Code execution is possible in Epic Games Unreal Engine builds up to and including 5.8.0 on Windows because the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL) ships with an empty FURLRequestFilter, allowing every URL scheme - including file:/// - to pass through to ShellExecuteW() with the open verb, which executes the referenced file. The issue is reachable only in titles that ingest user-generated content containing Blueprints: the attacker must supply a malicious file locally or via a WebDAV share and the victim must load or interact with that content (unauthenticated remote/local attacker, CVSS 3.1 base 7.7, AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). No public exploit code has been identified at time of analysis; real-world risk is conditionally gated by the Windows-only dependency, the requirement that a game actually loads third-party Blueprints, mandatory user interaction, and high attack complexity.
Account pre-hijacking in the Prowler API (5.4.0 up to but not including 5.35.0) lets an unauthenticated remote attacker gain persistent control of a user account that has not yet registered, by self-registering the victim's email address before the real owner ever signs up or links single sign-on. Because social account linking in ProwlerSocialAccountAdapter.pre_social_login() matches a Google or GitHub login to any existing local account with the same email address without requiring the address to be verified by the provider or on the local account, the genuine owner's later social sign-in is silently connected to the attacker's pre-created account, and the attacker's original password remains valid, exposing cloud provider credentials, scan findings and tenant memberships held in that account. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, though exploitation requires only open self-registration plus a victim who later authenticates through Google or GitHub (a race condition that closes once the legitimate owner has an account). The source assigns CVSS 4.0 7.6 (HIGH); our independent assessment scores it CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N.
Authenticated code execution in n8n (before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1) is possible through the Git node's Log operation, which invokes the external git program without stripping the target repository's local git configuration first. A member-level authenticated user who can point that node - including the scenario where the Git node is exposed as an agent tool the attacker can steer - at a repository whose local config they control can smuggle configuration directives that cause git to launch arbitrary programs as the n8n process user. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the CVSS 4.0 base score is 7.7, and the independent assessment rates it CVSS 3.1 8.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), with exploitation gated on valid n8n member credentials and attacker control of the repository's local configuration.
Prototype pollution in n8n's MCP workflow-validation tool allows an authenticated user holding only a workflow:read grant to escalate privileges and take over owner accounts that are not protected by MFA. The flaw affects n8n versions before 2.41.4 and 2.42.x before 2.42.1, and exploitation requires that the MCP validation feature be enabled and reachable so its interpreter can evaluate caller-supplied code in the main process. No public exploit code was identified at time of analysis, and the attack chain - polluting a shared prototype to replace a built-in method that server-side permission checks rely on - is a genuine privilege-escalation priority for exposed instances rather than an internet-wide emergency, since valid low-privilege authentication, feature availability, and the absence of MFA on the target owner account are all prerequisites.
Authenticated low-privileged users on multi-user Papermerge Core deployments can manipulate documents they do not own: the page management endpoints (/pages/, /pages/move, /pages/extract) and the OCR task endpoint (/tasks/ocr) skip the has_node_perm authorization check, letting an attacker rotate, delete, move, or extract another user's pages and queue OCR jobs against them. Exploitation requires a valid account plus out-of-band knowledge of the victim's random 128-bit page UUIDs, so it is a genuine but moderate-priority access-control failure rather than an internet-wide emergency; a patch commit has been published upstream, though a tagged release containing it was not independently confirmed, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-tenant access control bypass in InvoiceShelf prior to 2.4.0 lets an authenticated staff user holding only ordinary 'view notes' or 'manage notes' permissions read, modify, or delete another company's reusable invoice, estimate, and payment note templates by supplying a sequential note ID belonging to that tenant. The flaw is a classic insecure direct object reference (CWE-639) - the route-bound Note object is never handed to NotePolicy::viewNotes/manageNotes, so the policy checks only the generic ability and never validates the note's company_id, and the Note model carries no global company scope. Authentication is required (CVSS PR:L) and impact is confined to note templates rather than full financial records, but note IDs are sequential so enumeration is trivial; no public exploit code has been identified at time of analysis, and the vendor has released a fixed version (2.4.0).
