Unauthenticated path-traversal file writes in the EnergizeLab Eilik and EilikO AI skill upload endpoint allow any remote attacker who can reach the FastAPI AI inference and profiling service to write arbitrary files on the robot's host system by supplying crafted traversal filenames in an upload request. Because the endpoint enforces neither authentication nor path constraints, exploitation is a straightforward, low-complexity primitive that lets an attacker tamper with the AI skill files the robots execute, degrading or subverting robot behavior and causing high integrity and availability impact (CVSS 3.1 base 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, CWE-434); confidentiality is assessed as unaffected. The practical limiting factor is network reachability rather than credentials or configuration - these are consumer robots whose service is normally confined to the local network segment, so real-world exposure is materially narrower than the AV:N vector implies, and no public exploit code or confirmed active exploitation was identified at time of analysis (the flaw itself needs no user interaction or non-default toggle once the endpoint is reachable).
CRLF injection in Netgate pfSense CE 2.7.1 through 2.9.0 allows authenticated users with the 'DNS Resolver: Advanced' privilege to inject arbitrary Unbound directives via the sock_queue_timeout parameter. This can override local DNS records and forwarding for all clients, impacting integrity and availability. Publicly available exploit code exists, and the issue is rated medium severity (CVSS 4.0 base 5.1).
Authenticated pfSense CE users holding the 'DNS Resolver: Access Lists' privilege can embed CR/LF characters in the aclname or aclaction fields of an Unbound access list, causing attacker-supplied Unbound directives (local-data, local-zone, forward-zone) to be written into access_lists.conf and letting the attacker control which DNS answers are served to LAN clients. All pfSense CE versions through 2.9.0 are affected (CPE cpe:2.3:a:netgate:pfsense_ce:*), the root cause is CWE-93 (improper neutralization of CRLF sequences), and publicly available exploit code exists; there is no CISA KEV confirmation of active exploitation. Because the CVSS vector requires PR:H, exploitation demands an authenticated account with a specific, highly privileged DNS configuration role, so realistic risk is insider misuse or abuse of a compromised privileged session rather than opportunistic external attack - a genuine but bounded-priority issue rather than an emergency.
Remote, unauthenticated attackers can unlock Mitsubishi Electric's ICONICS GENESIS, GENESIS64, ICONICS Suite and related SCADA/HMI products by obtaining the system's challenge-response unlock value, which the vendor confirms is fixed and identical for every user and every installation, after which the attacker can disclose, tamper with, destroy or delete internal information or force the system into a denial-of-service condition. Affected builds are GENESIS 11.03 and prior, GENESIS64/ICONICS Suite/Hyper Historian/AnalytiX/MobileHMI/IoTWorX 10.97.3 and prior, and MC Works64, GENESIS32 and BizViz at all versions. The vendor assigns CVSS 4.0 a 9.2 score, while our independent CVSS 3.1 assessment lands at 8.1 (AV:N/AC:H/PR:N/UI:N) because exploitation hinges on the one-time prerequisite of acquiring the static challenge response (the CVSS 4.0 AT:P attack requirement); no public exploit code and no confirmed active exploitation were identified at time of analysis, so the risk driver is the universal reusability of a single leaked value rather than any observed campaign.
Server-side template injection in Tianji (msgbyte/tianji) before version 1.31.29 allows an attacker who already holds workspace-administrator privileges to execute arbitrary JavaScript inside the Tianji Node.js process by storing a lodash evaluate block ('<% code %>') in a survey feedTemplate or a monitor notification template. Because formatString() in src/server/utils/template.ts leaves the default lodash evaluate pattern enabled, the planted payload is rendered - and runs - when any unauthenticated user submits a response to the public survey.submit endpoint, so no victim administrator interaction is required to trigger it. The result can be command execution, secret disclosure, data modification, or service disruption; the vendor rates it CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), and the practical limiting factor is the workspace-admin prerequisite rather than any external exploitability. There is no public exploit identified at time of analysis and the issue is fixed in version 1.31.29.
