Adjacent Layer-2 attackers can crash the rpd routing daemon on Juniper Networks Junos OS and Junos OS Evolved devices that run LDP across a link-protected interface, producing a denial of service when two misconfigured LDP neighbors - or a single neighbor duplicated by an L2 loop - advertise the same transport address and trip an internal assertion in the daemon. The CVSS vector (AV:A/PR:N, no confidentiality or integrity impact) shows the attack is unauthenticated but requires link adjacency plus an established LDP session and a non-default misconfiguration or L2 loop, so exposure is conditional rather than universal and is confined to availability; recovery is assessed as automatic (R:A) because the daemon restarts after the crash. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS-style urgency signals in the supplied data do not indicate mass scanning or confirmed in-the-wild abuse.
A reachable-assertion flaw in the Juniper Junos OS and Junos OS Evolved rpd routing daemon lets a network-adjacent attacker crash the daemon by sending a crafted LDP Label message that carries an IPv6 Prefix FEC, producing a denial-of-service condition (CVSS 4.0 base 7.1; availability-only). The attacker must already share an L2 segment or act as a directly connected routing peer and must have an established LDP session with the target, so only devices with LDP configured and actively exchanging IPv6 Prefix FEC bindings are exposed; no authentication or user interaction is required once that adjacency exists (PR:N, UI:N), and the daemon's automatic restart bounds each outage. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); impact is limited to availability, with no confidentiality or integrity effect.
Juniper Junos OS and Junos OS Evolved devices that run OSPFv3 on a broadcast interface can be crashed by an unauthenticated adjacent attacker who sends specially crafted OSPFv3 protocol messages to the rpd routing daemon, producing a denial of service and heap memory corruption. Exploitation requires only Layer-2 adjacency to the affected broadcast segment and no credentials or user interaction, but devices that do not run OSPFv3, or that use point-to-point interface types, are not exposed; no public exploit code has been identified at time of analysis. Vendor severity is moderate (CVSS 4.0 7.1) with an availability-only impact, aligning with our independent CVSS 3.1 assessment of 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Adjacent, unauthenticated attackers can crash the rpd routing protocol daemon on Juniper Networks Junos OS and Junos OS Evolved devices that are configured for sparse-mode PIM, exploiting a use-after-free flaw triggered by specific PIM Join/Prune messages. Successful exploitation causes a denial of service through daemon failure and subsequent routing churn, with no impact on confidentiality or integrity. Exploitation is conditional: the target must run PIM sparse mode and the attacker must already sit on an adjacent multicast/routing segment with a valid PIM adjacency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vendor advisory JSA112187 is the authoritative source for affected and fixed releases.
Malformed PIM Hello messages can crash the rpd process in Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service on IPv6-enabled PIM interfaces. This improper input validation flaw (CWE-20) is exploitable by an unauthenticated adjacent attacker (AV:A) without user interaction, but requires PIM to be configured and the target interface to be IPv6-enabled. No public exploit code or active exploitation is known; the CVSS 4.0 base score is 7.1, and independent assessment classifies this as a moderate-severity availability issue with a bounded exposed population.
Denial of service in Juniper Networks SRX Series firewalls running Junos OS in a chassis-cluster (high-availability) configuration allows an adjacent attacker to crash the data plane by sending crafted traffic over the chassis-cluster fabric interconnect. The flaw is a signed-to-unsigned conversion error (CWE-195) in the srxpfe packet forwarding engine; authentication requirements are confirmed as unauthenticated (PR:N) and no user interaction is needed (UI:N) once the attacker has a position on the fabric. There is no public exploit identified at time of analysis and no record of confirmed active exploitation (CISA KEV), and the attack surface is restricted to clustered deployments rather than general network exposure, making this an access-constrained availability threat.
