Sonatype Nexus Repository 3 fails to enforce a write-authorization check on the NuGet symbol-package upload path, letting an account that holds only repository read and browse privileges persist .snupkg symbol packages into a hosted NuGet repository. The defect is an integrity-only issue (I:H, with no confidentiality or availability impact) and is reachable by remote, low-privileged authenticated users (CVSS 4.0 7.1 High; assessed CVSS 3.1 7.1 High with PR:L). Exploitation is conditional: the target must be a hosted (not proxy or group) NuGet repository with the Symbol Server feature explicitly enabled, and where anonymous access is on, the built-in anonymous account already carries read and browse rights and satisfies the privilege prerequisite without any credential. No public exploit code was identified at time of analysis and there is no CISA KEV listing; a vendor fix is available.
Denial of service in Lychee before 7.7.0 allows an authenticated user with upload/import permission to tie up image-processing capacity by submitting a tiny PDF whose first page declares an oversized /MediaBox. Lychee hands PDFs to ImageMagick with Ghostscript enabled and applies no pre-render page-size check in ImagickHandler::loadPdf(), so Ghostscript burns CPU rasterizing an enormous page before the pixel-cache policy rejects the result; in synchronous QUEUE_CONNECTION deployments a single request occupies a web worker, while the official asynchronous Docker setup instead backs up the shared image-processing queue and delays other users' work. Exploitation is gated behind authentication, only availability is affected (no confidentiality, integrity, or Ghostscript sandbox-escape impact), and no public exploit was identified at time of analysis. The vendor/CNA scored this 7.1 under CVSS 4.0, whereas the independent assessment rates the same issue CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L (4.3), reflecting limited per-request availability impact.
Incorrect authorization in ClassroomIO through 1.0.0 allows any authenticated course member, including students, to modify or delete lessons in any course or organization by supplying arbitrary lesson IDs to the PUT and DELETE /:lessonId routes. The vulnerability stems from a middleware that verifies course membership but fails to scope lesson access to the caller's course. No public exploit code has been identified at time of analysis, and exploitation requires a valid course-member session plus knowledge or enumeration of target lesson IDs.
Authenticated insecure direct object reference in MinDoc through 2.2-beta.2 lets any user holding a non-observer role on at least one book read markdown and HTML documents belonging to private books they were never granted access to. Because the DocumentController.Content endpoint authorizes the caller only by document ID and not by the book the document belongs to, an attacker can name any target book and iterate predictable, sequential document IDs to harvest its contents. Exploitation requires a valid low-privileged account (authentication requirements confirmed as authenticated per the CVSS vector, PR:L) and is read-only, with no write, integrity, or availability impact; no public exploit code was identified at time of analysis, though a detailed public technical writeup of the flaw exists.
Authenticated low-privileged users can read other users' and tenants' extracted document text in Bisheng through 3.0.0-beta4 by enumerating sequential file IDs against the GET /api/v1/knowledge/file_bbox endpoint, which lacks per-user ownership checks. This IDOR vulnerability (CWE-639) requires only a valid account on a network-reachable instance and poses a bounded confidentiality risk; no public exploit code or active exploitation has been identified at time of analysis. In multi-tenant deployments, the flaw can expose sensitive parsed documents across tenant boundaries.
CRMEB versions 5.6.1 through 6.0.0 are affected by an insecure direct object reference (IDOR) in the gift-order API, enabling authenticated storefront users to read and claim other users' orders by enumerating sequential order IDs. Attackers can retrieve buyer identities and gift keys via the gift_detail endpoint and then use receive_gift to redirect paid goods to an address they control. Exploitation requires a low-privilege account (obtainable via self-registration) and the gift-order feature to be active; no public exploit identified at time of analysis, though a detailed public writeup exists.
Authenticated Grafana users holding only the Viewer role can create, modify, and delete Loki alerting rules because Grafana's data source proxy fails to apply role-based access control to write requests forwarded to the Loki rules API at /loki/api/v1/rules. Both Grafana OSS and Grafana Enterprise are affected whenever a Loki data source is configured, and because the rules live in Loki rather than in Grafana, a Viewer's changes silently take effect for every user of that data source. Exploitation requires a valid Viewer account plus a configured Loki data source; no public exploit code has been identified at time of analysis, and Loki itself is not vulnerable and needs no patching.
