Local file read in Netgate pfSense CE through 2.9.0 allows an authenticated user who holds the Dynamic DNS client privilege to cause root-readable files such as /conf/config.xml or /etc/master.passwd to be written into the system log. The attacker configures a custom DynDNS provider with a file:// Update URL and a deliberately non-matching Result Match value, so the _checkStatus() routine logs the fetched content as root. Publicly available exploit code exists, but exploitation is privilege-gated: it requires access to services_dyndns_edit.php with the Dynamic DNS client privilege, and independent assessment confirms only confidentiality impact with no integrity or availability effect, making this a credible but limited information-disclosure risk rather than a mass-exploitation threat.
Heap out-of-bounds write in SoX (the sox CLI and any application linking libsox) through 14.4.2 allows a crafted MS ADPCM WAV file with an odd samplesPerBlock value in its fmt chunk to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt(), corrupting adjacent memory. Triggering the flaw requires the victim to open or submit the malicious file to sox/libsox (local attack vector, user interaction), but no authentication or privileges are needed; publicly available exploit code exists and no CISA KEV listing is present. The assessed impact is low integrity and high availability (CVSS 3.1 6.9, CWE-787), with exposure concentrated in automated audio-processing services that decode untrusted files.
Out-of-bounds write in libTiMidity through 0.2.8 allows unauthenticated local attackers to corrupt heap memory and crash applications by loading a crafted SoundFont (.sf2) file whose preset header 'bank' or 'preset' values index past the fixed 128-entry tonebank or drumset arrays in init_soundfont(). The vendor CVSS 4.0 base score is 6.9 (moderate), reflecting high availability impact (crash) and low integrity impact, with exploitation requiring passive user interaction to open the malicious file. Publicly available exploit code exists, increasing the likelihood of targeted attacks against applications that process untrusted SoundFonts.
Stack out-of-bounds write in libTiMidity through 0.2.8 occurs when the SoundFont loader parses crafted .sf2 files, allowing an unauthenticated local attacker to corrupt stack memory via out-of-range pgen/igen generator operators in parse_gen, which writes chosen 16-bit values near the stack Layer object. This leads primarily to denial of service (crash) with a constrained memory corruption primitive; exploitation requires the victim to load a malicious SoundFont file (user interaction), and publicly available exploit code exists but there is no confirmed active exploitation. The assessed severity is moderate (CVSS 3.1 base score 6.1), consistent with a file-parsing memory-safety bug rather than a top-priority threat.
Heap out-of-bounds write in OpenJPH 0.32.0 and earlier allows memory corruption when the library decodes a crafted JPEG 2000 codestream (.j2c or .jph) that uses small precinct sizes to create degenerate one-row codeblocks; the HTJ2K cleanup-pass decoder then writes a second row beyond the end of the codeblock buffer, causing heap corruption and crashes. Publicly available exploit code exists, including a detailed technical write-up, but there is no indication of confirmed active exploitation (no CISA KEV listing), and the assessed attack vector is local with user interaction (CVSS 3.1 AV:L/AC:L/PR:N/UI:R, integrity impact low, availability impact high). Realistic exposure requires OpenJPH to sit in a decode path that accepts untrusted images, such as an upload handler, image viewer, or batch conversion service, where a victim is induced to open the malicious file.
Out-of-bounds write in libsmi through 0.5.0 allows attackers to corrupt adjacent library globals via a crafted MIB file that supplies an OCTET STRING DEFVAL of 512 or more octets beginning with a 0x00 byte, causing smiValueAsString() to overflow a fixed 1024-byte static buffer during hex rendering and crash smidump or other consumers. Exploitation requires the victim to load the malicious MIB (UI:P per CVSS 4.0; UI:R per independent CVSS 3.1 assessment) and is limited to local memory corruption with high availability impact and low integrity impact. Publicly available exploit code exists.
Heap out-of-bounds read in libewf through 20260924 allows an attacker to crash an application or leak uninitialized heap memory by supplying a crafted .L01/.Lx01 logical-evidence image containing oversized 'ea' (extended attribute) metadata counts. The flaw is reachable only when the tool actually parses the attacker-controlled image: the CVSS 4.0 vector is local (AV:L) with passive user interaction (UI:P) and no privileges required (PR:N), and impact is concentrated in availability (VA:H, a crash) with only limited confidentiality (VC:L, memory disclosure). Public exploit code exists, but the vulnerability is not confirmed as actively exploited in CISA KEV.