Juniper Networks Junos OS and Junos OS Evolved can be forced into a denial of service by a network-adjacent, already-established BGP peer that drives the routing protocol daemon (rpd) into a reachable assertion (CWE-617) by triggering a specific code path in labeled-unicast processing when the non-default 'aggregate-label' labeled-unicast setting is configured. Impact is confined to availability - the rpd process crashes and must restart, causing route churn and potential traffic loss - with no confidentiality or integrity exposure; the assessed vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H reflects that the attack surface is a configured BGP peering relationship rather than an arbitrary remote host, so this is a genuine but conditional priority rather than an inflated high-CVSS issue. No public exploit identified at time of analysis, and exploitation additionally requires both the aggregate-label configuration and an existing BGP session with the target device.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to crash or destabilize the routing daemon (rpd) by sending a specially crafted IS-IS SRv6 packet, disrupting routing on the affected device. Exploitation is tightly constrained: the device must have both SRv6 and Flexible Algorithm explicitly enabled in its IS-IS configuration (a non-default segment-routing setup), and the attacker must already sit on an adjacent network segment able to inject IS-IS packets into the routing domain - a remote Internet attacker cannot reach this path. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV); with an assessed CVSS:3.1 base of AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (vendor score 7.1 under CVSS 4.0), it is a moderate-priority, availability-only issue whose real-world exposure is narrowed by its configuration prerequisites and adjacency requirement.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved occurs when an unauthenticated adjacent attacker who is an established LDP peer sends crafted LDP messages, triggering a NULL pointer dereference in the routing protocol daemon (rpd) that can crash the daemon. The flaw is availability-only (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and requires MPLS with LDP configured and an operational LDP session; default configurations without MPLS/LDP are not exploitable. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV.
A crafted LDP message sent by a compromised LDP neighbor can trigger a reachable assertion failure that crashes the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, producing a denial-of-service condition on the affected device. Only devices with LDP/MPLS actively configured are exposed, and the attacker must already control a device that holds an established LDP adjacency with the target, so the CVSS 4.0 vector (7.1) is scored AV:A - adjacent network, not internet-reachable. Impact is availability-only: no confidentiality or integrity effect, with no confirmed actively exploited campaigns (not in CISA KEV) and no public exploit code identified at time of analysis; this is a moderate-priority availability issue rather than a top-tier emergency.
A malformed BGP VPLS signaling update can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service on the affected device. The flaw is improper input validation (CWE-20) in rpd's handling of BGP signaling messages; the attack vector is adjacent and the CVSS 4.0 vector carries PR:N (no privileges required), but successful exploitation requires the target to be running BGP with VPLS signaling configured and to already have an established peering relationship with the attacking peer. Impact is limited to availability (rpd restart, routing churn, potential traffic loss) with no confidentiality or integrity impact; no public exploit code has been identified and there is no KEV confirmation of active exploitation at time of analysis, so this is a genuine but bounded operational risk rather than an urgent emergency.
An adjacent eBGP peer can crash the Juniper Junos OS and Junos OS Evolved routing protocol daemon (rpd) by sending a crafted VPLS signaling update, but only on routers where VPLS automatic site-ID negotiation is enabled and an external BGP peering session is already established. The flaw is a reachable assertion (CWE-617) in rpd that terminates the process, producing a denial of service with no confidentiality or integrity impact; Juniper rates it 7.1 under CVSS 4.0, and our independent assessment scores it CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, treating it as a moderate-priority availability issue rather than an emergency. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed actively exploited (no CISA KEV listing), so risk is concentrated in networks that combine external BGP peering with non-default VPLS auto site-ID negotiation.
Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG with ICCP can be disrupted by an adjacent, unauthenticated attacker who sends an inconsistent ICCP peer message that triggers a reachable assertion in the l2ald daemon. Successful exploitation results in a denial of service affecting availability, with no confidentiality or integrity impact; no public exploit was identified at time of analysis, and the attack is limited to environments that have the non-default MC-LAG/ICCP redundancy feature enabled and where the attacker can reach the ICCP peer relationship at Layer 2.
An unauthenticated attacker with an adjacent network position can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved devices by sending a specifically crafted RSVP packet, producing a denial of service on affected routing platforms. The flaw is a reachable assertion (CWE-617) that only triggers when RSVP signaling is enabled - i.e., devices running MPLS RSVP-TE within rpd - so unconfigured devices are not on the vulnerable path, and no data confidentiality or integrity impact is involved. As of analysis, there is no CISA KEV listing and no public exploit identified at time of analysis; vendor patches are available, and the real-world risk is tempered by the adjacency and RSVP-configuration prerequisites, making this a moderate rather than top-priority issue.
An out-of-bounds write in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241, and QFX5250 switches configured for BGP global-load-balancing with more than 128 ECMP next-hops allows unauthenticated adjacent-network attackers to crash rpd, causing a denial of service. This moderate-severity (CVSS 6.5) flaw is availability-only; exploitation requires the specific hardware and non-default routing configuration, and no public exploit code has been identified at time of analysis. Devices not configured for BGP global-load-balancing or with 128 or fewer ECMP next-hops are not affected.
