Unauthenticated attackers can mark arbitrary WooCommerce orders as paid on stores running the Asaas Gateway for WooCommerce plugin before 2.7.8, because the plugin's payment webhook accepts an empty access token under its default configuration and never confirms that the notified payment actually belongs to the order it updates (CWE-287 improper authentication). Exploitation needs only the vulnerable plugin installed, active, and network-reachable in its default state, and publicly available exploit code exists; CISA's SSVC decision data records no observed exploitation and EPSS is low at 0.22% (12th percentile). The impact is confined to integrity of order payment status - no data disclosure or availability loss - but stores that auto-fulfill or auto-provision on a 'paid' status can suffer fraudulent fulfillment and revenue loss.
Unauthenticated information disclosure in the GamiPress WordPress plugin (affected versions 7.9.5 up to but not including 8.0.6) lets remote attackers retrieve private activity-log entries belonging to any user on the site without logging in, as no authentication, user interaction, or non-default configuration is required. The issue is an incomplete fix of CVE-2026-13450, meaning the earlier attempt to lock down these log entries left a bypass that still permits access to another user's private activity data. Publicly available exploit code exists and the flaw is fully automatable, though CISA's SSVC assessment records no observed exploitation; EPSS is low at roughly 0.19% (8th percentile), and the impact is confined to read-only leakage of activity-log content, so sensitivity depends on how the site uses GamiPress tracking.
Unauthenticated information disclosure in the AWP Classifieds WordPress plugin before version 4.4.9 lets remote attackers read the private contact email address stored on any listing by submitting a request to the ad submission page that references a payment transaction. The plugin omits the ownership/authorisation check on that code path, so no account, login, or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3); the only exposure is the listing's private contact email, not credentials, content modification, or site control. Publicly available exploit code exists and WPScan published a proof-of-concept write-up, but there is no KEV entry and EPSS is low at 0.19% (8th percentile), so this is a genuine low-to-moderate priority issue affecting only sites running this optional plugin with listings that store private contact emails.
Stack-based buffer overflow in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potentially execute commands with root privileges via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled. Exploitation requires that BMP be explicitly enabled (not default) and that the attacker have an established BGP session, meaning a configured neighbor or compromised peer. No public exploit code has been identified at the time of analysis, and the vulnerability is not known to be actively exploited; patched releases are available from Juniper.
Unauthorized export of complete database table contents in the WP Data Access WordPress plugin before 5.5.84 lets unauthenticated remote attackers retrieve every row and column of any table the site publishes publicly, including data hidden from the on-page view, by reusing a token the plugin itself prints into those public pages. The flaw carries a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3), so impact is confined to confidentiality with no modification or denial of service. Publicly available exploit code exists, but there is no confirmed active exploitation and EPSS is low at 0.18% (7th percentile); a vendor-released patch in version 5.5.84 is available.
Unauthenticated information disclosure in CodeAtoZ B2B Suite for WooCommerce before 1.6.1 allows remote attackers to retrieve other guests' submitted quotes, including buyer names, email addresses, and requested line items, by supplying an enumerable identifier. No authentication or user interaction is required, and publicly available exploit code exists, though the EPSS score is only 0.18% (7th percentile). This is a moderate-severity issue (CVSS 5.3) with impact limited to confidentiality of quote data, and no active exploitation has been confirmed (not in CISA KEV).
Unauthenticated configuration tampering in the LTL Freight Quotes WordPress plugin before 4.2.19 allows remote attackers to modify some of the plugin's stored settings by calling a REST route that performs no authorization check or input validation before writing to the database (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Only WordPress sites running this specific plugin below version 4.2.19 are exposed, and the assessed impact is integrity-only - settings can be altered, but the flaw does not permit data disclosure or site takeover. Publicly available exploit code exists and has been documented by WPScan, though there is no confirmed active exploitation (CISA KEV does not list this CVE) and EPSS is very low at 0.17% (6th percentile).
