Stored SQL injection in DataEase versions prior to 2.10.26 allows authenticated users to inject arbitrary SQL into backend queries by storing crafted binning values (FieldGroupDTO.min, .max, .startTime, .endTime) in dataset group-field definitions. The payload is only triggered when a chart that references the tainted field is rendered, giving an attacker with a valid DataEase account high-impact read/write/delete access to the configured backend database (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H). Exploitation requires a low-privileged authenticated account with dataset-editing rights; no public exploit code or confirmed active exploitation was identified at time of analysis.
SQL injection in DataEase's CalciteProvider allows authenticated users with access to a configured datasource to alter the metadata queries the platform builds for getSchema, validate, save, and update flows, executing attacker-controlled SQL against the connected backend database using the application's stored datasource credentials. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.7), reflecting high confidentiality, integrity, and availability impact on the backend database with no victim interaction required, though exploitation is constrained by the need for a valid DataEase account that has been granted datasource access and by the privileges of the application-held datasource account. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released v2.10.27, which introduces identifier quoting, literal escaping, and parameter binding in CalciteProvider.
Regular expression denial of service in GitPython before 3.2.0 allows remote, unauthenticated attackers to exhaust CPU on applications that parse Git commit or tag objects taken from an attacker-controlled repository. The flaw is in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines, which slips into quadratic backtracking when those lines are padded with long space-filled sequences that lack a valid epoch or timezone. Impact is strictly availability (CVSS 4.0 VA:H with VC:N/VI:N) - there is no confidentiality or integrity exposure, so the 8.7 High score reflects CPU exhaustion only, not code execution or data compromise; no public exploit identified at time of analysis.
Improper authentication in the local device-management protocol of TP-Link Kasa smart plugs, switches, dimmers, and bulbs lets an unauthenticated attacker who is already on the same Wi-Fi/LAN segment send management instructions to the device, changing device state and settings or disrupting legitimate user control. The vendor scores this 8.7 (CVSS 4.0 AV:A/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity, and availability impact to the device), and the independent assessment agrees: authentication is not required within the adjacent network (PR:N, CWE-306), but the ADJACENT attack vector confines exploitation to attackers holding a foothold on the local segment rather than the public internet. No public exploit code has been identified at time of analysis, and the described cloud-account information exposure is conditional - it depends on concurrent user, mobile-app, and device-cloud interaction - so full account compromise is not guaranteed.
HTTP request smuggling in Eclipse Vert.x (io.vertx:vertx-core) affects versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, where the HTTP/1.x decoder canonicalizes well-known header names in a way that lets crafted names such as 'Content-Xength' be treated as 'Content-Length'. Unauthenticated remote attackers (CVSS v4.0 vector PR:N/UI:N, score 8.7; independent CVSS v3.1 assessment AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) can exploit this to desynchronize how HTTP messages are framed, with integrity impact only and no direct confidentiality or availability loss. Practical impact depends on deployment topology: a second HTTP agent (front-end proxy, load balancer, CDN or back-end server) must share the request path and parse the ambiguous headers differently from Vert.x, whereas a standalone Vert.x HTTP/1.x server with no co-located intermediary sharply limits exploitability; HTTP/2-only deployments are not reached by this decoder path. No public exploit identified at time of analysis, and no confirmed CISA KEV active exploitation.
Authenticated SQL injection in DataEase versions prior to 2.10.26 allows users with dataset-edit permissions to store a crafted custom dateFormat on a dataset field, which is then inserted without validation into date-conversion SQL templates. When a chart renders the affected field, the injected payload can alter generated SQL and potentially compromise the confidentiality, integrity, and availability of the backend database. Reliable exploitation requires a cross-datasource dataset where Calcite parsing is bypassed; on a single-datasource dataset the payload must survive Calcite reserialization as a valid string literal, significantly limiting that path. No public exploit code was identified at the time of analysis, and the vendor has released a patch in version 2.10.26.