Jail filesystem-root isolation can be bypassed on FreeBSD hosts where fdescfs(4) is mounted inside a jail with the non-default "nodup" option: opening /dev/fd/N returns a descriptor that does not inherit the FD_RESOLVE_BENEATH constraint or the Capsicum capability rights of descriptor N, so a jailed process that already holds a directory descriptor passed in from another jail can resolve paths outside its own jail root. The flaw is strictly local (CVSS 7.1, AV:L/PR:L) and only exploitable in multi-jail deployments that pass directory file descriptors across jail boundaries; default fdescfs mounts and single-jail hosts are not affected, and no public exploit code or active exploitation has been identified, with EPSS at a low 0.18% (7th percentile). Patched builds are 14.4-RELEASE-p10, 14.5-RELEASE-p1, 15.0-RELEASE-p14 and 15.1-RELEASE-p4.
Kernel memory disclosure in DragonFly BSD through 6.4.2 (prior to commit 4bb22ff) allows an unauthenticated attacker on the adjacent Layer-2 broadcast domain to leak roughly 250 bytes each of kernel heap and stack memory - including kernel pointers - with a single crafted ARP request. The ARP input handlers arpintr() and in_arpinput() in sys/netinet/if_ether.c fail to validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields, and in_arpreply() subsequently uses those attacker-controlled values as memcpy lengths against kernel buffers that are only 6 and 4 bytes long, copying the overread bytes back to the requester in the ARP reply. No authentication or user interaction is required, but impact is confined to adjacent-network attackers because ARP is not routed across subnets, and no public exploit code has been identified at time of analysis.
Out-of-bounds memory reads in HPE NonStop EXPAND - the networking subsystem of HPE's NonStop fault-tolerant server platform - can expose process memory contents and crash the EXPAND process, giving an adjacent-network attacker both information disclosure and a denial-of-service path. Exploitation requires network adjacency to a NonStop system's EXPAND communication path rather than arbitrary internet reach, no authentication or user interaction is needed, but high attack complexity means success depends on hard-to-control timing and process-state conditions, so reliable exploitation is unlikely. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the EPSS signal (not provided) is not a driver here; practical risk is further bounded by the platform's narrow deployment footprint and the fact that EXPAND links normally sit on segmented internal or interconnect networks.
An authenticated local user on an HPE NonStop system can trigger a heap buffer overflow in the HPE NonStop Debug Utilities to corrupt a saved resume-execution address, potentially redirecting the flow of the debugged process. The flaw is rated CVSS 3.1 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) - the attacker needs an existing local foothold with only low privileges, but cannot reach the component remotely, no user interaction is required, and confidentiality is not impacted while integrity and availability are rated High. A vendor security bulletin is published, but no exact fixed version is given in the supplied data, and no public exploit code or CISA KEV entry has been identified at time of analysis; the practical risk is moderate and bounded by the requirement for local access and the platform-specific, diagnostic nature of the utility.
Heap-based buffer overflow in HPE NonStop Inspect Subsystem allows an authenticated local attacker with low privileges to corrupt a saved resume-execution address and potentially redirect control flow. The CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) reflects no confidentiality impact but high integrity and availability impact. No public exploit code or active exploitation is identified at time of analysis, and exploitation requires prior authenticated local access plus interaction with the Inspect debugging subsystem.
A heap buffer overflow in HPE NonStop OCAX lets an authenticated local actor corrupt the component's address space and potentially redirect execution flow, producing high integrity and availability impact with no confidentiality impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 7.1). Because the vector is AV:L with PR:L, exploitation requires pre-existing local access and at least low-privilege credentials on the NonStop system plus the ability to feed input to OCAX; it is not remotely reachable, so realistic exposure is limited to insiders or attackers who have already compromised a low-privilege account. There is no public exploit code identified at time of analysis and the flaw is not listed in CISA KEV, making this a medium-severity authenticated local issue rather than a top-tier emergency. HPE is the reporting vendor and the linked HPE Security Bulletin (hpesbns05148en_us) is the authoritative source for fixed versions.