Unauthenticated remote attackers can delete or overwrite stored abandoned-cart records in the WordPress plugin Cart Abandonment Recovery for WooCommerce (all versions before 2.1.4) by supplying a customer's email address, which the plugin uses as the record key without verifying that the requester owns that address (CWE-639, CVSS 5.3). Exploitation requires only a known or guessable email per target record, so the attacker cannot mass-wipe blindly without an email list, and the impact is confined to abandoned-cart data - no passwords, orders, or payment details are exposed given C:N/I:L and SSVC technical impact of partial. No confirmed active exploitation has been reported (not in CISA KEV), but publicly available exploit code exists per WPScan and EPSS is 0.17% (5th percentile), indicating a genuine yet low real-world risk that is fully resolved by upgrading to 2.1.4.
Unauthenticated attackers can mark WooCommerce orders as paid without any payment taking place on sites running the Paymentfor Gateway for WooCommerce plugin before 1.0.6, because the plugin never verifies that an inbound payment notification actually came from the payment provider. Exploitation is simple for anyone who can reach the gateway's notification (callback/IPN) endpoint and reference an existing order - publicly available exploit code exists, and no credentials or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) - but the risk is real yet bounded, since only stores that installed and enabled this specific gateway are affected. EPSS is low at 0.17% (5th percentile), there is no CISA KEV listing, and a vendor fix is available in version 1.0.6.
Unauthenticated attackers can mark arbitrary pending orders as paid in the Sifalo Pay WordPress plugin before version 2.5.3 by reusing a single valid payment transaction identifier harvested from a legitimate purchase of their own, because the plugin does not bind that identifier to the order being confirmed and does not check that the requester owns the order. The result is a moderate-severity integrity flaw (CVSS 5.3, CWE-639, PR:N/UI:N, no confidentiality or availability impact); publicly available exploit code exists, but there is no confirmed active exploitation, EPSS is low at 0.17 percent (5th percentile), and CISA SSVC records exploitation as none while noting the issue is automatable. Reaching the flaw still requires a site running a vulnerable plugin version with pending orders in its flow plus at least one real transaction the attacker can complete to obtain a usable identifier.
Unauthenticated attackers can write arbitrary payment session metadata onto any order and force any awaiting-payment order into a failed state in Sifalo Pay WordPress plugin versions before 2.5.3, because the payment-return handler does not verify order ownership or authorization. Publicly available exploit code exists, though EPSS is 0.17% (5th percentile) and no active exploitation is confirmed. The independent assessment rates this as a genuine but limited-impact medium issue: no code execution, no confidentiality loss, and only low integrity and availability impact.
Price manipulation in the SellKit WordPress plugin before 2.8.0 lets unauthenticated remote attackers place checkout orders at a self-chosen price for any purchasable product, because the plugin trusts a client-supplied price during server-side total recalculation. Publicly available exploit code exists, and EPSS is 0.17% (5th percentile); the vendor has released a patch. The flaw is a business-logic missing-authorization issue (CWE-862) with CVSS 5.3, and impact is limited to integrity-attackers can underpay but cannot read data or disrupt availability.
Robokassa Payment Gateway for WooCommerce versions before 1.9.0 accepts incoming payment-notification requests without verifying their authenticity, allowing unauthenticated remote attackers to force any WooCommerce order into a failed state. Because order identifiers are sequential and enumerable, an attacker can walk through the shop's entire order queue one request at a time, removing every order from fulfilment. Publicly available exploit code exists and a vendor patch is available in 1.9.0; EPSS is low (0.17%, 5th percentile) and there is no KEV listing indicating confirmed active exploitation, so this is best treated as a moderate-priority business-logic integrity issue rather than a top-tier emergency.