Unauthenticated keyboard injection in the FreeRDP shadow server (versions 3.0.0 through 3.31.x) allows remote attackers to send synthetic keystrokes into a host user's X11 session via XTEST by delivering an input PDU during the Confirm Active state, before any authentication takes place. Exploitation requires the shadow/mirroring server to be network-reachable and the host to be running an X11 session over a TLS-only RDP negotiation; the confirmed impact is integrity-only (fabricated input) with no confidentiality or availability effect. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Juniper Junos OS and Junos OS Evolved rpd contain a stack-based buffer overflow that an unauthenticated adjacent LDP peer can trigger with a malformed LDP Label Mapping message, causing an rpd crash or potentially arbitrary code execution. Exploitation requires LDP/MPLS to be configured and the attacker to have an LDP adjacency, so exposure is limited to MPLS-enabled routers rather than arbitrary internet-facing systems. Vendor patches are available; no public exploit code has been identified at time of analysis.
Out-of-bounds read in Eclipse NetX Duo's X.509 certificate parser (routine `_nx_secure_x509_parse_signature_data`) lets a peer that supplies a certificate with an empty ASN.1 BIT STRING signature corrupt the parser's internal signature length to 0xFFFFFFFF and drive a signature pointer one byte past the end of the buffer, producing a crash or destabilization of the device. Because certificates are parsed from the remote peer during the TLS handshake, the issue is network-reachable and unauthenticated - affected devices are those acting as a TLS client toward an attacker-influenced server, or as a TLS server that requests client certificates; the independent assessment rates it AV:N/AC:L/PR:N/UI:N with availability-only impact (A:H). Neither CISA KEV active exploitation nor public exploit code is associated with this CVE at time of analysis, and the principal limiting factor is reachability: only systems that negotiate TLS with untrusted peers are exposed.
OS command injection in @offactory/compress-fonts before 1.1.1 lets an attacker execute arbitrary shell commands with the privileges of the Node.js process by getting a font file with shell metacharacters in its filename into a directory that is being compressed. The supplied CVSS 4.0 vector indicates no authentication is required (PR:N) and high confidentiality, integrity, and availability impact to the vulnerable component, but the attack vector is local (AV:L) and requires a user or automated build to initiate the FontForge conversion (UI:P), so real-world impact is bounded by who can place files in the processed source directory and by the privileges under which the build runs. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; a vendor fix is available in version 1.1.1, which replaces execSync with execFileSync.
OS command injection in xhtml2pdf before 0.2.19 lets an attacker execute arbitrary OS commands as the invoking user when the pisa command-line tool is run with the -s/--start-viewer option against a file whose name contains a double quote plus shell metacharacters. The flaw lives in pisa.startViewer(), which interpolates an unescaped filename into os.system('open "%s"'); because the vulnerable path is only reached in viewer-launch mode, the default programmatic HTML-to-PDF conversion API is not affected. The vector is local and requires a user (or job) to actually launch the viewer, and no public exploit code has been identified at time of analysis - confirmed actively exploited status is not present in the available data.
OS command injection in buildebooks (wastemobile) versions before 0.2.2 lets a crafted EPUB file name or project folder name break out of the shell command string built in lib/kindle.js and execute arbitrary operating-system commands with the privileges of the user running the build. Exploitation is local rather than network-reachable: the victim must process an attacker-supplied book project with the Kindle output path enabled (kindle: true), which satisfies the user-interaction prerequisite, and no privileges are needed on the attacker's side per the assessed vector (PR:N). No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, but the affected code path is straightforward (a naive string concatenation into child_process.exec) and a vendor fix is available in 0.2.2.
Code injection in TeamPlus Messenger allows unauthenticated remote attackers to trick a user into interacting with crafted content, injecting and executing arbitrary JavaScript; after the user confirms a Windows security warning, arbitrary code executes with the victim's privileges. The CVSS 4.0 vector scores 8.6 (High) with UI:A, gated by two distinct user actions: interacting with the malicious content and then accepting an OS-level security prompt. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Remote code execution in TeamPlus Messenger for Windows lets an unauthenticated attacker deliver a crafted link that injects and executes arbitrary JavaScript inside the client, escalating to native code execution with the privileges of the logged-in user once the victim opens the link and confirms a Windows security warning dialog. Rated CVSS 4.0 base 8.6 (High) and mapped to CWE-94, the flaw's practical severity is gated by two mandatory victim actions - following the malicious link and accepting the Windows prompt - so only users who both act are compromised, and execution is confined to user-level privileges rather than SYSTEM or administrative rights. At the time of analysis no public exploit code was identified and the issue was not listed in CISA KEV; only TWCERT/CC advisory references are available, and no vendor patched version is specified in the provided data.
