially exploitable against default configurations; an upstream fix exists via changeset 3726513, though a tagged release is not independently confirmed.
Unauthenticated PHP object injection in e107 CMS before 2.3.7 lets a remote attacker who can reach install.php execute arbitrary PHP functions with the web server's privileges, resulting in full server compromise (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H). The flaw arises because the installer decodes the attacker-controlled previous_steps POST parameter and feeds it to unserialize() without restricting allowed classes, and because install.php remains reachable after a normal installation. No public exploit code was identified at time of analysis and CISA KEV does not list this issue, but the advisory documents a complete, directly usable gadget chain (GuzzleHttp\Psr\7\PumpStream → paths.hash → site_path callable coercion) that makes reliable exploitation realistic for any deployment that left the installer endpoint exposed; sites that deleted or access-restricted install.php after setup are the main mitigating factor.
OS command injection in the thumbnail Python package through version 1.5 allows attackers who control a filename passed to generate_thumbnail() to execute arbitrary shell commands with the privileges of the Python process. The vulnerable code concatenates user-influenced values (input, output, width, height, quality, trim) directly into os.system() calls invoking ffmpeg, convert or unoconv, so shell metacharacters such as ';', backticks or $(...) in a filename break out of the intended command. The package is a library with no network listener of its own, so real-world reachability depends on the consuming application exposing untrusted filenames - classically a file-upload feature - and on ffmpeg/convert/unoconv being installed for the relevant code branch; where those conditions hold, no authentication or user interaction beyond submitting the malicious filename is required. An upstream fix exists in pull request #9, and no public exploit code has been identified at time of analysis.
Unauthenticated SQL injection in WeGIA versions prior to 3.8.6 allows any remote attacker to read and modify the underlying database by sending a single POST request to web/html/socio/sistema/cadastro_cobranca.php. The codigo parameter is folded into the WHERE codigo= clause of an UPDATE statement without parameter binding, and supplying a quoted string defeats MariaDB's implicit numeric conversion on the VARCHAR column, permitting arbitrary SQL execution without a session. Exposed records include user credential hashes and billing entries in the cobrancas table; the issue is rated CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis.
Unauthenticated SQL injection in WeGIA versions prior to 3.8.6 allows remote attackers to execute arbitrary SQL against the underlying database by sending crafted POST data to the web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint. Because the endpoint uses extract($_REQUEST) and interpolates user-supplied values directly into a raw INSERT statement, an attacker can read, modify, or delete billing, member, employee, permission, and credential data, or drop database tables, without authentication or user interaction. The vendor fixed the flaw in 3.8.6 with prepared statements and input validation; no public exploit code was identified at time of analysis.
Unauthenticated SQL injection in WeGIA prior to 3.8.6 lets any remote attacker who can reach the application read, alter, or destroy its MySQL database through the billing endpoint web/html/socio/sistema/cadastro_cobranca.php. Because that endpoint is reachable without credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) and passes the valor, valor_pago, id_pessoa, id_socio and id_sociotipo parameters straight into UPDATE, INSERT and SELECT statements, an attacker can exfiltrate billing records and credential data or truncate tables to cause application-wide data loss. No public exploit code was identified at time of analysis and there is no CISA KEV entry indicating active exploitation, but the low attack complexity and lack of authentication make prompt upgrading to 3.8.6 the priority action.
PHP object injection in the itthinx Affiliates WordPress plugin (all versions through 7.0.1) allows remote, unauthenticated attackers to reach a code path that deserializes attacker-controlled input via unserialize(), which can lead to full object injection against the affected site. The supplied CVSS 3.1 vector scores it 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), while our independent assessment applies AC:H because meaningful exploitation depends on the presence of a usable PHP POP gadget chain in the plugin, WordPress core, or another installed plugin/theme; without such a chain the practical effect is usually limited. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but sites running Affiliates 7.0.1 or earlier alongside components that expose gadget chains face materially elevated risk.