Heap out-of-bounds reads in the SoundFont loader (src/sndfont.c) of libTiMidity 0.2.8 and earlier allow an attacker to disclose heap memory and crash an application whenever a crafted .sf2 SoundFont is loaded through mid_set_soundfont(). The attack is local and requires the victim to open or otherwise load the malicious SoundFont (UI:P with AV:L), so the impact is bounded to low-confidentiality memory disclosure and a high-availability crash, with no confirmed integrity loss or code execution; any product that never parses untrusted or third-party SoundFont files is effectively unaffected. Publicly available exploit code exists - a public writeup and the referenced upstream source lines demonstrate the unvalidated sampleId/generator indexing - but there is no evidence of active exploitation, and exploitation prerequisites make this a moderate-priority rather than a critical remote threat.
Decoding a crafted PICT image with FreeImage (danoli3 fork) through 3.19.23 can over-read up to 64 KiB of heap memory inside Unpack32Bits() in PluginPICT.cpp, leaking process memory into the decoded pixel output or crashing the host application. The flaw affects any application that links the danoli3 fork (or the corresponding FreeImage codebase) and attempts to decode an attacker-supplied PICT file; per the assessed vector (AV:L/PR:N/UI:R) the attack requires a victim to open or process the malicious file, with no network-facing or unauthenticated remote path. Publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV entry), and the impact is bounded to information disclosure and denial of service rather than code execution.
Heap out-of-bounds read in libyal libesedb (through 20260704, all versions per the wildcard CPE) lets an attacker who supplies a crafted ESE/EDB database file to a libesedb consumer such as esedbexport cause the parsing process to crash or to disclose roughly 32 KiB of adjacent heap memory through libesedb_record_get_multi_value(). Publicly available exploit code exists, but there is no indication of confirmed active exploitation (not in CISA KEV), and the CVSS 4.0 vector (AV:L, UI:P) means the issue is not remotely reachable: an attacker must first place the malicious file on a target system and get a user or an automated job to parse it. Impact is bounded to denial of service and limited heap information disclosure - not code execution - so this is a genuine but moderate-priority issue for workflows that process untrusted ESE databases.
Heap out-of-bounds read in ytnef through 2.1.2 allows an attacker to crash the ytnefprint utility and incidentally leak small amounts of adjacent heap memory by supplying a crafted winmail.dat whose compressed RTF property decompresses to data without a trailing NUL terminator. The flaw sits in MAPIPrint() in lib/ytnef.c and is reachable unauthenticated, but exploitation requires that a victim or an automated workflow open the malicious file, since the attack surface is local file parsing rather than a network service. Publicly available exploit code exists (linked proof-of-concept write-up), and there is no confirmed active exploitation (not in CISA KEV); the dominant realistic outcome is denial of service via crash, with only incidental memory disclosure of limited value.
Heap out-of-bounds read in ytnef through 2.1.2 allows unauthenticated local attackers to crash the application and leak adjacent heap memory by supplying a crafted winmail.dat TNEF file with a malicious PT_BINARY MAPI property. Publicly available exploit code exists, though the vulnerability is not confirmed as actively exploited. The CVSS 4.0 score is 6.9 (moderate), and exploitation requires the caller to process the attachment (passive user interaction).
Heap out-of-bounds read in libregf (all snapshots through 20260526) allows an attacker who supplies a crafted legacy Windows registry hive (REGF format version 1.0/1.1) to make a value-data cell appear shorter than it actually is, so the library reads past the end of the cell and either leaks adjacent heap bytes or crashes the process. Exploitation is local and requires the victim or an automated pipeline to actively open the malicious hive; no privileges are required, but user interaction is needed, and the assessed impact is limited to confidentiality loss and denial of service, with no write primitive or code execution indicated. Publicly available exploit code exists in the form of a linked technical writeup, but there is no CISA KEV confirmation of active exploitation; downstream consumers such as regfexport and plaso/log2timeline are affected.