Unauthenticated visitors to any WordPress site running the 'Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant' plugin below version 5.3.2 can invoke an AJAX action that re-registers the store with the plugin's feed service and overwrites the stored shop secret, because that action performs neither a nonce nor a capability check (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The impact is integrity-only and confined to the plugin's feed registration state - there is no code execution, data disclosure, or site takeover path - and publicly available exploit code exists per the WPScan advisory. Real-world urgency is low: EPSS is 0.17% (5th percentile) and the CISA SSVC assessment records exploitation as 'none', with only the plugin version being a precondition.
Unauthenticated remote requests targeting the EmbedPress WordPress plugin (all versions before 4.6.8) can force the site to make server-side, credential-bearing calls to a third-party API and then write attacker-controlled cache entries into the site database. Because the vulnerable handler performs no capability or nonce check, any anonymous visitor can trigger it repeatedly, consuming the site owner's metered third-party API quota and inserting unbounded rows into the WordPress database when the plugin is installed, active, and configured with API credentials. Publicly available exploit code exists for this issue, so weaponization is trivial, though the EPSS score is low (0.17%, ~5th percentile), SSVC records no observed exploitation, and there is no confidentiality exposure or remote code execution - impact is limited to integrity/integrity-adjacent resource abuse.
Unauthenticated attackers can modify data in the WP Data Access WordPress plugin before version 5.5.77 by abusing one of the plugin's REST endpoints that verifies only read permission before carrying out a write. Exploitation is conditional on configuration: an administrator must have exposed a WP Data Access 'application' for anonymous (public) read access, and on such sites the administrator's explicit disabling of update actions offers no protection because the broken authorization check bypasses that control. Publicly available exploit code exists, but EPSS is low at 0.17% (5th percentile) and CISA's SSVC assessment rates exploitation as 'none'; impact is limited to integrity (CVSS 5.3, C:N/I:L/A:N) with no confidentiality or availability effect, and no authentication or user interaction is required against the vulnerable endpoint (PR:N/UI:N per the CVSS vector).
Unauthenticated attackers can forge Mobile Money payment confirmations against WordPress sites running the CamPay Shortcode Payment Gateway plugin before 1.7, marking fraudulent orders as paid, deleting genuine payment records, and writing plugin meta onto arbitrary posts. The root cause is a missing-authorization failure (CWE-862): the plugin's confirmation handling derives the payment outcome directly from client-supplied parameters rather than verifying authenticity with CamPay, so no login, user interaction, or non-default configuration is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Publicly available exploit code exists per WPScan, but observed exploitation is not recorded (EPSS 0.17%, 5th percentile; CISA SSVC exploitation: none), and the vendor has released a fix in version 1.7.
Unauthenticated remote attackers can delete the stored SEO analysis data held by the Rank Math SEO WordPress plugin in any version before 1.0.280, because the routine that wipes that data enforces neither a capability check nor a nonce. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N, 5.3) reflects an unauthenticated, network-reachable integrity-only impact: confidentiality and availability are untouched, so the realistic damage ceiling is loss of the plugin's cached SEO analysis results rather than site compromise or downtime. Publicly available exploit code exists and the vendor has shipped a fix, but CISA's SSVC evaluation rates exploitation as "none" and EPSS is only 0.17% (5th percentile), so this is a low-to-moderate priority issue and not confirmed actively exploited (no CISA KEV listing).
NEX-Forms WordPress plugin versions 9.2.1 up to (but not including) 9.3.1 fail to perform any authorization, ownership, or request-validation check before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign, or append to any previously submitted entry by simply referencing its sequential identifier. Exploitation requires no authentication (PR:N) and no user interaction (UI:N); publicly available exploit code exists, though CISA SSVC records no observed exploitation and EPSS is low at 0.16% (5th percentile), so this is a genuine but moderate-priority issue. Impact is confined to stored form-submission data - integrity and availability are rated Low, with no confidentiality loss and no compromise of the underlying WordPress host.