Unauthenticated adjacent IS-IS peers can cause a denial of service in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series by sending crafted input that fails proper quantity validation (CWE-1284). This medium-severity flaw (CVSS 6.5, AV:A/PR:N/UI:N/A:H) requires the attacker to hold Layer 2 adjacency on a directly connected or shared broadcast segment; no authentication or user interaction is needed. No public exploit code has been identified at time of analysis.
Memory exhaustion in the Juniper Networks Junos OS and Junos OS Evolved l2cpd process allows an unauthenticated attacker on the same Layer 2 segment to disrupt Layer 2 control-plane operations by sending LLDP traffic, but only when the non-default LLDP fast-receive-processing feature is enabled. No authentication or user interaction is required, and the impact is limited to availability (CVSS 3.1 7.1, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity effect. A vendor patch is available through Juniper advisory JSA112187, and no public exploit code has been identified at time of analysis.
Denial of service in Juniper Networks Junos OS allows an attacker on an adjacent Layer 2 network segment to exhaust resources in the l2cpd (Layer 2 Control Protocol) process, causing the daemon to restart and disrupting Layer 2 control-plane services on the affected device. The attack is unauthenticated and requires no user interaction, but is only reachable when the FNP feature is enabled on a VPLS routing instance that also has VLAN-VPLS encapsulation configured - a specific, non-default deployment that limits exposure; remote internet-based exploitation is not possible. All Junos OS platforms are potentially affected except the PTX Series and SRX Series, and no public exploit code or confirmed active exploitation was identified at time of analysis (the issue is not listed in CISA KEV), though a vendor patch is available.
An out-of-bounds read in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated attacker on the adjacent network crash the daemon and disclose limited process memory by sending a crafted Connectivity Fault Management (CFM) message to an interface with CFM configured. Affected releases span Junos OS 23.x through 26.2 and corresponding Junos OS Evolved branches, with fixes available per Juniper advisory JSA112187. Exploitation is bounded by the non-default requirement that CFM be configured on a reachable Layer 2 interface; no public exploit identified at time of analysis.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-adjacent attacker to trip a reachable assertion in the bfdd daemon and restart it by sending crafted Bidirectional Forwarding Detection (BFD) session traffic. Only devices running an affected release train with BFD configured on at least one session are exposed, and the impact is confined to availability: repeated daemon restarts can disrupt BFD-based link-failure detection and slow routing convergence, but there is no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and the requirement that the attacker be on the same L2 segment or directly connected link (PR:N, AV:A) sharply limits the attacker population, making this a genuine but constrained availability risk rather than a top-tier emergency.
A namespaced authenticated attacker holding access to a Kubernetes service account can impersonate the NGINX Agent gRPC connection in NGINX Gateway Fabric and read TLS private keys belonging to Gateway deployments in other namespaces. Exploitation requires the Gateway Custom Resource Definition to be configured and an authenticated gRPC link between the control plane and NGINX Agent, making this an access-gated control-plane disclosure flaw with no data plane exposure. No public exploit code was identified at the time of analysis.
Denial of service in Nodemailer versions 3.0.0 up to but not including 10.0.10 allows an attacker who can influence message content - specifically the recipient list (to/cc/bcc) or header fields passed to the message builder - to force quadratic header unfolding in MessageParser.parseHeaders, exhausting CPU and blocking the Node.js event loop while DKIM signing is performed. Only low-privileged access to the send functionality is required (CVSS PR:L), and impact is limited to availability: no data exposure, integrity loss, or code execution is involved. There is no public exploit identified at time of analysis, and exploitation additionally depends on DKIM signing being active in the same process, which makes real-world risk highest for multi-tenant mail-sending services that accept user-controlled recipients or headers.
Denial of service in FreeRDP 3.0.0 through 3.31.x allows a malicious RDP gateway to pin a client thread at full CPU indefinitely via an infinite loop in http_response_recv(). An attacker who controls the gateway endpoint the client connects to can return an HTTP response with a nonzero Content-Length and an unrecognized, semicolon-containing Content-Type header, causing the client to consume CPU without progress. Exploitation is unauthenticated but requires the victim to initiate a gateway-mode connection (user interaction); no public exploit code has been identified at time of analysis, and the issue is a moderate-severity availability concern with no impact on confidentiality or integrity.