Unauthenticated authorization bypass in the OpenNMS Meridian and Horizon REST API lets any remote attacker who can reach /rest/** read the monitored inventory and create, modify, or delete resources without credentials. The flaw arises because the Spring Security intercept-url rules match the HTTP method as a case-sensitive uppercase token and the filter chains terminate without a deny rule, so a request using a non-canonical method token (for example 'get' or 'put' instead of 'GET'/'PUT') matches no rule and is served without authentication; the /rest/alarms chain additionally leaks whether a specific alarm exists via a difference in the response. All pre-fix Meridian and Horizon versions in default configuration are affected, the vendor-supplied CVSS 3.1 base score is 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, i.e. unauthenticated and low complexity), and no public exploit code was identified at time of analysis; the practical limiting factor is deployment posture, since the vendor states these products belong on private networks and should not be Internet-facing.
Password-recovery brute force in MacCMS v10 (through 2026.1000.4056) lets unauthenticated remote attackers take over member accounts: the six-digit reset code is never rate-limited, so anyone who knows a victim member's registered email address or phone number can request a code and repeatedly submit guesses to findpass_reset until the correct value is found, then overwrite the member's password. Because no attempt cap, lockout, or backoff is enforced, a 1,000,000-value code space becomes brute-forceable within the code's validity window, though the attacker must already know the target identifier and the impact is confined to member (non-administrator) accounts. Assessed as high severity (published CVSS 4.0 base 9.1; independent 3.1 assessment AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact); there is no CISA KEV entry and no dedicated exploit tooling confirmed, although a public technical writeup documents the brute-force technique.
Stored cross-site scripting in Aureus ERP through 1.6.0 allows an authenticated user who can create or edit Inventory Operation Types and Location names to embed HTML/JavaScript in those fields, which are rendered without escaping by the Filament-based Rule form and infolist and then execute in the browser session of any warehouse manager or administrator who views or edits an affected Inventory Rule. The attack is not anonymous and not autonomous: the attacker must already hold an account with inventory-configuration permissions (CVSS PR:L), and the payload only fires once a privileged victim opens the affected screen (UI:R), limiting impact to actions available in that victim's session. Publicly available exploit code exists (a HackMD write-up is referenced), the issue is not listed in CISA KEV and shows no confirmed active exploitation, and the vendor fix is available upstream via pull request 1619.
Stored cross-site scripting in Webkul's Aureus ERP through version 1.6.0 allows an authenticated user holding permission to create Public Holidays or Mandatory Days to store JavaScript in a holiday name, which is then rendered unescaped as an HtmlString inside the Time-Off plugin's Holiday modal. The payload executes in the browser of any HR manager or administrator who opens that modal, enabling session hijacking or privileged actions in the victim's context. Publicly available exploit code exists, but the issue is moderate-priority rather than an emergency: the CVSS 4.0 vector (PR:L/UI:P) requires a valid low-privilege account with holiday-creation rights, and the script only fires when a privileged user actually opens the affected modal rather than self-triggering.
Certificate pinning and custom TLS identity checks can be silently bypassed in undici versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1 because the Agent dispatcher drops function-valued tls options such as checkServerIdentity during a JSON deep clone before per-origin pool creation. An unauthenticated man-in-the-middle attacker who can present a certificate satisfying Node.js default hostname and chain validation but that the application's custom callback would have rejected can then be accepted, affecting request, fetch, and setGlobalDispatcher paths plus EnvHttpProxyAgent direct and no-proxy routes when applications rely on function-valued TLS verification. This is a conditional security-control bypass rather than a broad remote-code or data-theft flaw; no public exploit identified at time of analysis and no CISA KEV active exploitation is reported, while vendor-released patches are available in undici 6.29.1, 7.30.1, and 8.12.2.
Persistent cache poisoning and disclosure of user-specific responses affect undici 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1 when an originless Agent uses a shared cache store and composes the redirect interceptor before the cache interceptor. An unauthenticated remote attacker who controls the target of a redirect from a trusted URL can have the resulting cross-origin response stored under that trusted URL and served to later callers, or cause a private redirect response to be stored under the original URL and exposed to a later caller. Exploitation requires all three non-default conditions (originless Agent, shared cache store, redirect-before-cache ordering) and attacker control of a redirect target; no public exploit code or active exploitation was identified at time of analysis, and EPSS is 0.15% (4th percentile). Vendor-released patches are undici 7.30.1 and 8.12.2.