Reflected cross-site scripting in the 8theme XStore WordPress theme affects all installations running a version before 9.7.9, allowing remote attackers to inject script that executes in the browser of a site visitor who loads a crafted URL. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms the flaw is network-reachable at low complexity and requires no authentication, but it does require the victim to click or load an attacker-supplied link (UI:R), and the scope change (S:C) means the injected script runs in the victim's browser context rather than on the server. Impact is limited to the victim's browser session within the site origin; because the payload is reflected and not stored, each victim must be individually lured, and no public exploit code was identified at time of analysis. A vendor fix is available in version 9.7.9 per the Patchstack advisory.
Reflected cross-site scripting in the Link Whisper Free WordPress plugin (versions through 0.9.7) allows remote attackers to inject malicious scripts into a victim's browser by tricking them into following a crafted link. Exploitation requires user interaction and the payload is reflected, not stored, so the attacker must lure a victim to a specially crafted URL while the plugin is active. No authentication is required of the attacker, but impact is greatest if the victim has an authenticated WordPress session, such as an administrator. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Heap buffer overflow in HPE NonStop NDSREST (CVSS 7.1) can corrupt a resume-execution address and potentially redirect execution flow, producing high integrity and availability impact without confidentiality impact. Exploitation requires authenticated low-privilege local access (AV:L, PR:L), no user interaction, and low attack complexity; if NDSREST is network-exposed in a given deployment, effective reachability may be broader than the local vector suggests. No public exploit identified at time of analysis, and CISA KEV does not confirm active exploitation.
Local attackers with low-privilege access can exploit a heap-based buffer overflow in HPE NonStop TNS/X Native Inspect to corrupt memory and potentially redirect execution flow, leading to code execution or denial of service. The vulnerability requires local, authenticated access (CVSS vector: AV:L/PR:L) and the ability to invoke the Native Inspect debugger utility. No public exploit code or active exploitation has been identified at time of analysis.
CVE-2026-16437 lets a locally authenticated administrator defeat the forgotten-password recovery mechanism in Mitsubishi Electric's ICONICS-based GENESIS (11.03 and prior), GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and IoTWorX (10.97.3 and prior) products, as well as all versions of MC Works64, GENESIS32 and BizViz, by tampering with the Windows-protected management file that stores the system-unlock challenge response - effectively unlocking the system without knowing the password. The impact ratings are high across confidentiality, integrity and availability, so a successful attacker could disclose, alter or destroy internal configuration data or drive the host into a denial-of-service condition. Realistic risk is tempered by the local-only vector, high attack complexity and the requirement for pre-existing administrative rights on the host; no public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied for this CVE. Vendor CVSS is 7.1 (HIGH).
Improper authorization handling in OPNsense core before 26.1.11 lets an authenticated low-privileged user (CVSS PR:L) bypass the user-config-readonly restriction and persist configuration changes through MVC APIs that rely on the throwReadOnly() guard. The flaw only triggers for accounts whose privileges are assigned directly: when a user is given both a component write privilege and user-config-readonly inside one comma-separated <priv> value, ACL::hasPrivilege() fails to detect the read-only flag through its exact string comparison, so the write is allowed; accounts receiving privileges through groups are unaffected. Impact is confined to configuration integrity for the affected component (I:H with C:N and A:L), no public exploit has been identified at time of analysis, and the vendor has shipped the fix in OPNsense 26.1.11.
Stored cross-site scripting in maxfoundry Social Share Buttons for WordPress through 1.31 lets malicious input persist in content handled by the share-button plugin and execute in the browser of any user who later views the poisoned page. The supplied CVSS vector scores it 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); our independent assessment applies PR:L because stored XSS in WordPress plugins usually requires at least a low-privilege authenticated account unless a specific unauthenticated sink exists, and the required victim interaction means impact occurs only when a logged-in user or administrator loads the affected page. No public exploit identified at time of analysis, and no CISA KEV or EPSS data was provided.
Authenticated low-privilege users can exploit missing authorization checks in the ThemeGrill User Registration plugin (versions up to 5.2.8) to perform unauthorized actions, potentially altering site data or user information. This broken access control flaw (CWE-862) has a CVSS score of 7.1 and requires network access with low complexity, but no user interaction. No public exploit code or active exploitation has been identified at this time.