Improper authentication in the SAML SSO identity-linking flow of self-hosted Sentry 26.5.0 through 26.7.1 lets an attacker who controls a SAML identity provider trick an already-authenticated user into opening a crafted URL, link the attacker's federated identity to that user's Sentry account, and achieve full account takeover (CVSS 4.0 base 7.6, High; independent assessment CVSS 3.1 7.6 with C:H/I:H). Exploitation is constrained by two prerequisites: the victim's browser must accept the cross-site cookie context (Firefox sending SameSite=None cookies, or Chromium with third-party cookies explicitly enabled, which is not the Chromium default), and the target deployment must have SAML SSO configured, so the realistically reachable population is narrower than the raw score suggests. Sentry SaaS was remediated on July 27, 2026 and is not affected; self-hosted instances are fixed in 26.7.2, and no public exploit code was identified at time of analysis.
Unbounded HTTP request-body buffering in the Model Context Protocol Python SDK (the 'mcp' package) before 1.29.1 and in 2.0.0a1 through 2.0.1 allows unauthenticated remote attackers who can reach an exposed HTTP transport endpoint to exhaust server memory and potentially terminate the process. The Streamable HTTP session manager, the SSE message endpoint, and the OAuth authorization-server routes read complete request bodies without any maximum-size check, so a single large declared or streamed body can consume multiple times its own size in process memory and repeated requests can drive sustained memory pressure. Per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) the impact is availability-only, and no public exploit code was identified at time of analysis; stdio-only servers and deployments behind an effective upstream request-size limit are not affected. This is a genuine but bounded-priority availability issue - the fix is a vendor-released patch in 1.29.1 and 2.1.0 that enforces a 4 MiB default body cap and returns HTTP 413, and the primary residual exposure is default HTTP deployments with no reverse-proxy or gateway body limit.
Local file inclusion in the LifterLMS WordPress plugin (up to and including 10.3.1) lets an authenticated attacker with Instructor-level access or above include and execute arbitrary files on the server by manipulating the 'template_name' and 'default_path' attributes of the [lifterlms_checkout] shortcode. The flaw causes llms_get_template() to overwrite its own local parameters via extract(), redirecting a PHP include to an attacker-chosen path, which can bypass access controls, expose sensitive data, and potentially achieve code execution where attacker-controlled content has been uploaded under an allowed file extension. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis; the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) reflects that Instructor+ authentication and, for full RCE, a successful upload are required prerequisites.
Unbounded HTTP request-body buffering in the Model Context Protocol (MCP) Java SDK lets an unauthenticated remote client exhaust the JVM heap and render an MCP server unavailable. The flaw affects the Servlet-based SSE, Streamable HTTP, and Stateless server transports in io.modelcontextprotocol.sdk:mcp 0.8.0-0.12.0, mcp-core 0.13.0-0.18.3, 1.0.0-1.1.3, and 2.0.0-M1-2.0.0; a client simply streams an arbitrarily large POST body (including via chunked transfer encoding) until OutOfMemory conditions make the process unresponsive. Rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affecting availability only, the impact is materially reduced for deployments that require authentication, enforce Origin/Host validation, or sit behind a reverse proxy, load balancer, or API gateway with a maximum-body-size limit, all of which reject the oversized request before the vulnerable read; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Privilege escalation in the Bit Integrations - Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress (all versions up to and including 2.10.6) allows unauthenticated attackers to overwrite an administrator's password and take over the admin account. The plugin stores raw, attacker-controlled field values - including user_pass and user_email - verbatim into wp_btcbi_log.field_data on anonymous front-end requests with no capability check, and when an administrator clicks 'Re-execute' on the resulting failure log row, the stored payload is replayed inside that administrator's session and written to the administrator's own user record. Exploitation is not automatic: it requires a non-default configuration in which an administrator has mapped a user-supplied form field to the user_pass parameter of the WP User Registration 'Update User' action, plus the manual Re-execute click (CVSS 3.1 AV:N/AC:H/PR:N/UI:R), so an anonymous remote attacker can plant the payload but cannot complete the escalation alone; no public exploit code was identified at time of analysis.