Null pointer dereference in FreeRDP versions 2.0.0 through 3.31.x allows a malicious RDP server to crash Linux clients that have serial-port redirection enabled. The attacker sends IRP_MJ_READ or IRP_MJ_WRITE requests either before the serial channel is created or after it is closed, causing CommReadFile or CommWriteFile to dereference a null handle and terminate the client. This is an availability-only issue (CVSS 4.0 score 7.1, no confidentiality or integrity impact) that requires the victim to initiate a connection to the attacker-controlled server and have serial redirection active; no public exploit code has been identified at time of analysis.
Null pointer dereference in the FreeRDP client's rdpsnd (audio redirection) channel allows a malicious or compromised RDP server to crash any connecting client running FreeRDP 3.0.0 through 3.31.x, producing a denial of service that terminates the user's RDP session. The trigger is a malformed rdpsnd fragment that sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST and arrives on a fresh channel; the CVSS vectors (4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VA:H, and the assessed 3.1 equivalent AV:N/AC:L/PR:N/UI:R/A:H) confirm unauthenticated remote reach but strictly availability-only impact - no confidentiality, integrity, or code-execution effect. Exploitation requires the victim to initiate a session against the attacker's server and to have audio redirection negotiated; there is no evidence of in-the-wild exploitation and no public exploit identified at time of analysis.
Crafted RSVP packets can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, producing a denial of service on devices where non-default Layer 2 label-switched path (L2 LSP) RSVP signaling is enabled. The issue is an adjacent-network, unauthenticated attack (CVSS v4.0 7.1, AV:A/AC:L/PR:N/UI:N, availability-only impact, and our independent assessment concurs with CVSS:3.1 AV:A/AC:L/PR:N/UI:N/A:H): the attacker must sit on the same Layer 2 segment as the target but needs no credentials and no user interaction, and a single malformed packet is sufficient. No public exploit code exists and there is no confirmed active exploitation at time of analysis, and the practical exposure is bounded because L2 LSP support is a non-default configuration; Juniper advisory JSA112187 provides patched releases.
Authorization bypass in FileRise prior to 3.18.0 allows an authenticated, low-privileged user to read - and, when they also hold edit-own permission, modify - files they do not own by exploiting a collision in folder metadata filenames. FileRise flattens logical folder paths into metadata filenames by replacing '/', '\\' and spaces with hyphens, so distinct folders such as team/docs and team-docs resolve to the same <name>_metadata.json file; an attacker who controls one colliding folder and knows the target basename can overwrite the uploader-ownership metadata that read_own and ownership-restricted edit checks rely on, making a victim file appear attacker-owned. The issue is rated CVSS 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L) and is fixed in 3.18.0; exploitation requires a multi-user deployment, a crafted colliding folder name, pre-existing read_own access to the target folder and knowledge of the exact victim basename, and no public exploit identified at time of analysis. Single-tenant or single-user installations are effectively unaffected because no second user exists to victimize.
Reflected cross-site scripting (XSS) in the SimplyRETS Real Estate IDX WordPress plugin (versions up to and including 3.2.9) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser session when they click a crafted link. The vulnerability requires user interaction (UI:R) and is non-persistent; no public exploit code or active exploitation has been identified at time of analysis. The specific vulnerable parameter is not named in the advisory, but the issue is a CWE-79 improper neutralization flaw.
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to crash the routing protocol daemon (rpd) on an affected device that is deployed in a BGP traffic-engineering scenario, simply by delivering a single valid, optional, non-transitive BGP update over an already-established BGP session. The crash triggers an automatic rpd restart, so the impact is a temporary loss of routing and forwarding until the control plane reconverges rather than persistent compromise, and exploitation is practical only for an adjacent BGP peer or an attacker able to inject into an existing session - arbitrary internet-based exploitation is not possible. Affected releases include all Junos OS versions before 23.2R2-S6 as well as the 23.4, 24.2, 24.4 and 25.2 branches, plus the corresponding Junos OS Evolved releases; vendor patches are available via JSA112168, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis.
DOM-based cross-site scripting in the Crocoblock JetEngine plugin for WordPress (all versions through 3.8.16) lets remote attackers inject script that executes in a victim's browser when the victim interacts with attacker-controlled input processed by the plugin's client-side JavaScript. The vulnerability is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and carries a mandatory user-interaction requirement, so impact is confined to the browser session of a user who loads or clicks a crafted page or link rather than to the server itself. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); this is a moderate-priority issue rather than an emergency, though the plugin's broad install base on WordPress sites makes prompt patching advisable.