Authentication bypass in Progress MOVEit Transfer's LDAP module allows unauthenticated remote attackers to skip a critical authentication step, carrying CVSS 9.8 impact on confidentiality, integrity, and availability when LDAP external authentication is enabled and the web interface is network-reachable. Affected releases are before 2025.1.6 and 2026.0.0 before 2026.0.4; fixed builds are 2025.1.6 and 2026.0.4. Exploitation signals conflict sharply: despite the critical score, no public exploit has been identified at time of analysis, EPSS is 0.46% (38th percentile), and CISA SSVC lists exploitation as 'none' while assigning total technical impact.
Unauthenticated SQL injection in the Abandoned Cart Pro for WooCommerce plugin (≤10.8.0) allows remote attackers to execute arbitrary SQL commands via attacker-controlled guest checkout fields, leading to database information disclosure and modification of WordPress user metadata. Exploitation can escalate an arbitrary account to administrator by injecting a malicious wp_capabilities row, and the vulnerability is exploitable without authentication or user interaction (CVSS 9.8). No public exploit code has been identified at time of analysis, but the flaw is considered high-priority due to its severe impact and default exposure on public-facing stores with the vulnerable guest cart persistence feature enabled.
Unauthenticated account takeover in Abandoned Cart Pro for WooCommerce (all versions up to and including 10.8.0) allows any remote attacker to forge a cart-recovery token and force WordPress to authenticate them as an arbitrary user, including administrators, via wp_set_auth_cookie(). The flaw combines MAC-free AES-CTR token encryption with a keystream-recovery attack, an HMAC nonce check that is skipped entirely when the wcap_nonce parameter is omitted, and a missing ownership check between the decrypted abandoned_id and the attacker-supplied user_email. Exploitation requires the attacker to have one legitimate cart-recovery link of their own plus a victim who has previously abandoned a cart, and because the auto-login feature is enabled by default and force-enabled on upgrade, default installations are exposed; no public exploit code has been identified at time of analysis, but the assessed risk is high and no CISA KEV entry is associated with this issue.
Insufficient session expiration in Progress MOVEit Transfer (versions before 2025.1.6, and 2026.0.0 through 2026.0.3) allows an attacker who obtains a still-valid session artifact - a token captured in transit, left behind on a shared or public workstation, or never revoked after logout or a credential change - to keep using that session beyond its intended lifetime, exposing managed file transfer data and functionality. No account of the attacker's own is required (CVSS PR:N), but exploitation is gated on a valid, reachable leftover token existing, which is why our independent assessment scores it AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:N rather than the vendor's 9.8 - the flaw does not by itself yield code execution or availability impact. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is only 0.31% (23rd percentile), so real-world risk is materially lower than the headline score suggests. Patches are available from Progress.
OS command injection in nodejs-whisper through 0.3.1 lets remote, unauthenticated attackers execute arbitrary operating-system commands with the privileges of the Node.js process by supplying a crafted audio file path. The vulnerable convertToWavType() function builds an ffmpeg command as a string, interpolating the caller-provided path between double quotes before handing it to shelljs exec(); a filename containing $() command substitution or a closing double quote breaks out of the quoted argument and is interpreted by the shell. An upstream fix exists in pull request #259, but no tagged patched release has been independently confirmed, and no public exploit code was identified at time of analysis - real-world exposure is limited to applications that pass attacker-influenced, unsanitized filenames into the transcription/convert entry points while ffmpeg is installed on the host.
OS command injection in the whisper-node npm package through version 1.1.1 allows remote, unauthenticated attackers to run arbitrary shell commands with the privileges of the embedding Node.js process whenever an application passes attacker-controlled data into whisper()'s filePath argument or the whisperOptions.language (and potentially modelPath) options. The vulnerable code path is the default in all versions up to and including 1.1.1, with no special configuration required, although real-world exposure is gated by how the library is used: whisper-node is a library, not a network service, so only applications that feed it untrusted input are remotely exploitable, and impact is bounded by the Node.js process privileges. No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV); the upstream fix appears in GitHub PR #64 but a released patched version could not be independently confirmed from the available data.