Unauthenticated PII disclosure in the Booking Package WordPress plugin through version 1.7.29 lets remote attackers retrieve the booking_package_booked_customers table, exposing customer names, email addresses, phone numbers, physical addresses, and cancellation tokens. The endpoint's only nominal protection is a nonce that the plugin emits in the public booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, so any visitor can harvest it and call the unauthorized retrieval path; no authentication, user interaction, or special configuration is required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No CISA KEV listing was provided, and no public exploit identified at time of analysis, and the assessed impact is confidentiality-only (I:N/A:N), making this an actionable priority for sites actively using the plugin but not a top-tier emergency.
Unauthenticated information disclosure in the FOG imaging/cloning suite (all versions prior to 1.5.10.1870) allows a remote requester to retrieve the configured default Active Directory domain-join password by dispatching the management adInfo() endpoint through node=ipxe, which was reachable without an authenticated session and returns the credential in the domainpass JSON field. Exploitation requires only network reachability to the FOG web interface plus the operator-side condition that a FOG_AD_DEFAULT_PASSWORD value has been configured for automatic AD domain joins; if no default AD password is set, the endpoint discloses nothing sensitive. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the disclosure of a reusable domain-join credential carries high confidentiality impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Malformed CCSDS telecommand frames cause assertion-driven denial of service in NASA's F´ (F Prime) flight-software framework prior to version 4.2.0 by aborting or resetting the flight-software process. In affected topologies, a frame that leaves a payload of six bytes or fewer after the TcDeframer strips its TC header and trailer reaches Svc::Ccsds::SpacePacketDeframer::dataIn_handler, which enforces the minimum packet-length condition with FW_ASSERT instead of rejecting and returning the buffer; the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) reflects high availability impact with no confidentiality or integrity loss and no authentication or user interaction required within the framework. No public exploit code or active exploitation has been identified at time of analysis, and the principal practical limitation is that the attacker must be able to inject frames onto the spacecraft telecommand uplink or command/data-link path, which is not generally internet-exposed; the issue is fixed in 4.2.0.
Discourse forums with the non-default 'secure uploads' feature enabled could keep serving media and attachments to anonymous visitors after the owning category was made read-restricted, because per-upload security metadata was never reconciled when a category's read_restricted flag flipped or when category permissions changed during a bulk import. Only uploads that were posted while the category was still public are exposed - including uploads attached to topics that were later deleted - and they remain reachable through their short upload URLs, which an attacker must know or enumerate; the vendor's reported CVSS 3.1 base of 7.5 reflects network, unauthenticated, no-interaction access, although our assessment raises complexity to High (AC:H) because both a specific non-default configuration and a triggering permission event are required. The issue is fixed in 2026.9.0, 2026.8.1, 2026.7.3 and 2026.1.9, and no public exploit was identified at time of analysis.
Unauthenticated information disclosure in the LatePoint appointment booking and scheduling plugin for WordPress (versions up to and including 5.7.3) lets any remote attacker read other customers' appointment records and pending cart contents by supplying sequential booking[id] and cart[id] values to the public steps__reload_booking_form_summary_panel and steps__start routes, which are reachable without login through wp_ajax_nopriv_latepoint_route_call. No ownership check is applied to those identifiers, so enumeration is trivial and requires no authentication, no user interaction and no special configuration beyond having the plugin active with live booking or cart data; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) confirms remote unauthenticated exploitation with confidentiality-only impact, and the readiness of sequential integer keys makes the practical barrier to exploitation very low. No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and EPSS data was not available in the supplied intelligence; the assessment is that this is a genuine, easily reproducible read-only disclosure rather than an inflated high-severity score.
Malformed inter-processor hub traffic can abort or reset NASA's F´ (F Prime) flight-software process in versions prior to 4.2.0, because the Svc::GenericHub receive handler treats externally supplied deserialization results as invariants and aborts via FW_ASSERT when they fail. An unauthenticated remote peer on a hub link (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) can send a truncated buffer, a HubType value at or above HUB_TYPE_MAX, or a header-only command-dispatch payload to trigger the fault, producing availability-only impact. The vendor has released 4.2.0 with hardened bounds and type checks; no public exploit code has been identified at time of analysis, and the issue is confined to deployments that genuinely instantiate GenericHub and expose its link to untrusted or spoofable peers.