Adjacent attackers can crash the Juniper Networks Junos OS and Junos OS Evolved routing protocol daemon (rpd) by sending a crafted LDP packet into an already-established LDP session, causing a denial of service on the affected router. Only devices running MPLS with LDP enabled and an active LDP peering session are exposed, and the attacker must already hold a position on the adjacent network capable of injecting packets into that session (CVSS 3.1 AV:A/AC:L/PR:N/UI:N with availability-only impact; vendor CVSS 4.0 base 7.1). There is no confidentiality or integrity impact - the outcome is loss of rpd availability, though repeated crashes can degrade routing stability; no public exploit has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV).
Denial of service in Juniper Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to crash the routing protocol daemon (rpd) by sending specifically malformed LSP-ping packets; this is a moderate-priority availability vulnerability, not a critical compromise, because it requires an adjacent-network position and MPLS LSP-ping processing to be enabled. No public exploit has been identified at time of analysis, and Juniper has released fixed software versions for both Junos OS and Junos OS Evolved. Successful exploitation causes only availability impact to rpd, with no data exposure or modification.
Unauthenticated adjacent attackers can crash the routing protocol daemon (rpd) on Juniper MX Series devices running Junos OS and ACX Series devices running Junos OS Evolved by sending a malformed IGMPv3 membership report over a directly connected network, producing a denial of service. The defect is a NULL pointer dereference (CWE-476) reached while the device processes IGMPv3 membership traffic, so exploitation requires multicast/IGMP to be configured and active on the receiving interface, and it does not yield any confidentiality or integrity impact. Vendor-reported CVSS 4.0 base score is 7.1 (AV:A, PR:N, UI:N, VA:H), and there is no public exploit identified at time of analysis; a vendor patch is available per Juniper advisory JSA112187 (EUVD-2026-101386).
Malformed OSPF packets crafted by an adjacent OSPF peer can crash the Juniper Networks Junos OS rpd routing daemon or disclose portions of its process memory, affecting both Junos OS and Junos OS Evolved builds below the fixed releases enumerated in JSA112187 (for example Junos OS prior to 23.2R2-S7.7, 24.2R2-S5.5 and 25.2R2-S2, and the corresponding -EVO builds). The weakness is an unauthenticated adjacent attack (CVSS v4.0 base 7.1, AV:A/PR:N/UI:N with high availability and low confidentiality impact), meaning the attacker must already hold or establish OSPF adjacency on the same routing segment, so exposure is confined to devices actively running OSPF rather than the general internet. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are already available, making this a moderate-priority routing-infrastructure issue rather than a mass-exploitation emergency.
Cross-tenant knowledge-base file read in Nexent through 2.7.0 allows any authenticated tenant to access other tenants' source documents by exploiting a missing tenant check in the check_file_access function for knowledge_base/ paths. Attackers in multi-tenant deployments can list objects via GET /file/storage to obtain presigned URLs or directly download files via GET /file/download/{object_name}. This is an authenticated information disclosure flaw requiring a valid account; no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in GitPython before 3.2.0 lets attackers leak environment-variable secrets through crafted submodule names in a repository's .gitmodules file. The flaw occurs when Repo._clone() calls Git.polish_url() without expand_vars=False, so variable syntax in a submodule name is expanded during clone plus submodule_update and the resulting values surface in .git/modules directory names and DEBUG logs. Exploitation is unauthenticated per the CVSS vector (PR:N) but requires the victim to clone an attacker-supplied repository and invoke submodule handling, and leakage only materializes if sensitive values are present in the process environment; no public exploit code, CISA KEV entry, or EPSS score was identified in the provided data, and integrity and availability are unaffected (CVSS 4.0 base 7.1, moderate severity).
Authorization bypass in n8n versions before 1.123.83 allows an authenticated member account to spoof workflow identity by supplying a trusted workflow identifier in the Execute Sub-workflow node's inline JSON mode, enabling credential resolution from projects the attacker does not belong to and unauthorized modification of another workflow's static data and error-workflow dispatch. The vulnerability (CWE-639, authorization bypass through user-controlled key) requires valid low-privilege credentials plus knowledge of a foreign workflow identifier, so single-tenant, single-project, or non-inline-JSON deployments are materially less exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, and the independent assessment rates this as a moderate, authenticated-access issue rather than a mass-exploitation emergency.