OS command injection in @mborne/extract versions before 0.2.1 lets an attacker execute arbitrary shell commands with the Node.js process's privileges by supplying shell metacharacters in the archivePath or targetDir options passed to extract(). The flaw is unauthenticated (CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N) and scored 9.3, with full confidentiality, integrity, and availability impact to the host process, though it is a library with no standalone attack surface - it is only reachable when the integrating application forwards attacker-controlled values into one of the affected extractor paths (unzip, 7z, tar-bz2, or gz; the 7z path additionally requires the 7z binary). No public exploit code was identified at time of analysis, so exploitation is contingent on the host application's input handling rather than on any inherently exposed service.
OS command injection in doc-recog through 1.1.6 allows remote attackers to execute arbitrary commands with Node.js process privileges by supplying crafted document paths containing $(...) or backtick command substitution to the recog() or tag() functions, which flow to a shell-based pdftotext exec call in DocData._readPDF. The CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N), but real-world exploitability hinges on whether a consuming application passes attacker-controlled paths into the library; if paths are hardcoded or validated downstream, the flaw is not reachable. No public exploit code has been identified at time of analysis, and the upstream fix (PR #2) switches to execFile with an argument array to eliminate shell interpretation.
OS command injection in the transcribe2texts Node.js library through version 1.0.6 lets unauthenticated remote attackers execute arbitrary shell commands with the privileges of the Node.js process by supplying crafted audioPath values to transcribeAudio(). The flaw is a library sink rather than a directly exposed service: it is exploitable only where an integrating application passes attacker-influenced data into audioPath, which is concatenated unescaped into a python3 command line and run through child_process.exec(); applications that hardcode or strictly validate that path are not exposed. The critical 9.3 (CVSS 4.0) severity reflects network-reachable, low-complexity, no-privilege, no-interaction exploitation with high confidentiality, integrity and availability impact to the host, and while an upstream fix exists, no public exploit code has been identified at time of analysis.
OS command injection in Stills (shahkashani/stills), a Node.js media-processing library, before version 25.24.2 allows crafted media file names containing shell command-substitution syntax such as $(...) or backticks to be executed as operating system commands with the privileges of the Node.js process. The flaw is reachable whenever the library shells out to ffmpeg, ffprobe, gifsicle, or convert on an attacker-influenced path, and the CVSS 4.0 vector (9.3) describes an unauthenticated, low-complexity network attack (PR:N/UI:N) yielding high confidentiality, integrity, and availability impact; our independent assessment scores it CVSS:3.1 8.8/9.8-class (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) but cautions that real-world risk is materially lower in deployments where media file names are operator- or system-generated rather than user-supplied. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch (25.24.2, via PRs #29/#30 and associated commits) is available.
OS command injection in webp-converter before 3.0.0 lets unauthenticated remote attackers execute arbitrary operating system commands as the Node.js process when a host application routes attacker-controlled file names or option strings into the library’s cwebp, dwebp, gwebp, or webpmux helper functions. The flaw carries a CVSS 4.0 score of 9.3 (with an independent CVSS 3.1 assessment of 9.8), but because webp-converter is a library rather than a listening service, real-world risk depends on whether the integrating application actually passes untrusted input into the vulnerable code path; applications that use only server-controlled, fixed paths and options are not exposed. No public exploit code has been identified at the time of analysis, and the vendor has released version 3.0.0 to fix the issue.
Privilege escalation in the WordPress plugin Frontend Dashboard (M A Vinoth Kumar), affecting versions through 3.0.7, lets remote attackers obtain elevated account capabilities through incorrect privilege assignment (CWE-266). Patchstack scores the flaw 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the assessed vector is PR:L, meaning exploitation in practice most likely requires an existing low-privileged account (for example a subscriber) to elevate from, which typically presupposes that open user registration is enabled on the target site. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; exploitation is bounded to WordPress sites actually running this plugin within the affected version range.
OS command injection in the Python library pypdftk (through version 0.5) lets attackers who control the pdf_path or out_file arguments of fill_form(), dump_data_fields(), or pdftk_cmd_util() execute arbitrary operating-system commands with the privileges of the hosting Python process. The three functions concatenate caller-supplied paths into a command string using '%s' formatting and pass it to subprocess.Popen with shell=True, so shell metacharacters embedded in a filename or path are interpreted by the shell rather than treated as literal arguments. CVSS v4.0 scores the flaw 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N), and the independent assessment concurs with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but real-world reachability is bounded by the calling application - pypdftk is a library, not a network service, so exploitation requires the embedding application to forward untrusted input into those parameters, and no public exploit code has been identified at time of analysis. No CISA KEV entry exists for this CVE, and a source-level fix is available from upstream via pull request 57, which replaces string command construction with argument lists.