Authentication bypass in the joserfc Python library before 1.7.4 lets remote, unauthenticated attackers submit a JWS General JSON Serialization whose "signatures" array is empty and have joserfc.jws.deserialize_json() accept it as authenticated, so relying applications can be fooled into treating an arbitrary attacker-chosen payload as a signed, trustworthy message. Exposure is scoped: only the General JSON Serialization code path is affected - compact JWS, JWT decoding, Flattened JSON serialization, and JWE JSON processing do not reach the vulnerable logic - but where the vulnerable API is used and its success is treated as proof of authenticity, the integrity impact is high (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N per the independent assessment; the published base score is 9.1). No public exploit code or confirmed active exploitation has been identified at time of analysis; the fix commit, tests, and security advisory are publicly available.
QNAP HybridDesk Station (HD Station) before 4.2.22 contains a missing authentication flaw in a critical function, allowing unauthenticated attackers on an adjacent network to gain access to the system. Exploitation is constrained by a specific attack precondition and passive user interaction, and only QNAP NAS devices with the optional HD Station app installed and enabled are exposed. The vendor has released HybridDesk Station 4.2.22 and later as a fix; no public exploit was identified at time of analysis.
Authenticated path traversal in Lychee photo-management tool prior to 7.6.4 allows any logged-in user to read files accessible to the web process - including the application's .env file with APP_KEY and database credentials, and other users' private images - by sending encoded traversal segments to GET /image/{path}. Exploitation is not unconditional: it requires the supported but non-default configuration with temporary_image_link_enabled on and both temporary_image_link_when_logged_in and secure_image_link_enabled off, so default installations do not expose the vulnerable code path in an exploitable state. The impact is read-only information disclosure (no write or availability effect) and disclosure of APP_KEY or DB credentials can escalate to further compromise; no public exploit was identified at time of analysis, and the vendor fixed the flaw in 7.6.4.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition due to a path traversal flaw (CWE-22) that permits an attacker with low-privilege credentials to escape restricted directories and execute code over the network. The vulnerability carries a CVSS score of 8.8 (AV:N/AC:L/PR:L/UI:N) and requires a valid SharePoint session, making it a credible priority for patching but not an immediate emergency according to current evidence. A vendor patch is available, and no public exploit code has been identified at time of analysis.
Arbitrary OS command execution on hosts running MoviePilot through 3.1.5 is achievable when the product's LLM agent ingests attacker-controlled content via browse_webpage, search_web, or torrent metadata parsing and is induced to call the unrestricted ExecuteCommandTool, which runs shell commands through asyncio.create_subprocess_shell under the admin session's is_admin context. The flaw is a prompt-injection-to-RCE chain (CWE-1427) that bypasses the validate_command_safety denylist by setting confirm_dangerous=true; the attacker needs no MoviePilot credentials (CVSS PR:N), but an administrator must interact with the poisoned content (UI:P in CVSS:4.0, UI:R in the assessed CVSS:3.1) and the model must be successfully coerced, so the issue is conditionally gated rather than a mass-exploitation emergency. Severity is 8.7 in CVSS:4.0 and 8.7 in the independently assessed CVSS:3.1; no public exploit code and no CISA KEV entry are associated as of this analysis.
Out-of-bounds read in the Driftregion iso14229 UDS server library before version 0.10.1 lets an unauthenticated sender crash the diagnostic stack or disclose adjacent memory by submitting a short RequestFileTransfer (SID 0x38) request whose filePathAndNameLength field is set to 0xFFFC-0xFFFF, wrapping the length arithmetic and defeating the buffer-length check before file-transfer callbacks read past the receive buffer. The issue carries a CVSS 4.0 base score of 8.8 and is assessed as AV:N/AC:L/PR:N/UI:N with low confidentiality and high availability impact (CWE-190 integer wraparound), so no credentials or user interaction are required once the handler is reachable. No public exploit code has been identified at time of analysis and no EPSS score was supplied; real-world exposure is gated by transport, since AV:N holds only where the server is reachable over an IP transport such as DoIP, whereas the typical CAN/ISO-TP deployment restricts an attacker to the vehicle or device bus.