OS command injection in Turnpress through 0.4.2 allows arbitrary shell commands to be executed with the victim user's privileges when the tool's convert or create operation processes a .docx file whose filename contains shell metacharacters. The flaw sits in convertDocxToHtml (src/converter.ts), which invokes pandoc through execa with shell:true, so the crafted filename is interpreted by the shell rather than treated as a literal argument; exploitation is local (AV:L) and requires the victim to run a convert/create command on the malicious file (UI:R), and no privileges are needed to craft the filename. Impact is high for confidentiality, integrity, and availability on the host running the conversion, but it is limited to the invoking user's privileges with no scope change, and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; vendor fix is available via an upstream pull request that removes shell:true.
PHP object injection in ILIAS LMS affects installations before 9.24, 10.12, and 11.5, allowing an authenticated user who holds the Test creation or Test import permission to deserialize attacker-controlled objects by importing a crafted Test results archive. By embedding a malicious 'tst_sequence' (sequence) attribute in the archive XML, the attacker reaches an unrestricted unserialize() call and can leverage the bundled Guzzle or Monolog libraries as POP gadget chains to write PHP files and achieve remote code execution on the server. The primary limiting factor is the required authenticated account and import-level permission rather than any anonymous exposure; no public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing).
Directive injection in NGINX Gateway Fabric lets an authenticated namespaced tenant escape the auth_basic "<realm>"; quoting rendered into a shared data-plane nginx.conf and inject arbitrary NGINX directives. Exploitation requires a multi-tenant deployment in which several namespaces share one Gateway/data plane, plus namespaced RBAC to create an AuthenticationFilter CRD and attach it via spec.basic.realm or spec.jwt.realm to an HTTPRoute or GRPCRoute bound to that Gateway (CVSS vector shows PR:L and UI:N, so valid authenticated credentials are required and no user interaction is needed). The impact is control-plane only, with no data-plane exposure, but a successful attacker could read co-located tenants' mounted secrets, perform SSRF through proxy_pass, read the pod ServiceAccount token, or hijack other tenants' routes; no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Information exposure in the Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, occurs when the provider's API client error-handling path writes sensitive information into an externally accessible file or directory (CWE-209). Dell rates this CVSS 3.1 8.6 (High) with a remote, unauthenticated vector (AV:N/PR:N/UI:N/S:U/C:H/I:L/A:L), but independent assessment maps realistic exploitation to AV:L/AC:L/PR:N/UI:N/C:H/I:N/A:N, because an attacker must already be able to read wherever the provider's error output is persisted - typically shared log aggregation, publicly readable CI/CD output, or exposed Terraform state/debug artifacts - rather than reaching a directly network-exposed service. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor's AV:N vector should be validated against Dell DSA-2026-434 before treating this as a remotely exploitable unauthenticated issue.
Stored cross-site scripting in JTL-Shop lets unauthenticated remote attackers inject arbitrary script code through the shop's public consent endpoint, which accepts and stores attacker-controlled consent names without validating them against configured consent items. Those unvalidated names are then rendered without output encoding on the administration backend's consent statistics page, so the payload executes in the browser session of any administrator who opens that page, allowing actions with the administrator's privileges. No public exploit code or CISA KEV entry was identified at the time of analysis, but the vendor has published a security advisory; the CVSS 4.0 score is 8.6, and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) confirms an unauthenticated, remote, high-impact issue whose successful exploitation depends on an administrator passively viewing the affected statistics page.
SmsForwarder through 3.5.0 exposes an AndServer-based HTTP remote-control interface whose API endpoints are enabled by default and perform no authentication check, allowing anyone who can reach the device's listener on an adjacent network to read SMS messages, call logs and contacts, send SMS on the victim's behalf, and export or overwrite the app's configuration via the clone API. The supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N) and the independent assessment agree that exploitation is unauthenticated and requires no user interaction, but is constrained to an adjacent network path such as the same LAN or Wi-Fi segment rather than arbitrary internet reachability. The vulnerability is not listed in CISA KEV and no public exploit code was identified at time of analysis; no EPSS score, no vendor CVSS 3.1 vector, and no explicit POC flag were provided, so those prioritization signals remain unknown rather than assumed.