Stored cross-site scripting in the BSK PDF Manager WordPress plugin (all versions through 3.8.1) allows an attacker to persist malicious JavaScript that later executes in the browser of any user who loads the page or admin view that renders the unsanitized input. The published CVSS vector is 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) with a scope change, while the independent assessment retains a 7.1 score but rates privileges required as PR:L, noting that persisting a payload realistically depends on having at least a low-privilege authenticated role or access to a content-submission surface - sites where only trusted administrators can submit plugin content, or that have upgraded past 3.8.1, are not realistically exposed. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV.
Stored cross-site scripting (XSS) in the Everest Forms WordPress plugin affects all releases through and including 3.6.1, allowing an attacker to persist a script payload inside form-submitted or plugin-stored data that later executes in the browser of a privileged user who views it. Our independent assessment rates this CVSS 3.1 at 7.1 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting that the payload is not self-firing - it requires a victim (most plausibly an administrator) to render the stored content, and that persisting it may in practice demand at least low-privilege authenticated access despite the upstream PR:N claim. Impact is bounded to the victim's browser session rather than the server, no public exploit code was identified at time of analysis, the issue does not appear in CISA KEV, and no EPSS score was supplied; sites running a release later than 3.6.1 are not exposed.
Multiple Lenovo consumer tablets - including the Idea Tab Pro (TB373FU), Idea Tab / Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU), Tab M11 (TB330FU/TB330XU), Legion Tab 8.8" Gen 3 (TB321FU), Tab Extreme (TB570FU/TB570ZU), and a broader set of Tab and Yoga Tab models - contain a physical-access authentication bypass (CWE-288) that lets someone in direct possession of the device defeat the lock/authentication flow and gain unauthorized access to the device and its data. Rated 7.0 under CVSS 4.0 (AV:P/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity and availability impact), the issue requires no credentials (PR:N) and no user interaction (UI:N), so the decisive limiting factor is the Physical attack vector: there is no remote or adjacent-network exposure and only lost, stolen or unattended units are at risk. No public exploit code has been identified at time of analysis, and the specific alternate authentication path involved has not been disclosed by the vendor.
Authorization bypass in Cool Admin Midway through 8.0.0 allows an authenticated non-superadmin administrator who holds sys:role permissions to read, update, or delete other administrators' role records by supplying arbitrary role IDs to the base CRUD role endpoints. This changes menu and department grants for other users and can escalate the attacker's effective access; exploitation requires a valid admin session with role-management rights, making the realistic threat a malicious or compromised low-privilege admin rather than an anonymous remote attacker. The assessed CVSS 3.1 vector is 7.0 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L), and no public exploit identified at time of analysis.
Privilege escalation to root on Ivanti Connect Secure 22.8R2.4, where the dsinvoked broker improperly trusts DSCache configuration data and can be induced to act on attacker-controlled input. Exploitation is not remote in isolation: the CVSS vector (AV:L/PR:L/AC:H) requires an attacker to already hold a low-privileged foothold on the appliance plus the specific broker/DSCache state needed to satisfy the high attack-complexity constraint. The practical risk is elevated because the CVE description and Volexity reporting tie this flaw to chained exploitation of upstream unauthenticated issues in October 2026, which removes the local-access barrier for a real attacker; no CISA KEV entry is present in the supplied data, and no specific patch version is provided. Treat this as a genuine high-priority hardening item - the exploitation signals are reported but the remediation data is incomplete.
FreeBSD's bhyve hypervisor contains a guest-to-host race condition and input-validation flaw in its framebuffer/VNC device model, allowing a guest with existing code execution to crash the bhyve process or potentially execute code in the host userspace context, subject to bhyve's Capsicum sandbox. Only VMs configured with the fbuf framebuffer/VNC device are exposed, affecting FreeBSD 14.4 before p11, 14.5 before p2, and 15.1 before p5, while headless or serial-only guests are not affected by this path. The CVSS 3.1 vector is AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, requiring guest-level privilege and a difficult timing race, and no public exploit identified at time of analysis.