Comment injection in Sunshine Photo Cart before 3.7.4 lets unauthenticated remote attackers submit comments to restricted galleries without satisfying the gallery access restriction, spoofing author name and email; the same restriction is enforced when comments are displayed. Publicly available exploit code exists, but EPSS remains low at 0.13% (2nd percentile), and the issue is integrity-only, allowing attacker-chosen comment content and metadata to be stored in password-protected, email-gated, private, account-only, or expired galleries. No CISA KEV active exploitation is indicated, and the flaw is a genuine but modest-severity integrity issue rather than a critical priority.
Stored HTML and link injection in the LTL Freight Quotes WordPress plugin before version 4.2.19 allows unauthenticated remote attackers to submit unsanitized values that are persisted and later rendered to storefront visitors. The plugin performs neither an authorization check nor input sanitization before storing these request values, so exploitation requires no authentication, no user interaction, and no special configuration on a default installation. Impact is limited to injected markup and links - the assessed vector (C:N/I:L/A:N) confirms no script execution, data confidentiality loss, or availability impact - and a publicly available exploit exists, though the EPSS score of 0.13% (2nd percentile) signals low real-world urgency, consistent with CISA's SSVC rating of no observed exploitation.
A stack-based buffer overflow (CWE-121) in the UTM Anti-Spam SBL inspection component of Juniper Networks Junos OS on SRX series firewalls lets an unauthenticated, remote attacker achieve arbitrary code execution or a denial of service by injecting a malformed DNS packet into the device's SBL lookup flow. Exploitation is gated by two real-world preconditions: the non-default UTM Anti-Spam SBL feature must be explicitly enabled, and the attacker must be positioned to inject or spoof the DNS response the device consumes (reflected by the CVSS 4.0 AT:P attack-requirements metric) - which is why the vendor's 9.2 score is tempered by our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by crafted HTTP requests when a non-default map directive with regex matching is configured so that the root directive or access log format references the map's regex capture variables before the map output variable, or when a non-cacheable variable is used in a string expression under specific conditions. The flaw is remotely reachable without authentication (CVSS PR:N) but has high attack complexity (AC:H) because exploitation depends on conditions beyond the attacker's control and on a non-default configuration; the realistic outcome on systems with ASLR enabled is worker-process restart/DoS, while code execution is limited to systems with ASLR disabled or bypassed. F5 rates this CVSS 4.0 9.2 (Critical), and no public exploit identified at time of analysis.
Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by unauthenticated remote attackers through crafted HTTP requests, but only when a non-default configuration uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable, or when $request_filename is used in an access log format directive. Successful exploitation causes a heap buffer overflow in the NGINX worker process, leading to a restart (denial of service) and potentially allowing code execution on systems with ASLR disabled or bypassable. No public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Juniper Networks Junos OS on SRX Series devices configured for AutoDiscovery VPN (ADVPN) can let an attacker who already is a trusted ADVPN peer take complete control of the device via malformed ADVPN attributes that trigger a buffer overflow. Exploitation requires the attacker either to possess the ADVPN pre-shared secret to impersonate a peer or to have compromised a legitimate peer, and the independent assessment rates this as high severity but not an emergency despite the 9.2 CVSS 4.0 score. No public exploit code or confirmed active exploitation was identified at time of analysis.
Payment verification bypass in the Tickera WordPress plugin before 3.6.0.4 allows unauthenticated remote attackers to forge payment notifications and mark arbitrary orders as paid without actually paying. The vulnerability stems from insufficient integrity checking of incoming payment callbacks and a signature that does not cover the order ID or amount, enabling tampering. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) has been reported. The independent assessment rates the integrity impact as High.