OS command injection in the npm package git-diff (danday74/git-diff) before 2.0.7 lets unauthenticated attackers execute arbitrary shell commands with the privileges of the Node.js process by passing crafted document strings into the gitDiff API. The library hashed each input with a shell command of the form `printf "..." | git hash-object -w --stdin` evaluated through shelljs.exec, so payloads containing $(cmd) or backtick substitutions survived the JSON.stringify escaping and were executed. The vendor has published an upstream fix that removes the shell invocation entirely, and no public exploit code has been identified at time of analysis; the assessed CVSS 4.0 base score is 9.3 (Critical) for maximal confidentiality, integrity and availability impact to the vulnerable system.
Authenticated, low-privileged TACACS+ users on Juniper Networks Junos OS Evolved can escalate to root and execute arbitrary OS commands, but only when the periodic TACACS+ authorization-refresh feature is enabled - an OS command injection flaw (CWE-78) that requires both a valid low-privileged TACACS+ account and that specific configuration to be active. The vendor rates it 9.3, while our independent assessment scores it CVSS:3.1 9.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting that exploitation is not possible by an anonymous remote attacker despite the vendor's PR:N vector. There is no public exploit identified at time of analysis, and the flaw does not trigger on devices using TACACS+ without authorization-refresh, or on devices using RADIUS or local authentication.
OS command injection on Windows in Beganovich Snappdf versions 1.1.0 through 6.0.x lets remote attackers execute arbitrary operating-system commands as the PHP process by feeding cmd.exe metacharacters (such as '&') into the URL passed to setUrl(). Because the vulnerable code path is built only when the library runs on Windows, the issue is exploitable only when the integrating PHP application runs on Windows and passes attacker-influenced data into setUrl(); a fully static or trusted URL is not exploitable. The CVSS v4.0 vector (AV:N/PR:N/UI:N) indicates the injection can be triggered remotely without authentication, giving high confidentiality, integrity, and availability impact on the host, although no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis.
Authentication bypass in vlife through 2.0.1 enables unauthenticated remote attackers to forge HS256 JSON Web Tokens using a hardcoded signing key, granting super administrator access to any URL on affected instances. The vulnerability carries a CVSS 9.3 (CVSS:4.0) and CWE-321, with all default installations affected because the key is embedded in the open-source TokenUtil class. Exploitation requires only network reachability; no public exploit code has been identified at time of analysis.
Authenticated SQL injection in JTL-WMS lets any user holding a low-privileged session inject arbitrary T-SQL into the application's database queries, granting full read and write control over the backend Microsoft SQL Server data and opening a pivot path toward connected systems. The flaw (CWE-89) carries a CVSS score of 9.4 and is network-reachable with no user interaction, but exploitation requires valid credentials (CVSS PR:L) - fully anonymous attacks are not supported by the assessed vector, and exposure is further bounded by whether the instance is network-reachable to the attacker and whether the vulnerable code path is deployed. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has published a joint advisory covering this CVE together with CVE-2026-89309.
Unauthenticated OS command injection in the bootzd zero-touch provisioning (ZTP) daemon of Juniper Networks Junos OS Evolved on PTX Series routers allows an attacker positioned on the management LAN to execute arbitrary commands as root by sending a crafted gRPC response to a device that is actively provisioning. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting low attack complexity, no authentication or user interaction requirements, and full confidentiality, integrity, and availability impact; the adjacent-network attack vector (AV:A) means the device is not exploitable directly from the internet. No public exploit code has been identified at time of analysis, no CISA KEV listing or EPSS score was provided, and exposure is materially reduced where management traffic runs over a segmented or physically isolated out-of-band network and where devices are not in an active ZTP state.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, unauthenticated attacker who operates a rogue DHCP server execute arbitrary commands as root on affected EX Series, SRX Series, and QFX Series devices. Exploitation is not remotely routable: the attacker must share a Layer-2 broadcast domain with the target and the device must be actively running phone-home / zero-touch provisioning (ZTP), which is why an independent assessment rates the attack complexity higher than the vendor's 8.7 score despite the high confidentiality, integrity, and availability impact (PR:N/UI:N once those conditions hold). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV entry), though NVIDIA/ENISA EUVD tracking and a full Juniper advisory (JSA112187) with vendor patches indicate this is a genuinely high-priority, patchable issue.