Memory corruption in FreeRDP's grayscale JPEG clipboard conversion can crash the RDP client when a malicious server delivers a crafted clipboard item that the victim pastes as CF_DIB bitmap data. The flaw is a heap-based out-of-bounds write in winpr_convert_from_jpeg, affecting versions 3.3.0 up to but not including 3.32.0 that are built with the non-default WINPR_UTILS_IMAGE_JPEG=ON option. Exploitation requires the victim to connect to an attacker-controlled RDP server with clipboard redirection active and to actively paste the malicious grayscale JPEG; no public exploit code has been identified at time of analysis, and the impact is primarily availability-focused (crash) with limited integrity impact.
Credential theft in Heym 0.0.55 through 0.0.120 allows a shared collaborator to seize the error_workflow_id execution field and repoint it at an attacker-controlled workflow containing an HTTP node, so that when the owner's parent workflow enters an error state the owner's decrypted credentials are injected into the attacker's workflow and exfiltrated over the network. The attack is remote and low-complexity, requiring only low privileges - an existing collaboration grant on the target workflow (PR:L per both the supplied CVSS 4.0 vector and the assessed CVSS 3.1 vector) - with no user interaction, producing high confidentiality impact and only low integrity impact from the single overwritten field. No public exploit code or CISA KEV entry was identified at time of analysis, and single-owner Heym deployments that do not use shared collaborators are not exposed.
Reflected cross-site scripting in the Crocoblock JetProductTables WordPress plugin (all versions through 1.2.4) allows an unauthenticated attacker to execute arbitrary script in a victim's browser by luring them to a crafted URL, which can lead to session theft or privileged actions such as content injection if an administrator clicks the link. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so exploitation depends on user interaction (UI:R) and the payload is not persisted; the advisory reports a base score of 7.1 while our independent impact assessment keeps confidentiality and integrity low with no availability impact. No public exploit code or active exploitation (CISA KEV) is identified at time of analysis, making this a social-engineering-dependent risk that matters most on sites where privileged users are likely to click untrusted links.
Reflected cross-site scripting in the Brainstorm Force SureCart WordPress e-commerce plugin (all versions through 4.9.3) allows an unauthenticated attacker to run arbitrary JavaScript in the browser of a logged-in SureCart/WordPress user - typically a store administrator or operator - by delivering a crafted URL containing the payload (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Because the flaw is purely reflected there is no persistence: every victim must be individually lured into clicking the malicious link while authenticated, and no public exploit code for this CVE has been identified at time of analysis and it is not confirmed actively exploited (CISA KEV). Independent assessment rates this a moderate-risk, not top-priority, issue, with the mandatory user interaction (UI:R) being the main factor limiting realistic exploitation compared with a no-interaction bug.
Reflected cross-site scripting (CWE-79) in the VideoWhisper 'Paid Videochat Turnkey Site' WordPress plugin (ppv-live-webcams) affects all versions through 7.5.12 and lets an unauthenticated attacker inject script into a reflected parameter that executes in the browser of a victim who clicks a crafted link. The attack is not self-triggering: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows no attacker authentication is needed but a victim must be socially engineered into following the malicious URL while logged in to a site running the plugin, and impact scales with the victim's privileges (an administrator click enables higher-value session abuse). No public exploit code and no confirmed active exploitation have been identified at time of analysis, and no EPSS score was provided; the Patchstack advisory remains the single reference.
Stored cross-site scripting in WPManageNinja's Best Payments Plugin for WP (WordPress plugin slug wp-payment-form) through version 4.6.27 lets attackers inject script that the plugin persists and later executes in a victim's browser, typically a logged-in administrator viewing the stored content in the WordPress dashboard, as required by the UI:R metric. The vulnerability is a CWE-79 improper-neutralization flaw rated 7.1 by the Patchstack reporter; our assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting low confidentiality and integrity impact within a changed browser scope and no availability impact, with PR:N implying the initial injection does not require credentials though the advisory should be confirmed as to whether the vulnerable sink is a public-facing submission form or an authenticated plugin area. There is no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation, so real-world risk depends on the plugin's payment or submission feature being in use and an administrator visiting the poisoned page.