Payment bypass in WPForms Lite (versions before 2.0.2.2) allows unauthenticated visitors to submit forms that are configured to use the plugin's PayPal Commerce gateway without ever completing payment, because the plugin does not perform a server-side check that PayPal recorded a completed order before accepting the submission. The form confirmation is still delivered and notification emails are still sent even though no order exists at the payment provider and no payment is recorded, making this a business-logic integrity flaw (CVSS 5.3, I:L; no confidentiality or availability impact) rather than a system-compromise bug. Exploitation is limited to sites that have enabled the PayPal Commerce gateway on a form - forms using other gateways or no payment at all are out of scope - and while publicly available exploit code exists, there is no indication of confirmed active exploitation (not in CISA KEV).
Unauthenticated visitors can suppress all auto-inserted snippets for their own requests on WordPress sites running the WPCode plugin before 2.4.0, because the plugin enters its snippet "safe mode" without correctly verifying that the incoming request is genuinely for the login screen. The effect is confined to the attacker's own requests - snippets still execute for every other visitor and no site-wide change occurs - so per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) the result is a low-severity bypass of snippet-enforced behavior (headers, redirects, content/access controls) rather than an outage or global configuration change. Publicly available exploit code exists (WPScan advisory), and there is no CISA KEV confirmation of active exploitation, so real-world priority is modest despite WPCode's wide deployment.
Unauthenticated attackers can take over Databasus accounts, including administrator accounts, by exploiting an authentication bypass in versions 3.7.0 through 3.61.0. The flaw allows brute-forcing six-digit password reset codes via POST /api/v1/users/reset-password because the application lacks rate limiting, account lockout, and code invalidation after failed attempts. No public exploit code has been identified at time of analysis, and while the flaw is high severity, real-world priority is tempered by the product's limited deployment footprint and absence of active exploitation signals.
Unauthenticated remote attackers who can reach Dgraph Zero's administrative HTTP port (default 6080) can read cluster topology via /state, allocate identifiers via /assign, invoke the exposed /moveTablet route, or remove cluster members via /removeNode in any Dgraph deployment prior to 25.4.0, destabilizing the Zero control plane and the Alpha nodes that depend on it. The /removeNode path accepts attacker-controlled id and group values and, when group 0 is supplied, reaches Server.RemoveNode and ProposePeerRemoval, giving a caller with only network access the ability to alter cluster membership. No public exploit identified at time of analysis, but the vendor CVSS 4.0 score of 9.2 reflects a fully remote, unauthenticated, low-complexity vector (PR:N confirmed) with high integrity and availability impact, cascading to dependent Alpha nodes; the practical limiting factor is network exposure of port 6080, which is intended to sit on a trusted network.
XML injection in the Unified Threat Management daemon (utmd) of Junos OS on SRX Series devices allows an unauthenticated network attacker to push arbitrary Junos device configuration that the daemon then commits with root privileges, by serving a crafted XML response from a configured custom URL-feed server. Exploitation is not opportunistic: the SRX must be running UTM with a custom URL-category feed pointed at an attacker-influenced server, and the attacker must either control that feed server or be positioned to intercept and modify its response (a MITM), which is why the vendor's CVSS 4.0 score of 9.2 sits alongside an independent assessed vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Impact is total on exposed devices - full confidentiality, integrity and availability loss on the affected SRX - but no public exploit has been identified at time of analysis and there is no confirmed active exploitation. Treat it as a genuine high-priority issue rather than an inflated high-CVSS artifact, and prioritize any SRX running a custom URL-feed.
Remote code execution in GitPython 3.1.30 through 3.1.x allows unauthenticated attackers controlling the positional refspec argument to Remote.pull() to execute arbitrary OS commands via a crafted --upload-pack option, bypassing the library's keyword-only unsafe-option guard. The flaw affects local-path and SSH transports and is fixed in 3.2.0; no public exploit code has been identified at time of analysis, but the vulnerability carries a CVSS 4.0 base score of 9.2 and requires the calling application to pass attacker-controlled data as the positional refspec.