Unauthenticated time-based blind SQL injection in the Gmedia Photo Gallery plugin for WordPress, affecting all versions up to and including 1.25.1, lets any remote attacker append arbitrary SQL to the plugin's existing query through the 'gmedia__in' parameter and extract sensitive data from the site's database. The plugin's mobile-app endpoint dispatches the 'library' action without validating the Mobile App feature flag, a nonce, or any WordPress authentication, so no account or session of any kind is required, matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5). Impact is confidentiality-only and exploitation is blind and time-based, so extraction is slower and noisier than an error-based injection; no public exploit code and no confirmed active exploitation were identified at time of analysis.
User enumeration and credential-verification flaws in Omada Controller MSP mode allow an authenticated attacker to validate credentials for other accounts by manipulating the Identifier parameter, potentially leading to unauthorized access to MSP resources or account compromise. Exploitation requires the controller to be running in MSP mode, an existing authenticated session, and knowledge of the target account's Identifier; no public exploit code or active exploitation has been identified at time of analysis. The issue is rated moderate priority due to these prerequisites and the oracle-based nature of the leak, as the endpoint returns distinguishable responses for nonexistent users, invalid passwords, and successful authentication.
Blind SQL injection in the 10Web Form Maker WordPress plugin (all versions up to and including 1.15.48) lets unauthenticated remote attackers append additional SQL to queries built from the 'inputs' parameter, allowing them to extract sensitive information from the site's database. The plugin's nonce check offers no real protection because the required nonce is emitted into the HTML source of every public page that renders a form, so the only practical prerequisite is that a Form Maker form be reachable by an anonymous visitor - the normal way a contact-form plugin is deployed. CVSS is 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only), no public exploit code has been identified at time of analysis, and the issue should still be treated as high priority given how trivially the vulnerable handler can be reached.
Unauthenticated attackers can inject SQL into the JTL-Connector for WooCommerce WordPress plugin (all versions up to and including 2.4.3) through the 'product.push' identity-linking endpoint, allowing blind, time-based extraction of data from the site's WordPress database. The flaw requires no credentials, no user interaction and no non-default configuration - only that the plugin is installed and its connector endpoint is reachable, which is its normal operating mode for JTL ERP synchronisation - and it fires during identity linking before ProductController::push() runs, so downstream validation never gets a chance to reject the request. Impact is limited to data disclosure (CVSS 7.5, C:H/I:N/A:N) and exploitation is slower than direct extraction because it relies on time-based inference, but it is fully automatable; no public exploit code was identified at time of analysis and there is no CISA KEV telemetry for this CVE. Overall this is a credible, high-priority issue for the narrow population of sites actually running the JTL-WooCommerce bridge.
Unauthenticated remote attackers can render PgBouncer 1.20.0 through 1.26.0 unresponsive by sending a single crafted StartupMessage whose options parameter contains an empty parameter name (for example "-c="), which makes the server's ignore_startup_parameters lookup loop indefinitely during the pre-authentication startup phase. Because PgBouncer serves every client from a single process, the loop pins a CPU core and stalls all connection pools until an administrator manually restarts the daemon, so a lone packet from any TCP-reachable source can take down the entire pooler. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the issue is network-reachable with low complexity, requires no credentials or user interaction, and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflecting its availability-only impact.
Authentication bypass via capture-replay in Progress MOVEit Transfer's OIDC module allows a remote unauthenticated attacker (CVSS PR:N) to replay captured OpenID Connect authentication material and impersonate a legitimate user, but only when OIDC SSO is configured and a real user completes an authentication (UI:R, AC:H). Affected versions are MOVEit Transfer before 2025.1.6 and 2026.0.0 through 2026.0.3; instances using other authentication methods are not exposed to this specific flaw. No public exploit identified at time of analysis.
Unauthenticated SQL injection in Abandoned Cart Pro for WooCommerce (all versions up to and including 10.8.0) allows remote attackers to extract sensitive information from a WordPress site's database by forging the plugin's encrypted 'validate' parameter. The parameter is protected with AES-CTR, a malleable stream cipher, so an attacker who abandons a cart using an email address they control can harvest one legitimate token, recover the keystream, and re-encrypt arbitrary SQL; the HMAC integrity check introduced in 10.4.1 is enforced only when the wcap_nonce parameter is present, and omitting that parameter skips the check entirely. CVSS 3.1 scores this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting unauthenticated, remote, confidentiality-only impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, though the attack requires only a token-harvest and keystream-recovery step rather than a one-shot injection.