Reflected cross-site scripting (moderate severity, reported CVSS 7.1) in the Hippoo Mobile App for WooCommerce plugin (versions through 1.12.0) allows remote attackers to inject malicious scripts that execute in the browser of a user who clicks a crafted link. Exploitation requires a victim with an active session on the affected WordPress/WooCommerce site - typically a logged-in administrator - to interact with the link (UI:R), but no attacker authentication is needed (PR:N). As of this analysis, no public exploit code has been identified and the vulnerability is not known to be actively exploited.
Renovate before 44.60.1 permits authenticated repository users with configuration influence to circumvent the allowedHeaders restriction by embedding hostRules[].headers inside shared presets, causing custom HTTP headers to be injected into outbound requests Renovate makes to other hosts. This is an allowlist/authorization bypass requiring low privileges (PR:L per CVSS) and specific, condition-dependent prerequisites (AC:H), making it an insider or supply-chain-style abuse rather than anonymous remote exploitation. It is not confirmed as actively exploited (no CISA KEV entry) and no public exploit code has been identified at time of analysis.
OSPF-triggered denial of service in Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated adjacent OSPF peer crash the routing protocol daemon (rpd) when OSPF Source Packet Routing best-route Prefix-SID installation is configured, causing a reachable assertion (CWE-617) and loss of routing availability. Exploitation is genuinely conditional rather than broad-impact: the target must run the non-default SPRING/segment-routing Prefix-SID configuration, and the attacker must source OSPF traffic from within the routing domain on an adjacency rather than from across the internet, so routers without that feature enabled are not affected. No public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis, and Juniper has released fixed maintenance releases.
Incorrect authorization (CWE-863) in VentureDrake Laravel CRM before 2.4.0 allows an authenticated account that already holds user-management privileges to assign roles it is not entitled to hand out - including the 'Owner' role or a role belonging to another team - by tampering with the 'role' parameter accepted by Role::find() in UserController::store/update, and to remove cross-team users through the unscoped UserIndex Livewire delete() method. The result is privilege escalation to Owner-level control plus cross-tenant user deletion on affected installations; the CVSS v3.1 assessment is AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H (high integrity and availability impact, no confidentiality impact). The issue is fully remediated in version 2.4.0 through an AssignableRole validation rule and an explicit Owner-role guard, and no public exploit was identified at time of analysis - reachability is gated by the need for a privileged administrative account (PR:H), so risk is real but not a mass-exploitation emergency.
A signature bypass in n8n's waiting-webhook endpoint allows attackers who possess a valid resume token for an existing Send-and-Wait execution to approve waiting executions intended for other users, causing downstream workflow actions to run under the workflow owner's credentials, which may include command execution if the workflow is configured to perform such actions. Affects n8n versions before 2.41.4 and 2.42.x before 2.42.1. No public exploit identified at time of analysis; exploitation requires a valid resume token (no authentication to n8n itself is needed beyond the token), and the impact is bounded by the target workflow's downstream nodes. This is a moderate-to-high priority issue for organizations running n8n, but not a drop-everything emergency.
The SeaweedFS Helm chart between versions 4.0.388 and 4.41 embedded a single, unencrypted Ed25519 SFTP host private key in the chart template k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml, so every deployment following the legacy configuration path presents the same publicly known SSH host identity. A standalone deployment is exposed only when a specific chain of non-default settings is met at once (sftp.enabled=true, sftp.enableAuth=true, no existingSshConfigSecret supplied, the legacy sftp.sshPrivateKey path selected, a valid config-ssh Secret permitting startup, and no overriding Ed25519 signer via hostKeysFolder); default all-in-one and non-authenticated standalone deployments never load the key and are unaffected. An attacker who already holds a traffic redirect or interception (MITM) position and whose victim client actually connects while trusting that published host identity could impersonate the SFTP endpoint and capture password credentials or data sent to the rogue server; there is no public exploit identified at time of analysis, and the high attack complexity, MITM positioning requirement, and mandatory user interaction keep real-world risk limited despite the 7.0 'High' CVSS 4.0 rating.
SQL injection in the version 1 Microsoft SQL node of the n8n workflow automation platform lets unauthenticated external callers execute arbitrary SQL against a connected database whenever a workflow binds untrusted input (for example, webhook fields) into the node's Query field via an expression. Affected deployments are n8n before 2.41.4 and the 2.42.x line before 2.42.1; exploitation is strictly gated on that specific insecure workflow configuration (AT:P), so default installs and workflows that use parameterised inputs are not exposed. Injected statements run with the privileges of the credential stored in the node; no public exploit code and no confirmed active exploitation were identified at time of analysis.