Remote code execution in ThemeHigh's Email Customizer for WooCommerce (Pro) through version 3.9.5 allows any authenticated user with subscriber-level access or higher to write attacker-controlled PHP into executable files inside the WordPress uploads directory through the plugin's send_test_mail() function, leading to full site compromise. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) makes clear that the low-privilege account requirement is the main gate; exposure is greatest on WooCommerce stores that permit open customer/subscriber self-registration rather than manual account approval. Code execution also depends on the server permitting PHP to run from the uploads path, so sites that already harden that directory are materially less exposed, and no public exploit code has been identified at time of analysis.
Heap-based memory corruption in Microsoft Word - affecting Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 - lets a remote, unauthenticated attacker execute arbitrary code in the context of the victim, but only when that victim opens or previews a specially crafted Word document. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms the trigger is entirely dependent on user interaction, so there is no zero-click or server-side path; no public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available. That combination - high technical severity but a required user action and an available fix - makes this a high-priority vulnerability rather than an emergency.
Heap-based buffer overflow in Microsoft Word allows remote, unauthenticated attackers to execute arbitrary code when a user opens a maliciously crafted document. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and their macOS editions, with a CVSS score of 8.8; no public exploit identified at time of analysis, and CISA KEV does not list active exploitation, though high impact and low attack complexity make this a genuine high-priority issue. The primary limiting factor is the required user interaction to open the weaponized file, and code runs with the victim's privileges rather than SYSTEM.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, and Office 365 for Mac when a user opens or previews a specially crafted document. The flaw is a stack-based buffer overflow (CWE-121) rated 8.8, reachable by unauthenticated remote attackers with PR:N but requiring user interaction with UI:R; successful exploitation yields code execution with the victim user’s privileges. A vendor patch is available, and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Word (CWE-122) allows an unauthorized attacker to execute code in the context of the victim when a specially crafted Word document is opened, earning a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw affects Word as shipped in Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021 and 2024 on both Windows and macOS. Exploitation is unauthenticated from the attacker's side but requires the victim to open an attacker-supplied file, so success depends on social engineering and on getting past Protected View or Mark-of-the-Web warnings for documents downloaded from the internet. No public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); patch data indicates a vendor fix is available via the Microsoft Security Response Center advisory.
Heap-based buffer overflow in Microsoft Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024) allows a remote, unauthenticated attacker to execute code in the context of the victim when a crafted document is opened, matching a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8 High). Exploitation is not interaction-free: the vector's UI:R component and the assessed conditions require file delivery plus a user open action, so Protected View and Mark-of-the-Web prompts materially limit real-world success. No public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available from Microsoft and this remains a genuine priority for patching.
Heap-based buffer overflow in Microsoft Word allows remote unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted document. Affects Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024. No public exploit identified at time of analysis, but this is a genuine high-priority issue given the potential for code execution and widespread product deployment; exploitation requires user interaction (opening or previewing the malicious file).
Code execution in Microsoft Word - across Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 - is achievable when a victim opens an attacker-crafted document containing a malformed numeric field that triggers an integer truncation flaw (CWE-197) inside the Word parsing path. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no authentication or prior access is needed, but successful exploitation is gated by mandatory user interaction: the target must open or preview a malicious file, so delivery depends on phishing, web download, or similar social-engineering vectors. At time of analysis there is no public exploit identified, and Microsoft has published a fix via its MSRC update guide, so fully patched installations are not exposed.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, where a heap-based buffer overflow (CWE-122) is triggered when a victim opens or previews a specially crafted document. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) shows an unauthenticated remote attacker needs no credentials, but the UI:R metric confirms victim interaction is mandatory, making delivery dependent on phishing or file-sharing social engineering. Successful exploitation yields code execution at the privilege level of the user who opened the file, with high confidentiality, integrity, and availability impact, but no scope change or privilege escalation beyond that user's context; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft. This is a credible patching priority despite the absence of exploitation telemetry.