Denial of service against the Two-Way Active Measurement Protocol (TWAMP) client in Juniper Networks Junos OS allows an unauthenticated, network-positioned attacker to crash the rmopd service by sending a single specially crafted TCP packet. Only devices on which the TWAMP client feature is configured are exposed, since the faulty code path lives in that client; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor-scored 9.2 under CVSS 4.0) confirms no authentication, privileges, or user interaction are required once the feature is enabled, and impact is confined to availability with no confidentiality or integrity effect. No public exploit identified at time of analysis, and no CISA KEV entry accompanies this advisory; the realistic risk is driven by the non-default nature of the TWAMP configuration rather than by broad internet-scale exposure.
Unauthenticated remote attackers can trigger a use-after-free in NGINX's ngx_http_core_module when asynchronous file I/O (AIO) is enabled and a Server Side Includes (SSI) page containing 'include virtual' commands is processed, causing memory corruption or a worker process crash. This affects both NGINX Plus and NGINX Open Source, with code execution possible only on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed. Exploitation requires a non-default configuration (AIO and SSI enabled), and no public exploit code was identified at time of analysis.
Unauthenticated server-side request forgery in Kan 0.5.5 through 0.6.0 allows remote attackers to make the server issue arbitrary outbound HTTP requests through the /api/download/attatchment route by supplying a crafted url query parameter. The flaw is an incomplete fix for CVE-2026-32255 and only manifests when the S3_ENDPOINT environment variable is unset or blank - the configuration the project's own .env.example documents as the intended setup for AWS S3 - in which case hostname validation is skipped entirely and the attacker-controlled URL is handed directly to fetch(). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but EPSS/scoring data and the unauthenticated network vector (CVSS 4.0 base 9.2, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) make this a high-priority fix for exposed deployments.
Root-level code execution is possible on Juniper SRX Series devices running Junos OS, because the ipfd daemon passes externally supplied data retrieved from a configured HTTPS feed server into a formatted-output function, allowing the feed server to inject format specifiers that corrupt memory and hand the attacker code execution as root (CWE-134, CVSS 4.0 base 9.2). The flaw is unauthenticated with no user interaction (PR:N/UI:N), but the CVSS 4.0 vector carries AT:P because two prerequisites must hold: the SRX device must actually be configured to consume an HTTPS feed source, and the attacker must either compromise or impersonate that feed server, which is why the independent assessment maps the issue to CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H rather than treating it as a default-configuration remote takeover. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, so a default, feed-less SRX configuration is not directly reachable by arbitrary internet attackers; the risk concentrates on deployments that actively pull external feeds.
Remote code execution as root in Juniper Networks Junos OS on SRX Series allows unauthenticated network-based attackers to execute arbitrary code via a SQL injection flaw in the ipfd process, but exploitation requires that the SRX device be configured with a Security Intelligence (SecIntel) feed connection. This high-severity vulnerability (CVSS 4.0 base score 9.2) has no public exploit identified at time of analysis. Devices without SecIntel configured are not exposed.
Remote unauthenticated attackers can retrieve confidential PDF invoices from Copart's Online Billing Service because the endpoint that serves those documents performs no authorization check, exposing customer names, addresses, invoice numbers, payment details and tax information. Exploitation is made easier by invoice document URLs that are publicly indexed by search engines and by predictable invoice identifiers, which allow an attacker to enumerate and pull additional files beyond any single leaked link. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, but the CVSS 4.0 base score of 9.2 (Critical) reflects a fully remote, low-complexity, unauthenticated vector with high confidentiality impact on both the vulnerable service and a subsequent system.
Arbitrary shortcode execution in Click to Chat for WhatsApp plugin versions up to and including 4.44 allows unauthenticated remote attackers to run registered WordPress shortcodes by injecting delimiters into the URL of an archive page, which is substituted into the {url} greeting placeholder and then passed to do_shortcode() without sanitization. Exploitation depends on a non-default configuration: the greetings feature must be active and rendering greetings-1 or greetings-2 templates on archive pages with the {url} placeholder present, and meaningful impact requires a dangerous shortcode from WordPress core, the active theme, or another plugin. The CVE assigns a 9.1 base score (AC:L), but our independent assessment sets attack complexity to High (AC:H); no public exploit code or active exploitation has been identified at time of analysis.