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-Web web management interface. An attacker who can reach the J-Web HTTP/HTTPS interface can bypass authentication due to an improper authentication flaw (CWE-287) and execute arbitrary Junos commands as root, with no credentials or user interaction required. The CVSS 4.0 score is 9.3 and our independent CVSS 3.1 assessment is 9.8; no public exploit code has been identified at time of analysis, but exposure is critical for any internet-facing or broadly reachable J-Web service.
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause a denial of service via a crafted TCP frame. Exploitation requires the optional SDX/SRC service-deployment feature to be configured and the attacker to hold a man-in-the-middle position on that path (or control/spoof the SDX/SRC server), conditions that significantly limit real-world exposure; no public exploit has been identified at time of analysis. Juniper has issued patches in advisory JSA112187, and the vendor's CVSS 4.0 score of 9.3 is tempered by our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1).
Unauthenticated remote code execution affects Komodo through 2.3.3 via its Periphery agent, which fails open when its core_public_keys and passkeys allowlists are left empty - the shipping default. Any attacker who can reach the agent's TCP port 8120 can present a self-generated keypair, be accepted as a trusted Core, and issue Periphery API calls that include terminal sessions and container operations, resulting in command execution on managed hosts typically as root. The CVSS 4.0 base score is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N, high confidentiality/integrity/availability), consistent with an independent assessment of CVSS 3.1 9.3; no public exploit code and no CISA KEV entry were identified at time of analysis, though the default-configuration exposure makes exploitation trivial wherever port 8120 is reachable.
Out-of-bounds array access in the Svc::GenericHub component of NASA's F´ (F Prime) framework (4.1.0 through 4.1.x, fixed in 4.2.0) lets remote, unauthenticated attackers who can deliver a crafted hub packet via fromBufferDriver supply an output-port index outside the configured port array; assert-enabled builds abort (denial of service) while builds compiled without assertions can corrupt heap memory and potentially achieve remote code execution. No public exploit code exists and no exploitation has been confirmed in the wild - exploitation presupposes attacker reachability to the hub's input channel, which in F´ deployments is typically a mission radio link or inter-process transport rather than an internet-facing service. The vendor rates this CWE-129 improper array index validation flaw CVSS 4.0 9.3 (Critical), with high confidentiality, integrity and availability impact.
Lantronix XPress-DR and XPress-DR-I (CoBos-family) devices running firmware through 8.1.0.0 expose an unauthenticated UDP configuration service on port 30718 that lets any remote attacker who can reach that port read live configuration data with a type 0xF8 query and persistently rewrite the device IP address and serial-channel forwarding records using a type 0xFD frame with an exactly 0x78-byte body, with the changes committed to EEPROM and surviving reboots. The root cause is missing authentication for a critical function (CWE-306), and no credentials, user interaction, or non-default settings are required; the only practical barriers are network reachability of UDP/30718 and the shrinking installed base after the series reached end-of-life in February 2025. The CVE record scores this 9.3 under CVSS 4.0 and our independent assessment rates it 9.8 under CVSS 3.1; no public exploit code or confirmed active exploitation was identified at time of analysis, though the attack itself is trivial to perform against any reachable device.
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, remote attacker execute code as root or crash the device by sending a crafted packet through a configured GRE tunnel. The only meaningful precondition is that a GRE tunnel must be configured and the malformed packet must arrive on that tunnel interface, so SRX deployments without GRE are not exposed; where GRE is enabled the attack is network-reachable, requires no credentials and no user interaction, and the independent assessment rates the resulting impact as high across confidentiality, integrity and availability. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but vendor patches are available and the configuration-dependent exposure makes rapid triage of GRE-enabled SRX fleets worthwhile.