Denial of service in NASA's F´ (F Prime) framework prior to 4.2.0 allows remote attackers to abort or reset the flight software process by delivering a file-uplink packet whose file-packet type byte falls outside the valid Type enum, driving Fw::FilePacket deserialization into an unvalidated FW_ASSERT (CWE-617). The impact is availability-only, matching the assessed CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity loss, and the practical limiting factor is reachability: the malicious packet must traverse the Svc::FileUplink file-packet path, which in spaceflight deployments is the ground-to-vehicle uplink. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has released a fix in F Prime 4.2.0.
Cookie header leakage in cpp-httplib before 0.51.0 causes session cookies to be forwarded to a different origin when the library's client follows a cross-origin 301, 302, 307, or 308 redirect. Remote attackers who control the redirect response - or who occupy a network man-in-the-middle position against a plaintext HTTP origin - can capture cookies intended for the original origin, with confidentiality-only impact rated CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exploitation requires the consuming application to enable set_follow_location(true) and to supply cookies directly or via default_headers_, so unauthenticated remote attackers, not authenticated local users, drive the vector, and there is no public exploit identified at time of analysis.
Privilege escalation in the Membership & User Roles for WooCommerce (Automatic Role Changer) plugin through version 20260828 lets an authenticated subscriber-level user re-acquire a previously revoked Administrator role and take full administrative control of the WordPress site. The flaw is reachable when the plugin is configured in Replace Roles mode and the attacker's account previously legitimately held Administrator while the plugin was active, because that role stays cached in the dfxwcrc_foreign_roles user meta and is re-applied whenever a role-assignment event fires, such as completing a purchase for a role-mapped product. Wordfence reported the issue (CVSS 7.5, CWE-269) and no public exploit code was identified at the time of analysis; the stacked preconditions - former legitimate admin, stale cache, Replace Roles mode - materially limit real-world exploitation, and only former privileged users, not arbitrary subscribers, can abuse it.
Code injection in the VillaTheme 'Email Template Customizer for WooCommerce' WordPress plugin, affecting versions up to and including 1.3.4, lets an attacker influence the content/code generated by the plugin's email template handling, carrying a high confidentiality impact (C:H) with low integrity impact in our assessment. The supplied advisory vector claims unauthenticated, no-interaction exploitation (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5), but our independent assessment revises this to PR:L (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), meaning a privilege prerequisite cannot be ruled out and the unauthenticated claim is unverified. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied; exposure is limited to WordPress sites running WooCommerce with this specific plugin active.
Code injection in the VillaTheme Salevo WooCommerce plugin for WordPress (woo-boost-sales) affects all releases through 1.3.0 and lets a remote attacker reach a code-generation sink within the plugin, with the assessor's scoring indicating high impact to confidentiality, integrity and availability. The underlying vulnerability class is CWE-94 (Improper Control of Generation of Code), and the Patchstack advisory tags the issue as potential remote code execution; there is no confirmed actively exploited status (not in CISA KEV) and no public exploit code identified at time of analysis. Exploitation requires the plugin to be installed and active on a WooCommerce site, which meaningfully narrows the realistic attack surface; the exact vulnerable function, endpoint or parameter is not disclosed, and the published CVSS vector (PR:N) conflicts with the assessor's vector (PR:L), so the precise authentication precondition is not fully resolved from available data.
An integer overflow in list allocation inside the Nix expression evaluator - and in the Lix fork - can drive an out-of-bounds write when an attacker-supplied Nix expression is evaluated, allowing memory corruption in the evaluating process. Only Nix before 2.35.3 and Lix before 2.95.4 are affected, and the flaw is remotely reachable and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L, base 7.5), though the high attack complexity means allocation sizes must be crafted precisely. Our assessment is consistent with a memory-corruption primitive rather than a trivial crash - high integrity impact, low availability impact, no confidentiality impact; no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Improper access control in TP-Link Omada Controller's MSP and OpenAPI certificate/private-key management APIs allows an authenticated user to perform privileged certificate operations - uploading or deleting the controller's TLS certificate or private key - which can disrupt secure management access to the controller. The description states a low-privileged authenticated account is sufficient, although the supplied CVSS 4.0 vector (7.5) specifies PR:H; an independent assessment captures the lower-privilege reading as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, i.e. network-reachable, no user interaction, no confidentiality impact, and high integrity and availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis (no KEV listing and no EPSS score were provided), so exploitation requires a valid controller account plus network reachability to the affected MSP or OpenAPI endpoints.