OS command injection in Runnerty's @runnerty/executor-decompress package (all versions through 3.1.1) lets an attacker who can control the name of an archive file processed by a compress_file/decompress task execute arbitrary shell commands with the privileges of the Runnerty process. The package builds shell command strings from templates that interpolate the archive filename and then hands them to shelljs exec(), so a filename containing $() command substitution or unquoted shell metacharacters - for example one dropped into a watched or ingested directory - is interpreted by the shell instead of being treated as a literal path. Exploitation requires low-privileged access sufficient to name files in that directory (PR:L) and no user interaction; impact to confidentiality, integrity, and availability is high but is bounded to the Runnerty process's privilege level, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authentication bypass in Zulip Server through 12.1 can log an attacker into an existing user account when OIDC single sign-on is configured with a misconfigured identity provider. The GenericOpenIdConnectBackend matches the IdP's email claim against an active account's delivery_email without rejecting an explicit email_verified=false, so a user who does not control that address can be authenticated as the account that owns it. Exploitation requires OIDC SSO to be enabled, a trusted IdP that emits email addresses the authenticating user does not control, and a pre-existing account whose delivery_email matches that address; deployments whose IdP only emits user-controlled addresses are explicitly not affected. The vendor fixed the flaw in Zulip Server 12.2, unauthenticated remote exploitation is rated Critical (CVSS 4.0 9.1, AT:P), and no public exploit has been identified at time of analysis.
Authentication bypass in Better Auth's OAuth Proxy plugin (versions 1.5.0-beta.12 through 1.7.6) lets unauthenticated remote attackers sign in as arbitrary users by forging encrypted profile state when the plugin is deployed with a shared global secret and cookie-stored OAuth state, abusing implicit account linking against a victim's verified email to seize the account. The vendor rates the flaw 9.1 (CVSS 4.0) with high attack complexity and a present attack requirement because exploitation depends on that specific shared-secret/cookie-state configuration rather than a default install; no public exploit code has been identified at time of analysis and there is no CISA KEV entry. Priority risk is therefore concentrated on deployments that have enabled the OAuth Proxy plugin in that exact configuration; upgrading to 1.7.7 or later closes the bypass.
Administrative account takeover in the Hitachi Vantara application is possible when password reset and email delivery are enabled, because reset-code attempts are not rate limited, allowing unauthenticated attackers to brute-force reset codes. The CVSS 4.0 score is 9.1 (Critical), but an independent assessment uses CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N because exploitation depends on the reset flow being active and email configured; impact is bounded to application administration functions and does not expose device credentials or customer data. No public exploit code or CISA KEV entry was identified in the provided data.
Eclipse Vert.x's HTTP client (io.vertx:vertx-core) caches SSL contexts using a cache key that does not fully capture the SSL semantics of the requested properties, so a caller asking for a context with hostname/endpoint-identification validation can be handed a cached context that silently ignores it - a TLS trust-decision failure affecting versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0. The issue is unauthenticated (CVSS vector PR:N/UI:N) but rated high attack complexity because exploitation additionally requires the application to create multiple SSL contexts with differing security properties and an attacker to hold a man-in-the-middle network position to abuse the resulting loss of certificate verification. There is no public exploit identified at time of analysis and no CISA KEV listing; the advisory-driven CVSS 4.0 score is 9.1, while the independent v3.1 assessment rates it lower (High, ~7.4) with AC:H, reflecting the configuration-dependent and MITM-gated prerequisites.