Heap out-of-bounds read and write in the DPDK Generic Segmentation Offload (rte_gso) library can be triggered when an application enables GSO on its packet path and is configured with small or undersized mbuf pools relative to the segmentation workload, letting network-delivered traffic corrupt memory in the data plane. The vendor-published CVSS 3.1 base score is 8.6 (High) on a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, indicating a network-reachable, unauthenticated, low-complexity heap out-of-bounds read/write; our independent assessment keeps the network-reachable, unauthenticated profile but assesses higher attack complexity (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) because exploitation is gated on the non-default-looking small-mbuf-pool configuration together with GSO actually being enabled. Impact is dominated by availability (A:H), so the realistic outcome is a data-plane crash rather than full host compromise, with only partial confidentiality and integrity effects; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Eclipse Vert.x Web versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 contain a scope bypass in ChainAuthHandler that allows an authenticated remote attacker with a valid token but insufficient scopes to access resources protected by withScope() or withScopes() requirements. The flaw occurs when a preceding authentication handler in the request pipeline has already authenticated the user, causing ChainAuthHandler to skip scope validation in both any() and all() modes; the most common trigger is overlapping authentication handlers on nested routes. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in Better Auth SSO (@better-auth/sso) 1.7.0-rc.2 through 1.7.2 allows an authenticated low-privilege user to sign in as other users by registering a personal SSO provider that copies a legitimate provider's OIDC issuer or SAML entity ID and asserts a victim's subject or NameID; the account lookup ignores providerId, so the forged personal provider can create a session for the victim account. Exploitation requires a valid account and that the application permits user-registerable personal SSO providers, and no public exploit has been identified at time of analysis. The issue is fixed in 1.7.3; CVSS 8.6 reflects high confidentiality and integrity impact.
Unauthenticated attackers who can reach the Ubiquiti UniFi Protect AI Key over the network can abuse an improper access control weakness to read information from the device, make unauthorized changes, and knock it offline. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, base 8.6) confirms the attack requires no credentials and no user interaction, with the dominant impact being a high-availability Denial of Service and limited confidentiality and integrity effects. No public exploit code was identified and there is no CISA KEV listing at time of analysis; Ubiquiti's Security Advisory Bulletin 070 is the authoritative source for affected firmware and fixes.
OS command injection in the Junos OS CLI lets an authenticated, low-privileged local user escalate to full root control of the device by passing unsanitized arguments to the 'request csds' operational command. Only Junos OS 24.4 (from 24.4R1 up to before 24.4R2-S4), 25.2 (before 25.2R2-S1), and 25.4 (before 25.4R1-S3) are affected; releases before 24.4R1 are explicitly unaffected, and the attack is strictly local with no network or unauthenticated path. There is no public exploit identified at time of analysis, and Juniper has released fixed versions (24.4R2-S4, 25.2R2-S1, 25.4R1-S3), making this a serious but access-gated issue rather than an internet-facing emergency.
A heap-based buffer overflow in the eventd daemon of Juniper Networks Junos OS and Junos OS Evolved allows a local unprivileged attacker to send crafted IPC messages, leading to denial of service or privilege escalation to root. The vulnerability affects all platforms and carries a CVSS 4.0 base score of 8.6 due to high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires a pre-existing local account or foothold on the device, and network-based unauthenticated attacks are not possible.
Improper validation of the JWT seeding token used by Akamai's Guardicore Platform Agent (GPA) client before version 7.4 allows an attacker who persuades a user to interact with a crafted link to slip a spoofed token into the enrollment flow and inject arbitrary configuration parameters, reconfiguring the agent and compromising its functionality end to end. The same spoofed-token technique can be aimed at an already-seeded client, but only when the attacker also knows the specific identity-provider (IDP) URL that client used for enrollment, a concrete prerequisite that constrains opportunistic targeting. There is no public exploit code identified at time of analysis and the issue is not in CISA's KEV catalog; Akamai has released 7.4 as the corrected version, and the independent assessment rates the flaw CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - serious, but not an immediate drop-everything emergency on current signals.