Remote code execution in Microsoft Office Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS builds) allows an unauthenticated attacker to run arbitrary code in the security context of a victim who opens a specially crafted document. The flaw is a heap-based buffer overflow reachable over the network, and because it requires only low attack complexity and no privileges (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), the sole barrier to exploitation is the user-interaction requirement - the victim must open the malicious Word file, which is the primary limiting factor. No public exploit code has been identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status, but Microsoft has published a vendor patch, so this should be treated as a genuine high-priority, patch-now item rather than an emergency.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, where a crafted document triggers a heap-based buffer overflow and lets an unauthenticated attacker run code in the context of the victim. Exploitation is network-delivered (email or web) but requires the user to open or preview the malicious file (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R); no elevated privileges are needed on the target. No public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch per its advisory; the severity and default-configuration reachability make this a real patching priority despite the user-interaction dependency.
Remote code execution in Microsoft Excel is possible when a user opens or previews a specially crafted spreadsheet, which triggers a use-after-free during file parsing and lets an unauthenticated attacker run code in the context of the victim. The flaw carries a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, the Mac LTSC and Office 365 for Mac builds, and Office Online Server, with no attacker authentication required but mandatory user interaction (UI:R) - meaning successful exploitation depends on social engineering rather than automatic server-side triggering, and Protected View plus Mark-of-the-Web warnings can interrupt the chain. At time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, and Microsoft has published a vendor fix via its MSRC update guide; risk is high but manageable through prompt patching and the existing Office security defaults.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office for Mac/LTSC for Mac editions, allowing an unauthenticated attacker to execute arbitrary code by convincing a victim to open a specially crafted document (UI:R). The stack-based buffer overflow (CWE-121) requires no privileges or non-default configuration (PR:N, AC:L), making it a high-priority target for social-engineering campaigns, though no public exploit code has been identified at time of analysis. Patch available per vendor advisory from the Microsoft Security Response Center.
Heap-based buffer overflow in Microsoft Office (Windows and macOS builds: Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 365/LTSC for Mac) allows unauthenticated remote attackers to execute arbitrary code when a victim opens a crafted document. Exploitation requires user interaction (UI:R in the CVSS vector) and is not zero-click, executing with the victim user's privileges rather than SYSTEM. No public exploit has been identified at time of analysis, and a vendor patch is available per the Microsoft advisory (CVE-2026-108444).
Remote code execution in Microsoft Word (part of Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021/2024) allows unauthenticated attackers to execute arbitrary code in the context of the victim who opens a crafted document. The vulnerability is an off-by-one error (CWE-193) in the Word parser that can corrupt memory, and no public exploit code or active exploitation has been identified at time of analysis. Microsoft has released a patch via its MSRC update guide.
Use-after-free memory corruption in Microsoft Office Word enables remote attackers to execute arbitrary code with the privileges of the user who opens a maliciously crafted document. The flaw is unauthenticated (PR:N) but requires the victim to open the document (UI:R), and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS editions (Office 365 for Mac, Office LTSC for Mac 2021/2024). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); vendor patches are available, making this a genuine high-priority patching target rather than an emergency.
Heap-based buffer overflow in Microsoft Word (CWE-122) enables remote code execution when a user opens an attacker-crafted document in an affected Office build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, or the Mac equivalents - and rates CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R): the malicious file must actually be opened, so delivery depends on phishing or document-sharing lures rather than autonomous network exploitation, and Protected View or Mark-of-the-Web sandboxing on untrusted documents can block the trigger until the user dismisses it. Vendor patches are available via the Microsoft Security Response Center update guide; no public exploit code or confirmed active exploitation was identified at time of analysis, though the high confidentiality, integrity, and availability impact across all supported Office channels warrants prompt patching.
Stack-based buffer overflow in Microsoft Word permits remote code execution in affected Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and Office LTSC 2021/2024 (including Mac editions) when a victim opens a maliciously crafted document. The vulnerability is unauthenticated from the attacker's perspective but requires user interaction (UI:R), so delivery typically depends on phishing or social engineering, and no public exploit identified at time of analysis or CISA KEV confirmation is available in the provided data. Patch available per vendor advisory via Microsoft's MSRC update guide.