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved through the J-Web management interface. An attacker who can reach J-Web can send a crafted HTTP request to bypass authentication and execute CGI content with high confidentiality, integrity, and availability impact; the CVSS v4 base score is 9.3 and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit was identified at time of analysis, and the primary risk factor is exposure of J-Web to untrusted or internet-facing networks, since devices with J-Web disabled or restricted to a management network are not reachable.
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid EVPN route advertisements sent by an established BGP/EVPN peer for a configured EVPN-VPWS service, while the identical input causes only an rpd crash (denial of service) on Junos OS Evolved. The underlying defect is a stack-based buffer overflow (CWE-121) in a daemon that runs with root privileges on FreeBSD-based Junos OS, so a successful overflow yields full device compromise, and Juniper has published patched builds under advisory JSA112187. The vendor's CVSS 4.0 base is 9.3 with AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, but real exposure is gated by the requirement that the attacker already hold a configured BGP/EVPN adjacency to the target device; no public exploit code has been identified at time of analysis and there is no KEV confirmation of active exploitation.
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-based buffer overflow in Juniper Networks routing protocol daemon (rpd). A remote configured BGP peer can trigger it by sending a flow-spec update that is selected for re-advertisement; exploitation requires an existing BGP peering relationship and the relevant flow-spec re-advertisement configuration. Rated Critical (CVSS 4.0 base 9.3), Junos OS can be compromised for code execution while Junos OS Evolved is limited to an rpd crash, and no public exploit identified at time of analysis.
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routing protocol daemon (rpd) processes crafted BMP route monitoring messages from a configured external BGP neighbor. Exploitation requires the target device to have an established external BGP (eBGP) session with the attacker-controlled peer and BMP route monitoring enabled; routers without BMP configured or without eBGP peers are not exposed. No public exploit code or active exploitation has been identified at time of analysis.
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based buffer overflow (CWE-121) in the httpd process that serves the J-Web management interface, reachable by an unauthenticated network attacker who can reach the J-Web HTTP(S) listener. The vendor-assigned CVSS 4.0 score is 9.3 (and our independent assessment maps this to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. 9.8), reflecting full confidentiality, integrity and availability impact with no authentication or user interaction required; attack complexity is low in the base vector, though the real-world exploitable population is constrained by two configuration prerequisites. Successful exploitation is contingent on J-Web being enabled and a J-Web virtual-domain being configured - a non-default state - so devices with J-Web disabled or no virtual-domain configured are not affected. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Authenticated users with query access to an administrator-configured DuckDB data source on Redash 26.0.0 through versions before 26.9.0 can read and write files on the Redash server with the privileges of the Redash process, because the DuckDB query runner opened connections with enable_external_access left at its default value of true. The practical impact escalates beyond data exposure: reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY allows forged session cookies and a full authentication bypass, which is why the issue carries a 9.3 CVSS 4.0 base score under a CWE-284 improper access control root cause. There is no public exploit identified at time of analysis, and exploitation is not possible without both an existing administrator-created DuckDB data source and a query-capable account (authenticated, low privileges per the CVSS PR:L metric), so instances that do not use the DuckDB query runner are unaffected.
HTML injection in Responsive Blocks WordPress plugin before 2.3.0 allows unauthenticated remote attackers to place arbitrary HTML, including phishing links, into notification emails sent to the site owner when a crafted value is submitted through the plugin's Form block. The issue is moderate, not critical: the independently assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, so there is no server-side code execution, confidentiality loss, or availability impact, and the injected content only matters if the recipient opens the email and interacts with the attacker-supplied HTML. Publicly available exploit code exists, but there is no evidence of confirmed active exploitation (CISA KEV) from the provided data.
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Junos OS Evolved devices through the J-Web management interface when web management is enabled, due to improper authentication in NETCONF session handling. This is a critical vulnerability (CVSS 9.3/9.8) that requires only network reachability to the J-Web HTTP/HTTPS service; no credentials or user interaction are needed. No public exploit code or active exploitation has been identified at time of analysis, but the risk is genuine and high-priority as noted in independent assessment, not merely a high-CVSS artifact.