Out-of-bounds memory access in FreeBSD's bhyve hypervisor Intel HDA audio device emulation can be triggered by a privileged guest that supplies a zero-length Buffer Descriptor List entry and then modifies BDL fields after the hypervisor's validation step, causing an out-of-bounds read or write during DMA transfer processing. The concrete impact is a crash of the bhyve process or, potentially, arbitrary code execution in the host userspace context running the virtual machine, although any such execution remains confined by bhyve's Capsicum sandbox. Only hosts that expose the emulated HDA audio device to untrusted guests are affected, and exploitation requires local access from within a guest with device-programming privileges plus a high-complexity post-validation race (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0); no public exploit identified at time of analysis and the EPSS score is low at 0.18% (7th percentile).
FreeBSD's bhyve hypervisor xHCI (USB 3) device model can be driven into a guest-to-host memory race by a malicious privileged guest: the emulated controller neither validates nor caches the guest-supplied event ring size, re-reading it from guest memory on each use, and loads Transfer Request Block (TRB) fields without guarding against concurrent modification by the guest. Winning that race (CVSS 3.1 AV:L/AC:H/PR:L) crashes the host-side bhyve process or potentially yields arbitrary code execution in the host userspace running the VM, bounded by bhyve's Capsicum sandbox. Exploitation requires an attacker who already controls privileged code inside a guest configured with the bhyve xHCI controller; no public exploit code was identified at time of analysis, and EPSS is low at 0.18% (7th percentile), making this a moderate, defense-in-depth priority rather than an urgent emergency.
Remote code execution in Telegram's bundled rlottie library allows an attacker to execute arbitrary code in the context of the current process when a victim opens a malicious Lottie/TGS animation. The flaw is a numeric truncation error (CWE-197) that results in an out-of-bounds write before the start of an allocated buffer, requiring user interaction (UI:R) and high attack complexity (AC:H) to exploit; the CVSS vector is AV:L, indicating a client-side file/content-handling issue. No public exploit has been identified at time of analysis, and no CISA KEV status is present.
A local privilege-escalation race condition in FreeBSD's kqueue subsystem lets an unprivileged user who can run code on the host potentially gain elevated privileges. When kqueue_fork_copy_knote() transfers knotes into a child process, it indexes the child's file descriptor table with the knote's fd number without validating it against the child table's size; because the child's table is copied before knotes are transferred, a concurrent parent thread that grows its own descriptor table can leave the knote pointing past the end of the child's table, producing an out-of-bounds read. Exploitation requires winning a narrow, non-automatable concurrency race (SSVC Automatable=no), no public exploit code has been identified at time of analysis, EPSS is low at 0.14% (3rd percentile), and the issue is fixed in FreeBSD 15.1-RELEASE patch level p4.
Local privilege escalation in the FreeBSD kernel kqueue subsystem affects FreeBSD 15.1-RELEASE before patch level p4, where a race condition in the parent-to-child knote copy path can free a marker knote and cause a use-after-free. A local user with low privileges (PR:L) may leverage this to corrupt kernel memory and potentially escalate privileges, though exploitation requires winning a high-complexity, non-deterministic timing race (AC:H). No public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is low at 0.14% (3rd percentile).
Improper authorization in Lenovo Baiying PC Client - software distributed exclusively in the Chinese market - lets a local, already-authenticated user execute arbitrary code with elevated privileges, resulting in high impact to confidentiality, integrity, and availability. The vendor rates it 7.0 under CVSS 4.0 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), and our independent CVSS 3.1 assessment is consistent: the vector is strictly local (AV:L), requires a valid logged-in session (PR:L) and some passive user interaction (UI:P), so it is not remotely triggerable. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, so real-world risk is concentrated in Chinese-market endpoints where a low-privileged local user has interactive access.
Sliver C2 servers running an HTTP or HTTPS listener can be driven into total memory exhaustion by unauthenticated remote attackers who submit a deliberately oversized PNG to the encoder endpoint. The Decode path in util/encoders/images.go passes attacker-controlled PNG data straight to png.Decode with no cap on pixel dimensions, so a small, highly compressible image (for example 32767x32767 RGBA) expands into multi-gigabyte pixel buffers; the only credential-like barrier is the 65,537-value encoder nonce modulus, which is brute-forceable via response timing as demonstrated in the published proof-of-concept tool 'pngboomer'. Impact is a complete loss of availability for the Sliver process and potentially the host, and a fixed release (v1.7.6) plus upstream commit are available; exploitation requires an active, reachable HTTP(S) listener, and the public PoC targets Docker deployments with defined memory caps.