Remote code execution in Markdown Preview Enhanced (a Visual Studio Code Markdown preview extension) before 0.8.29 lets a malicious repository run operating-system commands as the victim's account the moment the victim opens a Markdown file from that repository. The extension automatically evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files through vm.runInNewContext, and prototype-chain traversal escapes the Node.js host realm to reach the Function constructor and the process object - no further interaction and no module-scoped require are needed, and both the configuration-evaluation and parser-hook paths are affected. The vector requires local placement of the repository plus user interaction (opening the file), so it is not mass-exploitable over the network against a default install; there is no CISA KEV listing and no public exploit identified at time of analysis. The issue is fixed in Markdown Preview Enhanced 0.8.29, which bundles crossnote 0.9.30.
Blind SQL injection in the Webnus Modern Events Calendar Lite plugin for WordPress (versions before 7.37.0) lets an authenticated low-privilege user inject SQL through a plugin endpoint that fails to neutralize special elements, allowing them to read arbitrary data from the site's database. The provided vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5 High) requires a valid low-privileged account, so sites that restrict registration or grant only minimal roles present a materially higher barrier; our independent assessment keeps the high confidentiality impact but scores scope as unchanged (S:U) and shifts the integrity/availability impact to a low integrity impact, which lowers the practical blast radius claimed by the vendor vector. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Authenticated SQL injection in the Codepeople CP Multi View Event Calendar WordPress plugin (versions through 1.4.41) allows a logged-in user with low-level privileges to feed crafted input into an unsanitized database query, giving the attacker read access to data held in the site's WordPress database and potential limited manipulation of it. Patchstack rates the issue CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, CWE-89), and exploitation is contingent on the plugin being installed and active plus a valid account on the site - fully anonymous visitors cannot trigger it, and no public exploit code has been identified at time of analysis.
Server-side request forgery in Renovate before 44.79.0 allows authenticated users with low privileges to direct the shared HTTP client at arbitrary internal URLs through 'extends' preset references or 'customDatasources' entries. An attacker who can influence Renovate's configuration - for example by committing to a scanned repository or controlling a preset source - can reach an instance metadata endpoint such as AWS IMDS to obtain credentials, or exfiltrate sensitive information into Renovate logs; real-world impact depends on the deployment's network reachability of internal services. The vendor fixed the issue in Renovate 44.79.0, and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in GStreamer's gst-plugins-base plugin library lets a local attacker who controls the sending side of a GStreamer inter-process IPC pipeline corrupt memory in the receiving process, yielding a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with high confidentiality, integrity, and availability impact. The victim process maps a crafted video buffer whose GstVideoMeta declares plane strides and offsets larger than the actual backing allocation, causing out-of-bounds reads and writes that can crash the process or potentially permit code execution in its context. Exploitation is strictly local and requires a deployment where GStreamer buffers cross a trust boundary between a less-trusted producer and a more-trusted consumer; no user interaction or authentication to the victim is needed, and no public exploit has been identified at time of analysis.
Heap out-of-bounds write in Eclipse ThreadX GUIX's binary theme resource loader (gx_binres_theme_load) lets a crafted binary resource (theme) file overwrite memory past the end of the loader's own arena with bytes taken verbatim from the file, producing high confidentiality, integrity, and availability impact on the affected process. The vector is local rather than network-reachable: an attacker must get the malformed theme file onto the device and the target application must actively load it (CVSS 4.0 AV:L/UI:A; assessed CVSS 3.1 AV:L/UI:R, PR:N, so no privileges are needed once the file is loaded), and deployments that only load theme resources compiled into firmware, or that never accept externally sourced theme files, are not exposed. GX_BINARY_RESOURCE_SUPPORT is enabled in the shipped default configuration, so no special build option is required for the flaw to be reachable; no public exploit code was identified at time of analysis, and no caller-side workaround is possible because the public API takes no buffer-size parameter.