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is configured, allowing a remote, unauthenticated attacker to cause a denial of service; the independent assessment rates the impact as availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The exposure is bounded by the Extended Echo precondition, and no public exploit identified at time of analysis. Juniper advisory JSA112188 should be used to identify affected and fixed releases.
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enabled allows unauthenticated remote attackers to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets. Exploitation requires the target device to have at least one interface explicitly configured for SVR, a non-default feature; devices without SVR are not exposed. At time of analysis, no public exploit code has been identified, but the flaw carries a critical severity rating (CVSS 9.3) and should be prioritized for patching on affected deployments.
Stack-based buffer overflow in Juniper Networks Junos OS and Junos OS Evolved BGP flowspec handling allows a configured BGP flowspec peer to compromise the routing engine or cause a routing-daemon denial of service when BGP update-threading is enabled. The vendor CVSS 4.0 score is 9.3, and the independent assessment is CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting a genuinely high-priority issue whose exploitability is more constrained than the critical score alone suggests: the attacker must already be a configured flowspec BGP neighbor, and update-threading must be enabled, so devices without those conditions are not exposed. Vendor patches are available in fixed builds such as Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.4R2-S5, 25.4R1-S3, and 26.2R1-S2 (with corresponding Junos OS Evolved -EVO releases); no public exploit code has been identified at time of analysis.
Unauthenticated remote code execution as root affects Juniper Junos OS on MX Series routers that are configured for IKE/IPsec with certificate-based authentication, due to a stack-based buffer overflow in the key management daemon (kmd). An attacker with network access to the IKE service can send specially crafted IKE certificate-based packets to trigger the overflow and execute arbitrary code with root privileges. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the vendor has released patches and the vulnerability carries a critical severity rating (CVSS 9.3 from Juniper, 9.8 assessed).
An authentication bypass in Better Auth versions 1.4.0-beta.18 through 1.7.6 allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. The attack requires the target application to have both an OAuth/social sign-in provider and the Magic Link plugin enabled; the attacker must also know the victim's email address. No public exploit identified at time of analysis, but the vulnerability is rated critical (CVSS 9.3 per CVSS 4.0, 9.8 per assessed CVSS 3.1).
Missing authentication in NullHub through 2026.5.29 exposes the /api/* management API, so any remote attacker who can reach the listener can control agent instances, rewrite configuration including provider credentials, and manage cron jobs and MCP servers. The root cause is the auth_token field defaulting to null and never being assigned, meaning requests sent without Authorization and Origin headers are accepted without credentials (CWE-306). Exploitation requires the API to be bound to a non-loopback interface - the deployment pattern reflected in the project's Dockerfile - and once that exposure exists there are no further attacker prerequisites; severity is rated 9.2 and the independent assessment (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) treats this as a genuine high-priority issue rather than a CVSS-inflated one. No public exploit code was identified at the time of analysis, and the issue is not confirmed as actively exploited.
Out-of-bounds write in the Eclipse NetX Duo TLS 1.3 client lets a malicious or compromised server corrupt memory past the caller-supplied TLS packet buffer by returning a HelloRetryRequest containing an oversized cookie; the copy happens before certificate authentication completes, so no valid certificate is required. It is remotely triggerable without authentication (CVSS:4.0 base 9.3; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects only devices acting as TLS 1.3 clients that initiate an outbound handshake to an attacker-controlled or MITM-positioned server. No public exploit code or CISA KEV entry was identified at time of analysis.
A stack-based buffer overflow in the kernel of Juniper Networks Junos OS Evolved can be triggered by a crafted TCP packet when key-chain authentication is configured for BGP or LDP sessions, leading to a kernel panic and denial of service. This remotely exploitable, unauthenticated vulnerability requires network reachability to BGP (TCP/179) or LDP (TCP/646) and the operator-side configuration of key-chain authentication for those protocols. No public exploit code or active exploitation has been identified at time of analysis; the assessed impact is limited to denial of service with no confidentiality or integrity impact, and it is not a code-execution threat.