Denial of service in the Linux kernel networking stack: a stale transport_header left behind after tunnel decapsulation makes qdisc_pkt_len_segs_init() compute a negative transport offset, which is cast to unsigned and turns into an out-of-bounds read of the skb, crashing the host (availability impact only, no code execution or data exposure). Reachability is narrow: the machine must decapsulate GSO-marked tunnel traffic and then forward the inner frame at layer 2 through a bridge or HSR rather than handing it to the local IP stack, and the flaw only exists in kernels carrying commit 7fb4c1967011. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, meaning unauthenticated remote traffic can trigger it but the confluence of preconditions makes exploitation complex; EPSS is 0.21% (10th percentile) and no public exploit identified at time of analysis.
Autodesk's ADP Desktop SDK transmits sensitive Autodesk service credentials and tokens over an unencrypted channel (CWE-319), allowing anyone able to observe that traffic to capture the secrets and use them for unauthorized access to Autodesk services. The published CVSS 3.1 vector (7.5) is AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, which describes a constrained scenario - local positioning, high attack complexity, some existing privileges, and a legitimate user triggering the SDK operation - while our independent assessment (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) models an on-path observer on an adjacent network with confidentiality-only impact; either reading requires the attacker to already be positioned to observe the cleartext transmission. Exploitation is limited to loss of confidentiality of transmitted secrets, not code execution or integrity compromise, and there is no public exploit identified at time of analysis; a vendor patch is available per the Autodesk advisory.
Authenticated users on Discourse sites running the bundled Chat plugin can receive live and recent private-category channel messages they are not entitled to see, because the MessageBus publication audience for a read-restricted category channel is bounded by category visibility alone and never verifies Chat eligibility under the site's group restrictions (CWE-862 missing authorization). Only sites where chat is enabled, a chat channel is attached to a read-restricted category, and chat_allowed_groups are configured such that a user may view the category while being excluded from Chat are affected; exploitation requires a valid authenticated account with category-view access, which the assessed vector reflects (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Disclosure is confined to messages flowing through the MessageBus stream and its short backlog - the Chat API does not expose full channel history, and no message creation or modification is possible - making this a moderate confidentiality-only issue with no public exploit identified at time of analysis.
Remote, unauthenticated code execution is possible in the HPE NonStop SNMP Trap Multiplexer, which processes inbound SNMP trap messages on the HPE NonStop platform. An attacker who can reach the trap-receiving interface can deliver a crafted trap that overflows a stack buffer (CWE-121); our independent assessment rates the full impact as high for confidentiality, integrity and availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), whereas the vendor-published 7.5 vector reflects only an availability impact (C:N/I:N/A:H) - a conflict that must be reconciled with HPE before prioritization. Exploitation requires network reachability to the trap listener and no credentials, privileges, or user interaction (PR:N/UI:N); no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV. Exposure is confined to the specialized population running HPE NonStop with this multiplexer deployed - typically banking, telecom and transaction-processing environments - which limits the scale but not the severity of a successful attack.
Missing authorization in the Crocoblock JetFormBuilder WordPress plugin through version 3.6.6 allows unauthenticated network attackers to reach an improperly access-controlled endpoint, with the assessed impact being availability-only (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Per the independent assessment, exploitation requires a site with an affected version where the specific vulnerable plugin action is reachable, and no public exploit was identified at time of analysis. Signals are mixed and point to a moderate, not top-tier, priority.