Missing authorization in holaOS channel-gateway connectors (Telegram, Slack, Discord, and similar) through 2026.822.1 allows any unauthenticated messaging-platform user who can reach an operator's configured bot to submit agent tasks, because the #isAllowed check treats an empty default allowFrom list as permitting all senders and ChannelIngress.handle then forwards those turns to the workspace agent, which executes configured tools on the operator's machine. Exploitation requires the connector to be configured and allowFrom left at its empty default (attack requirements present, AT:P) and needs no user interaction; no public exploit code is identified at time of analysis, but the CVSS 4.0 base score of 8.3 reflects high integrity impact (VI:H) with low confidentiality and availability impact. This is a high-priority issue for operators who actually run holaOS with a chat connector and have not populated an explicit sender allowlist.
Command injection in Ubiquiti's UniFi Protect AI Key lets a network-reachable, unauthenticated attacker (CVSS PR:N/UI:N) potentially execute arbitrary operating-system commands on the appliance, giving full loss of confidentiality, integrity, and availability. Per the supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), exploitation is high-complexity: the vendor conditions success on unspecified preconditions ('under certain conditions'), so attacks are not expected to succeed against every deployment and require the attacker to reach the device's network and satisfy environment-specific state. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was provided; the practical exposure is dominated by whether the AI Key is reachable from untrusted network segments.
Canonicalization inconsistency in the NGINX JavaScript (njs) XML module lets an unauthenticated attacker who already holds a genuinely signed SAML/XML document cause entity-backed attributes to appear absent or truncated ($attr$Name returning undefined, $attrs derived from only the first attribute child) while signature verification still succeeds. nginx-saml running the built-in njs backend is the confirmed affected consumer, where this can bypass expiry, Destination, and request-correlation checks and enable replay or acceptance of a response outside its intended context; the flaw cannot forge signatures or identities and has no availability or control-plane impact. F5's advisory rates this 8.3 (High, CVSS 4.0 with AT:P reflecting the significant effort needed to obtain a validly signed document); no public exploit code was identified at time of analysis, and no KEV listing applies. There is no public exploit identified at time of analysis.
SSL session ticket key handling in NGINX Plus and NGINX Open Source can let a remote unauthenticated attacker forge client SSL sessions and bypass client certificate verification, but only on instances that enforce mutual TLS and rely on NGINX's automatic ticket key rotation. Exploitation is conditional and non-deterministic: the affected deployments must be configured with ssl_session_cache shared:name:size and must not set an explicit ssl_session_ticket_key file, and the resulting forgery is beyond the attacker's control (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, 6.5). There is confirmed data-plane information exposure potential but no control-plane exposure, and no public exploit identified at time of analysis.
Arbitrary activity-log disclosure in the GamiPress WordPress plugin before 8.0.6 lets any authenticated user - including a lowest-privilege Subscriber - read other users' points balances and earned achievements, plus the usernames of administrators who manually awarded or revoked points, by invoking one authenticated AJAX action that performs neither a capability check nor an ownership verification. The issue is remotely reachable with only low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3, CWE-639) and is read-only, with no integrity or availability impact. Publicly available exploit code exists, but there is no evidence of active exploitation and EPSS is low (0.17%, 6th percentile), so it ranks as a low-to-moderate priority for sites with open user registration.
Information disclosure in the Tainacan WordPress plugin before 1.4.0 lets any authenticated subscriber-level user read the email addresses of the repository's staff by calling reports REST endpoints that lack a management-capability check; the CVSS vector (PR:L) confirms authentication is required, so the attacker needs an existing or self-registered low-privileged WordPress account. Publicly available exploit code exists (referenced from the WPScan advisory), but there is no confirmed active exploitation and EPSS is only 0.17% (6th percentile), placing this at low practical risk. Impact is limited to confidentiality (C:L, CVSS 4.3) and serves reconnaissance or phishing preparation rather than direct system compromise.