Heap-based out-of-bounds read in the HCOMPRESS tile decoder of CFITSIO through 4.7.0 lets unauthenticated attackers trigger memory reads beyond the compressed tile buffer by supplying a crafted FITS file whose compressed image declares ZCMPTYPE HCOMPRESS_1 with oversized tile geometry; the flaw sits in the input_nnybble logic of fits_hdecompress.c and is reached through fits_read_pix. Impact is limited heap disclosure plus high availability loss - malformed reads can crash the consuming application - while confidentiality and integrity are only lightly affected (C:L, I:N per the source CVSS 4.0 vector, and assessed CVSS:3.1 as AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Publicly available exploit code exists, so the practical barrier is low, but exploitation is file-based: a victim application must ingest and decompress the malicious FITS file, so the issue is a genuine but moderate-priority concern rather than a top-tier emergency.
Heap out-of-bounds read in EarthScope libmseed through 3.5.4 occurs when an application passes a truncated 40-to-47-byte miniSEED 2 record that still satisfies the MS2_ISVALIDHEADER check to msr3_parse() or ms3_detect(); the parser then reads the blockette-offset field beyond the end of the allocated buffer, over-reading up to 8 bytes and potentially crashing the process. Publicly available exploit code exists (a detailed write-up and the upstream fix are both linked from the CVE references), but CISA KEV does not list this issue, so there is no confirmation of active exploitation. Impact is limited to a denial of service (process crash) with no confidentiality or integrity effect; exploitation is local and requires passive user interaction, since a victim application or automated ingest pipeline must actually feed the malformed record to the parser - no authentication is required.
Opening a malicious NSF file through libgme's gme_open_data or gme_open_file entry points can crash the host application via a global out-of-bounds read in Classic_Emu::mute_voices_, as a chip_flags value such as 0x3F implies a voice count exceeding the fixed 16-entry voice-type table. This affects Game Music Emu (libgme) through version 0.6.5; the vulnerability is local (AV:L) and requires user interaction (UI:P) to load the crafted file, but requires no privileges (PR:N). Publicly available exploit code exists, and the CVSS 4.0 base score is 6.8, though no confirmed active exploitation (CISA KEV) has been observed. No vendor-released patch has been identified at time of analysis.
Heap out-of-bounds read in libgme (Game Music Emu) through 0.6.5 allows local attackers to crash applications that parse a crafted ZXAYEMUL (AY-format) file through gme_track_info or gme_start_track. The root cause is an integer underflow in the AY loader's track-table bounds check in gme/Ay_Emu.cpp; the assessed impact is denial of service (process crash) with no confirmed code execution or data disclosure, and exploitation requires that the victim opens or otherwise processes a malicious file. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the assessed CVSS:3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
Heap out-of-bounds read in the PCM data-block decompressor (DecompressDataBlk) of ValleyBell libvgm through commit a6eed945 allows a crafted .vgm file to crash the consuming application. A malicious file supplies a PCM data block of type 0x7F with an undersized compression table that is then indexed by wider compressed values, forcing an out-of-bounds heap read; the confirmed impact is a denial-of-service crash of whatever player, converter, or emulator embeds the library, with no code execution, privilege escalation, or confirmed data disclosure. Publicly available proof-of-concept exploit code exists, and the issue is being tracked by VulnCheck; no confirmed active exploitation (CISA KEV) has been reported. Exploitation is local and file-based (CVSS:3.1/AV:L/AC:L/PR:N/UI:R), so an attacker must convince a victim to open the malicious media file, and no public EPSS score was included in the available data.
Loading a crafted PSID/RSID SID tune file in applications built on libsidplayfp through 3.1.1 crashes the process through a heap out-of-bounds read. The library trusts the header's data offset without validating it against the real file size, so an attacker-supplied offset wraps the length calculation in SidTuneBase::resolveAddrs() and the code reads up to 64 KiB past the heap buffer. The confirmed impact is denial of service only - no code execution and no verified data exposure - and an attacker must get a victim to open or play the malicious tune, so this is a moderate, not high-priority, issue; publicly available exploit code exists (a HackMD write-up), but there is no confirmed active exploitation (not in CISA KEV).