Customer account takeover in the Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress through 5.7.2 is possible on sites that enable the 'Use WordPress users as customers' option: an authenticated Subscriber-level attacker whose own user_login equals a victim customer's email address causes their WordPress user ID to be linked into that victim's LatePoint customer row, exposing the victim's bookings, services, agents and calendar data and overwriting the victim's email address the next time the victim logs in. Exploitation is tightly conditional - it requires the opt-in WordPress-user integration, a Subscriber account (commonly obtainable when open registration is enabled), and prior knowledge of the target's email address, so the attack is per-victim and targeted rather than mass-exploitable; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided in the source data. The flaw has been assigned CVSS 7.4 with high confidentiality and integrity impact but no availability impact, and a fix appears to have shipped in the 5.7.3 release.
An authenticated administrator on Hitachi Vantara can retrieve password reset codes for arbitrary users through a privileged API, enabling takeover of other accounts on the application. This CWE-640 weakness is rated 7.4 High by CVSS 4.0 and requires high privileges (PR:H per the CVSS vector), so exploitation is confined to malicious insiders or attackers who already possess administrator access; device credentials and customer data remain inaccessible per the vendor. No public exploit identified at time of analysis.
Unauthenticated administrative account takeover in FileRise versions prior to 3.16.0: because the application treats an empty or missing users.txt as a fresh installation, a remote caller with no credentials can detect that first-run setup has silently reopened and create the next initial administrator account through the setup flow. The empty-user-store condition must first arise from storage loss, truncation, or another failure after setup previously completed (hence the AC:H rating), so reliably-stored, intact installations are not exposed; once that state exists, exploitation requires no authentication and no user interaction (PR:N/UI:N) and yields high confidentiality and integrity impact (CVSS 7.4). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the flaw is trivially reproducible by anyone who notices the exposed setup page.
Privilege escalation in Google Cloud Application Integration (versions prior to 2026-08-27) allows an authenticated low-privilege user within a Google Cloud project to abuse AuthConfig validation and the integration execution runtime to impersonate a higher-privileged service account and gain that account's cloud permissions. The flaw is classified as Incorrect Authorization (CWE-863) with a CVSS v4.0 base score of 7.3; there is no public exploit identified at time of analysis and no CISA KEV listing. Google remediated the issue server-side on 27 August 2026, so current Google Cloud instances are no longer affected and no customer patching action is required.
Memory corruption in NASA's F´ (F Prime) FpySequencer component, affecting framework versions prior to 4.2.0, lets an authenticated high-privilege actor who can load and execute flight sequences bypass the sequencer's stack write bounds check via a U32 integer wraparound in a STORE directive, so memcpy writes outside the sequencer stack and can cause denial of service, memory corruption, and potentially code execution. It is rated CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) because the malicious sequence must be supplied and run - typically requiring trusted commanding, uplink, or ground-system authority - making it an access-gated risk rather than an unauthenticated mass-exploitation threat. No public exploit has been identified at time of analysis, there is no CISA KEV entry, and the vendor released a fixed version (4.2.0).
Session hijacking in the VideoWhisper Broadcast Live Video WordPress plugin (up to version 7.3.2) is enabled by a session fixation flaw (CWE-384), allowing remote attackers to take over authenticated sessions, but only if a victim logs in while an attacker-controlled session ID is active (UI:R per independent assessment). No public exploit code exists and no active exploitation is confirmed (not in CISA KEV). The published CVSS 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) overstates the required user interaction and availability impact; the assessed vector is AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N.
Markdown Preview Enhanced, the VS Code Markdown preview extension, fails to validate webview-to-extension-host messages prior to version 0.8.30: the handler in src/preview-provider.ts accepts any attacker-supplied _crossnote.{command} plus arbitrary args and forwards it to vscode.commands.executeCommand with no allowlist or type checking. JavaScript already running inside the preview webview - obtainable via the separately tracked .crossnote/head.html script-injection flaw (GHSA-mcwg-4j78-qwv3) - can therefore invoke privileged extension commands such as updateMarkdown, chromeExport, pandocExport, and runCodeChunk with attacker-selected arguments, enabling file writes, code-chunk execution, export-tool execution, and arbitrary URL opening within the victim's workspace context. Exploitation is conditional rather than standalone: it requires a pre-existing webview JavaScript execution primitive and a victim who opens and previews attacker-controlled repository content, and no public exploit code has been identified at time of analysis; both the bridge-abuse bug and its most practical trigger are resolved in 0.8.30.