Heap-based memory corruption in Microsoft Word lets a remote, unauthenticated attacker execute arbitrary code in the security context of the user who opens a specially crafted Word document. Affected software includes Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 and 2024, and the corresponding Office LTSC/Office 365 for Mac builds referenced in the CPE list; exploitation is not automatic, since the victim must open the malicious file (UI:R), but no credentials or special configuration are required otherwise. Microsoft has published a security update, and no public exploit code was identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Word allows unauthenticated remote attackers to execute code on vulnerable systems when a user opens a crafted document, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. The attack requires user interaction (opening a malicious file) and executes code in the context of the opening user without privilege escalation, resulting in a CVSS score of 8.8. No public exploit code or active exploitation has been identified, and a vendor patch is available; this is a high-priority vulnerability but not an emergency based on current signals.
A heap-based buffer overflow in Microsoft Word's document-parsing code lets an unauthenticated remote attacker execute arbitrary code when a victim opens a maliciously crafted Word file, affecting Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024. The attack is network-deliverable (typically a phishing attachment or downloaded document) but cannot trigger without user interaction, since the victim must open or preview the file; successful exploitation runs code in that user's security context rather than SYSTEM. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a high-priority patching item - rated 8.8 with the vendor patch already available - rather than an emergency zero-day response.
Eclipse Jetty's host whitelist/blacklist enforcement in the jetty-server and jetty-proxy modules performs case-sensitive comparisons, so a remote, unauthenticated attacker can bypass the filter simply by altering the letter case of the Host value (e.g. 'EXAMPLE.com' instead of 'example.com') and reach hosts the operator intended to block or exclude. The flaw only matters where an operator has explicitly configured a host whitelist or blacklist and treats it as a security boundary; deployments without host-based filtering are unaffected. The vendor has published a security advisory (GHSA-7wfj-j486-mxrf), and no public exploit code has been identified at time of analysis, though the low attack complexity (AC:L, PR:N, UI:N) and high confidentiality impact make the bypass straightforward to attempt wherever the non-default filtering configuration is present.
Stored cross-site scripting in Netgate pfSense CE 2.3.0 through 2.9.0 lets an authenticated WebGUI user who holds the Firewall: Rules or NAT: Port Forward privilege plant a crafted separator[] color value that display_separator() writes unencoded into an HTML class attribute, so the payload executes in the browser of any administrator who subsequently opens the firewall rules or port-forward page. Because the script runs inside that administrator's authenticated session, it can drive WebGUI actions at the higher privilege level; publicly available exploit code exists, but there is no CISA KEV entry, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) frames this as a moderate, insider-flavoured privilege-escalation issue rather than an urgent unauthenticated compromise.
The EnergizeLab AI Station (RK3562) firmware image ships with hard-coded root credentials and an SSH daemon enabled by default, so any attacker who can reach the device's SSH port from the same LAN or adjacent network segment can log in as root and take complete control of the unit. Rated CVSS 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw needs no authentication, no user interaction, and no pre-existing privilege on the device - the only barrier is network reachability, per the adjacent-network attack vector. No vendor patch has been identified at time of analysis, and no public exploit code or confirmed active exploitation (CISA KEV) was identified; because every device running stock firmware is affected by design rather than by misconfiguration, this is a high-priority issue for any organization with these units deployed, not a paper-only finding.
Account takeover in the EnergizeLab Eilik NestJS authentication service allows any registered user to hijack another account by manipulating a user ID field in account update requests, a mass assignment flaw (CWE-639). All versions of the service are affected (CPE: cpe:2.3:a:energizelab:nestjs_auth_service:*:*:*:*:*:*:*:*), and exploitation requires only a valid low-privilege account (PR:L) over the network with no user interaction. No public exploit has been identified at time of analysis, though the flaw is trivially automatable and carries a CVSS base score of 8.8.
Password reset authorization bypass in ELADMIN v2.7 and earlier allows any authenticated user, regardless of role, to reset arbitrary account passwords-including the built-in administrator-by sending PUT /api/users/resetPwd. The endpoint lacks the method-level authorization check applied to other user-management endpoints and performs no role or ownership validation in UserServiceImpl.resetPwd, so a low-privileged session can take over privileged accounts. No public exploit was identified at time of analysis, but the CVSS 3.1 score is 8.8 (PR:L) and the flaw is a genuine high-priority broken-access-control issue; risk is highest for internet-facing instances or those allowing self-service account creation.