Subscriber-level (or higher) users on WordPress sites running rtMedia for WordPress, BuddyPress and bbPress before 4.7.14 can assign uploaded media to an album they do not own or have write permission for, placing content into another user's private album and having it attributed to that victim. The plugin fails to validate album ownership on the upload path (CWE-639, an IDOR/authorization bypass through a user-controlled key), so the only prerequisite is an authenticated account plus the ability to supply a target album identifier - described in the independent assessment as exploitable by an authenticated attacker with PR:L, remote (AV:N), with impact limited to integrity (I:L) and no confidentiality or availability effect, giving an assessed CVSS of 4.3. Publicly available exploit code exists per the WPScan reference tagged as 'exploit', but there is no KEV listing and CISA's SSVC rates exploitation as none and automatable as no, while EPSS is only 0.16% (5th percentile) - consistent with low real-world urgency rather than a top-priority patch item.
Unauthenticated local file inclusion in the Mang Board WordPress plugin (all versions through 2.4.3) allows remote attackers to include and execute arbitrary PHP files by supplying a crafted '<mode>_type' parameter (e.g. foo_type) to any publicly reachable page that renders the [mb_board] shortcode. Because no nonce or capability check is enforced on the shortcode render path, the LFI itself is trivially triggered by an unauthenticated POST and can be used to bypass access controls or disclose sensitive data; full code execution is a further step that requires either a standard PHP installation exposing pearcmd.php (which can be abused to write and then include an attacker-controlled payload in a single request) or the ability to upload .php files that are then included, which is why the vendor scored the issue AC:H despite the unauthenticated PR:N vector. The vulnerability is tracked as CWE-98 with a CVSS 3.1 base score of 8.1, reported by Wordfence; no public exploit code identified at time of analysis and the CVE is not listed in CISA KEV, though the low exploitation complexity warrants prompt patching.
Unauthenticated local file inclusion in ShopMagic for WooCommerce (all versions up to and including 4.9.0) allows remote attackers to include and execute arbitrary .php files on a WordPress server by submitting a path payload as the billing first name during WooCommerce guest checkout. The value reaches the plugin's PHP template renderer through the {{ customer.first_name }} placeholder, and the built-in "New Order email with social media profile links" recipe processes that placeholder out of the box, so default configurations are exploitable with no account, cookie, or nonce. CVSS is 8.1 (C:H/I:H/A:H, AC:H); full code execution additionally requires that an attacker-controllable .php file already exist on the server, and no public exploit code was identified at time of analysis. The vendor-released fix is 4.9.1.
Denial of service in the Erlang OTP ssl application allows a malicious or man-in-the-middle TLS 1.3 server to crash the node-global session-ticket store on a connecting client, and repeated crashes can exhaust the ssl supervisor restart intensity and take down TLS for every connection on that node. The victim must be a TLS 1.3 client running OTP 23.3 through the fixed releases with session_tickets set to auto (automatic ticket storage and resumption); the crash does not occur when the bogus ticket is received but on the next automatic resumption attempt, and it requires the client to initiate the outbound connection, which is reflected in the assessed AT:P attack-requirement metric and a CVSS 3.1 base of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) despite the vendor's CVSS 4.0 score of 8.2. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but vendor patches and upstream commits are available. Reported by the Erlang Ecosystem Foundation (EEF) and tracked as EUVD-2026-101384.
InvoiceShelf installs prior to 2.4.0 leak other customers' invoices, estimates, and payment PDFs through the public customer-portal token routes, because the EmailLog token is resolved by numeric mailable_id without checking mailable_type and the JSON handlers never enforce EmailLog::isExpired. An unauthenticated remote attacker holding any legitimate emailed customer link (PR:N, no account needed) can therefore retrieve a document belonging to a different company when numeric identifiers collide across tenants, or keep using an already-expired link indefinitely on the JSON routes GET /customer/invoices/{email_log:token}, GET /customer/estimates/{email_log:token}, and GET /customer/payments/{email_log:token}; the view handlers can additionally flip a mismatched invoice or estimate to 'viewed' and trigger a notification email. Rated CVSS 8.2 (C:H, I:L) as a genuine improper-authorization flaw (CWE-285), though the cross-tenant variant is opportunistic and gated by id collisions while the expired-token variant is fully reliable; no public exploit code has been identified at time of analysis and the issue is fixed in version 2.4.0.