Insecure storage of sensitive information in Progress MOVEit Transfer allows an authenticated low-privilege local user to recover confidential material - most plausibly stored credentials, keys, or configuration secrets - from the MOVEit Transfer host, as reflected by the assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:R/C:H, which requires local presence, a valid account, and user interaction. Affected builds are MOVEit Transfer before 2025.1.6 and 2026.0.0 through 2026.0.3, with remediation in 2025.1.6 and 2026.0.4 per the Progress September 2026 security bulletin. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); note that the authoritative independent assessment rates the impact as confidentiality-only (C:H/I:N/A:N), not the integrity and availability impact implied by the 7.3 base score in the raw feed.
PHP Object Injection in the Post Export Import with Media WordPress plugin (versions ≤1.17.1) allows authenticated administrators to inject arbitrary PHP objects via deserialization of untrusted input, but the flaw has no impact unless a separate plugin or theme provides a usable POP gadget chain. If such a chain exists, the attacker could delete files, retrieve sensitive data, or execute code. No public exploit code has been identified, and the issue is considered conditional and lower-priority despite the 7.2 CVSS score.
Authenticated attackers with high privileges on SonicWall Network Security Manager (NSM) on-prem can execute arbitrary OS commands via an OS command injection flaw (CWE-78), achieving remote code execution. The vulnerability affects NSM on-prem versions 4.3.1 and earlier, requires a privileged session (PR:H), and is assessed with high attack complexity (AC:H) due to unenumerated specific conditions. No public exploit code or active exploitation has been identified (CISA KEV status: none; SSVC exploitation: none), and the EPSS score is 0.54% (44th percentile), indicating a moderate-priority risk rather than an urgent emergency.
Missing authorization in the VideoWhisper Paid Videochat Turnkey Site (ppv-live-webcams) WordPress plugin, in all versions through 7.5.12, lets unauthenticated remote attackers invoke plugin functionality that should be gated behind an access-control check, rated CVSS 3.1 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The accessible functionality yields only low confidentiality, integrity and availability impact rather than full site compromise, and real-world exposure is bounded by the narrow install base of this specialized pay-per-view videochat plugin. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Stored cross-site scripting (XSS) in the Verified Reviews (Avis Vérifiés) WordPress plugin up to version 2.4.6 allows unauthenticated attackers to inject arbitrary web scripts via the 'moderation' parameter, which execute when a user views an affected page. The plugin's ntav_check_data() function uses loose '!=' comparisons, enabling signature verification bypass by sending a JSON body with boolean true for idWebsite and sign. No public exploit identified at time of analysis; CVSS 3.1 score is 7.2 (HIGH).
Stored cross-site scripting in the Cryptocurrency Donation Box plugin for WordPress (all versions up to and including 2.2.13) allows unauthenticated attackers to persist arbitrary JavaScript via the data_object parameter of the cdbbc_payment_verify AJAX action, which executes whenever a user opens an injected page. The plugin registers that AJAX action under wp_ajax_nopriv_ and its only gate is a nonce that is publicly exposed to anonymous visitors inside the wallets_data JavaScript object emitted by the [crypto-donation-box] shortcode, so exploitation needs no credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C, score 7.2) and no non-default configuration - any site publishing the shortcode is exposed. Impact is gated on the second-order step: the injected script fires when a logged-in user, typically an administrator, views the plugin's donation list table in wp-admin. No public exploit code or confirmed active exploitation is identified at time of analysis, and the practical exposure is limited to sites running this niche plugin.
Stored cross-site scripting in the WordPress plugin Smart Forms - When You Need More Than Just a Contact Form (all versions up to and including 2.6.104) lets unauthenticated attackers inject arbitrary JavaScript through the 'formString' parameter, which is persisted and later executed in the browser of any user, typically an administrator, who views the affected page or the form-entries listing. The nonce and authentication check on the rednao_smart_forms_save_form_values AJAX handler is enforced only when the non-default smart_forms_block_anonymous_submissions option is enabled, so default installations accept and store malicious payloads from anyone with network access. No public exploit code has been identified at time of analysis, but the unauthenticated access path, low attack complexity, and scope-changing admin-context execution make this an elevated-priority issue for affected sites; impact still depends on a privileged user subsequently rendering the stored payload.