Authenticated SQL injection in Tianji before 1.31.29 allows any workspace member - even a read-only viewer - to execute arbitrary SQL against the shared PostgreSQL database by supplying a crafted timezone value through analytics request data or the timezone HTTP header. The getDateQuery() helper in src/server/utils/prisma.ts interpolates that value into raw SQL via Prisma.sql() without parameter binding, so an attacker can disclose or modify credentials, API keys and tenant data, or make the service unavailable. No public exploit code has been identified at time of analysis; the vendor-released fix is 1.31.29.
Security-constraint bypass in Eclipse Jetty leaves some request URL patterns unprotected when annotation and deployment-descriptor security metadata are mixed, specifically in the jetty-annotations and jetty-eeN-annotations modules. The flaw triggers only in a narrow application layout: a servlet declared in web.xml with more than one url-pattern, a web.xml security-constraint that covers only a subset of those patterns, and @ServletSecurity annotations present at the same time, in which case the Jakarta Servlet specification's authoritative url-pattern precedence rules are not applied and the uncovered patterns remain reachable. Because the resulting access is reachable over the network with no credentials (CVSS 4.0 AV:N/PR:N/UI:N, independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N), an unauthenticated remote attacker can read content that should have been restricted, yielding a high confidentiality impact with a low integrity impact and no availability impact; exploitation is strictly gated by the application-level web.xml/annotation layout rather than by the Jetty version alone, and no public exploit identified at time of analysis.
Cross-site request forgery in XXL-JOB 3.5.0-SNAPSHOT and earlier lets an attacker riding an authenticated administrator's browser session create, modify, or delete console user accounts through the unprotected /user/insert, /user/update, and /user/delete endpoints in JobUserController. The flaw is scored CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no attacker privileges are required, but success depends entirely on a logged-in admin being lured into visiting an attacker-controlled page, since the endpoints carry no anti-CSRF token and do not restrict HTTP method. No public exploit code and no CISA KEV entry were identified at time of analysis, and the practical impact is limited to user-management state (account creation, privilege changes, and deletion) on admin consoles that are reachable from the victim's browser.
Memory corruption in Google Chrome's DOM implementation allows remote attackers to execute arbitrary code within the browser's renderer sandbox by convincing a victim to load a crafted HTML page. All Chrome builds prior to 155.0.8059.84 are affected; exploitation is unauthenticated (CVSS PR:N) but requires the user to navigate to attacker-controlled content (UI:R), and the resulting code execution is contained by the sandbox (S:U), so host compromise would require a separate sandbox-escape vulnerability. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none, though the vendor's Chrome severity rating is High and technical impact is total for the compromised renderer; a vendor patch is available in Chrome 155.0.8059.84 and the corresponding extended stable update.
Privilege escalation in the Fluent CRM WordPress plugin version 3.2.5 and earlier allows an authenticated low-privileged user - such as a subscriber or self-registered account - to elevate their privileges and gain control over site resources, with a CVSS 3.1 score of 8.8 and high impact to confidentiality, integrity, and availability. Exploitation is not anonymous: it requires a valid low-privilege WordPress account plus an active vulnerable plugin installation, but no user interaction is needed (PR:L, UI:N) and no non-default configuration is named in the advisory. No public exploit identified at time of analysis; this is a genuine priority, not a high-CVSS-but-low-real-risk issue.
Memory corruption in Google Chrome's Workers component affects versions prior to 155.0.8059.84 and can allow a remote attacker to execute arbitrary code inside the browser's renderer sandbox when a victim visits a crafted HTML page. The CVSS vector indicates network reachability, no authentication, and required user interaction, with high confidentiality, integrity, and availability impact inside the sandbox; however, Scope is Unchanged, so full host compromise requires a separate sandbox escape. Assessment signals conflict and should be weighed carefully: CVSS is 8.8 while Chromium rated it Medium, SSVC says exploitation is none and automatable is no, and no public exploit identified at time of analysis; a vendor patch is available.
Use-after-free in Google Chrome's compositing pipeline lets an unauthenticated remote attacker execute arbitrary code within the browser sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.84. The flaw carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) even though Google rates it Chromium severity Medium, and no public exploit has been identified at time of analysis, with CISA's SSVC assessment recording no observed exploitation. Because the resulting code execution stays inside the sandbox, full host compromise would require chaining a separate sandbox escape, which tempers the real-world severity despite the high vector score.