Unauthenticated remote attackers can mint valid JWT access tokens - and thereby log in as an administrator - on affected Hitachi Vantara deployments by abusing the private key shipped inside the product's default self-signed SSL certificate (CWE-321, hard-coded cryptographic key). Exploitation is gated by a single configuration precondition: the web interface must still be running the out-of-the-box default certificate whose key material is reused to sign session JWTs, which is why the vendor's CVSS 4.0 vector carries AT:P (attack requirements present) even though no authentication or user interaction is needed (PR:N/UI:N). Impact is bounded to administrative/configuration control such as changing service settings or requesting log collection - the vendor states device credentials and customer data are not reachable - and no public exploit was identified at time of analysis (the issue is not in CISA KEV).
OS command injection in the Koha integrated library system lets an authenticated staff account holding the tools => schedule_tasks permission execute arbitrary operating-system commands as the Koha web/application user. The flaw lives in the tools/scheduler.pl handler: an op=cud-delete request passes the unvalidated jobid parameter into C4::Scheduler::remove_at_job, which hands it to Schedule::At::remove, where the value is spliced into an atrm command string and run through a single-argument system() call that invokes the shell - so shell metacharacters in jobid become executable commands. Per the CVSS vector the attack is network-reachable with low privileges required (PR:L) and no user interaction (UI:N), scoring 8.8, but it is strictly post-authentication and gated by a deliberately granted staff capability; no public exploit code has been identified at time of analysis and there is no CISA KEV listing. Vendor fixes are available in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04.
Command injection in Dokku before 0.38.25 allows a user with authenticated app-level Dokku access and remote SSH access to store shell-substitution payloads through the docker-options plugin, and also via dokku run -e/--env values and --ttl-seconds; on the next build, deploy, or run, Bash eval interprets the stored value and executes arbitrary commands as the dokku OS user. Exploitation is privilege-gated, requiring valid app-level credentials and SSH access rather than being remote-unauthenticated, and no public exploit was identified at time of analysis despite the CVSS 9.0 severity.
Dell Terraform Provider for Redfish versions before 1.6.2 exposes Redfish BMC traffic, including credentials, to man-in-the-middle interception because TLS certificate verification is unconditionally disabled in its base HTTP transport. This critical-severity flaw (CVSS 9.0) allows an unauthenticated remote attacker who occupies a MITM position to capture or alter sensitive Redfish API communications, though exploitation is condition-gated to active provider-to-BMC traffic windows and is materially lower risk on trusted, isolated management segments. No public exploit identified at time of analysis; Dell recommends upgrading to 1.6.2.
Renovate before 44.60.1 on self-hosted instances lets an attacker with a legitimate foothold (PR:L in the assessed vector, i.e., control of a repository or externally sourced preset the instance already extends) bypass the restricted environment-variable allowlist by embedding an env block inside a shared preset, overriding variables such as PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes. Because those variables govern dynamic library loading, runtime module resolution, command lookup, and TLS trust stores, a successful bypass can escalate from a poisoned preset into arbitrary code execution or credential and traffic interception inside the Renovate execution context. The exposure is narrow but severe for the population it touches - self-hosted deployments that extend third-party or community presets while treating allowedEnv as a security boundary - and no public exploit identified at time of analysis; the record carries no KEV status or EPSS score.
Command injection in the NetBird desktop client (versions 0.60.0 through 0.74.6) lets a malicious or compromised peer inject arbitrary OpenSSH directives - including command-executing ones - into the system-wide drop-in config of other clients' Linux, macOS, Windows and FreeBSD hosts. Exploitation requires the attacker to control an enrolled peer whose crafted FQDN or hostname containing a double quote is distributed to the victim, and the injected command runs only when a local user subsequently invokes ssh, so peer membership plus a local user action are both prerequisites rather than an unauthenticated internet-facing attack. NetBird 0.74.7 fixes the issue by rejecting peer names that are not valid DNS names; no public exploit identified at time of analysis, and the Android and iOS apps are not affected.