Unauthenticated network attackers can cause a complete denial-of-service (FPC crash) in Juniper Junos OS on SRX Series by exploiting a NULL pointer dereference in the DNS plugin when multiple DNS queries in a single flow session trigger both Security Intelligence (SecIntel) feed matching and Domain Generation Algorithm (DGA) analysis. Exploitation requires a non-default configuration where both SecIntel and DGA features are enabled, and the crash depends on a timing/race condition that the attacker cannot directly control, limiting reliability. No public exploit code has been identified at time of analysis, and vendor patches are available.
Unauthenticated local file inclusion in the BP Profile Search plugin for WordPress (versions up to and including 5.9) lets an attacker force the site to include an arbitrary PHP file by supplying an 'ajax_template' value inside the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. No authentication or special configuration is required, and the plugin performs no basename restriction, whitelist, or path-traversal validation before appending '.php' and passing the value to bp_locate_template(); escalation to full remote code execution is conditional on an includable PHP file already existing on the server (for example via a separate file-upload weakness or default container images such as wordpress:php8), while without such a file the attacker is limited to including existing server-side PHP, which still risks information disclosure and unintended code execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1), with the High attack-complexity reflecting the RCE precondition.
Unauthenticated arbitrary file read in the dbt docs serve component (dbt 2.0.0-alpha.0 through 2.0.0-alpha.4) lets any client that can reach the server POST attacker-chosen SQL to /api/v1/query and invoke DuckDB filesystem-reading functions, returning the contents of files readable by the dbt process - including paths outside the docs index directory. The SQL handler was removed entirely in 2.0.0-alpha.5. Reachability is the gating prerequisite: dbt docs serve binds to localhost by default, so remote exploitation only succeeds when an operator has exposed it via the host option or the DBT_DOCS_HOST environment variable; no public exploit code was identified at time of analysis, and no KEV listing is associated with this issue. The vector is unauthenticated (PR:N) with high confidentiality impact only (VI:N, VA:N), giving a 4.0 base score of 8.2 and an assessed 3.1 score of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
A network-based, unauthenticated attacker can cause a temporary denial of service on Juniper Networks SRX Series devices running Junos OS when the SSL proxy feature is enabled. During a TLS session-resumption attempt, a specifically malformed TLS message triggers an improper handling of a missing special element in the SSL plugin, leading to an invalid pointer access and a Packet Forwarding Engine (PFE) crash that interrupts traffic forwarding until the PFE automatically recovers. Exploitation is conditional: it requires the non-default 'ssl-proxy' configuration, and the exact internal timing needed to hit the fault is outside the attacker's direct control, making the attack probabilistic rather than reliably repeatable; no public exploit identified at time of analysis and there is no impact to confidentiality or integrity, only availability. Vendor-released patches are available in the fixed Junos OS releases listed in advisory JSA112176.
A use-after-free in the packet forwarding engine of Juniper Networks Junos OS on SRX Series firewalls lets unauthenticated, network-based attackers repeatedly crash the flowd daemon when web filtering for TCP traffic is enabled, producing a temporary but complete service outage until flowd automatically restarts. The trigger is a high volume of DNS requests that must coincide with an internal race condition explicitly outside the attacker's direct control, so impact is probabilistic rather than deterministic; devices without web filtering for TCP configured are not exposed. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded to specific pre-25.2 service releases for which Juniper has published fixed builds.
Denial of service in Juniper Networks Junos OS on SRX Series firewalls with UTM WebFiltering enabled allows unauthenticated, network-based attackers to crash and restart the UTM subsystem, knocking out all UTM-served traffic until the device recovers. The crash is not directly reachable: it requires the external WebFiltering cloud categorization server to be unreachable so that category-lookup requests accumulate, plus sustained HTTP load and a specific timing window during cleanup of those pending lookups that drives the process into an invalid internal state (CWE-413, improper resource locking); both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF) are affected. Junos OS 23.2R2, 23.4R2, 24.2, 24.4, 25.2 and 25.4 branches are impacted below their respective fixed releases, the vendor rates this CVSS 4.0 base 8.2, and no public exploit identified at time of analysis. Because of the cloud-server-unreachable precondition and the load/timing race, the independent assessment classifies this as a genuine availability risk rather than a drop-everything emergency.