Denial of service in libansilove 1.3.0 through 1.4.2 lets a crafted XBIN file crash any application that parses it: setting the 512-character font flag while leaving the custom-font flag unset leaves the internal high_font_data_xbin pointer NULL, and drawchar() then dereferences it and terminates the process. The flaw is reachable by unauthenticated remote attackers (CVSS PR:N) but is file-based and local in nature (AV:L) and only triggers when the target application actually processes the malformed file (UI:P), so impact is confined to availability - no code execution, data disclosure, or data modification. Publicly available exploit code exists (proof-of-concept write-up published), and the 6.8 CVSS 4.0 base score overstates real-world urgency: practical exposure depends entirely on whether an embedding application accepts untrusted XBIN input, and active exploitation is not confirmed.
An out-of-bounds read in libansilove through 1.4.2 lets a crafted compressed XBIN file, particularly one whose run-length data ends on a control byte such as 0x7F, drive the ansilove_xbin() loader past the end of its input buffer and crash the rendering application. Applications that link libansilove and render untrusted XBIN art are affected; the outcome assessed is denial of service via crash rather than code execution or disclosure of sensitive data. Publicly available exploit code exists in the form of a published proof-of-concept writeup, and exploitation requires a victim to open an attacker-supplied file, making this a local, user-interaction-dependent medium-severity issue rather than a remotely reachable emergency.
A heap out-of-bounds read in NetSurf libnsbmp through 0.1.7 can crash applications that call bmp_decode() when they process a crafted ICO file whose inner bitmap width is not a multiple of 8. Publicly available exploit code exists, and exploitation requires user interaction to open or process the malicious file. The flaw is a one-byte over-read (CWE-125) with no privileges required (PR:N) but a local attack vector; the impact is limited to a possible application crash, with no confirmed data disclosure or code execution.
Decoding a crafted RLE8- or RLE4-compressed BMP image with NetSurf's libnsbmp 0.1.7 or earlier can drive a one-byte heap over-read in bmp_decode_rle8() or bmp_decode_rle4(), crashing the consuming application. The trigger is narrow: the image must use RLE compression and end on an odd-length absolute run, so the word-alignment pad byte that the decoder forgets to count defeats its absolute-run bound check. Publicly available exploit code exists (a technical write-up with a reproducer is linked in the advisory), and exploitation is unauthenticated but requires a user or process to load and decode the attacker's image; impact is bounded to denial of service via crash, with no code execution, memory corruption, or confidentiality impact, making this a moderate, bounded issue rather than a top-tier priority.
Heap out-of-bounds read in AdPlug through 2.4 can crash an application that parses a truncated TwinTeam DMO file, yielding a local availability-only denial of service rather than code execution or data disclosure. The attack requires the victim to open or load a crafted 12- or 13-byte DMO file that still passes dmo_unpacker::decrypt() and reaches CdmoLoader::load() via CAdPlug::factory; publicly available exploit code exists, but exploitation is local and depends on user interaction. The independent assessment rates this as a low-priority memory-safety defect, not an urgent crisis.
Out-of-bounds read in AdPlug through 2.4 lets a crafted XSM file (with 'ofTAZ!' signature and a song byte of 0x80 or higher) crash applications that play the file, requiring victim interaction. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV); the CVSS 4.0 score is 6.8 while the independent CVSS 3.1 assessment is 5.4 (AV:L/AC:L/PR:N/UI:R, availability-only). The vulnerability is a low-to-moderate priority local denial-of-service issue, with no code execution, privilege escalation, or data disclosure per the assessed impact (C:N/I:N/A:H).
Information disclosure in EspoCRM's portal Note API allows an authenticated portal user (CVSS PR:L) who already has stream access to a parent record to retrieve internal agent notes by directly requesting a single Note by its known identifier; the stream list endpoint correctly filters notes where isInternal is true, but the direct single-Note read path fails to apply that restriction. Only EspoCRM versions prior to 9.3.7 are affected, and the issue is resolved in 9.3.7. Publicly available exploit code exists, but the practical risk is moderated by the preconditions: a valid portal credential, stream access to the relevant parent record, and knowledge of the specific note identifier - there is no described bulk enumeration, so exposure is per-known-identifier rather than wholesale dumping of internal content. No public exploit identified at time of analysis is contradicted here - exploitation code is public, but this is not confirmed as actively exploited (no CISA KEV listing).
Unauthenticated visitors to WordPress sites running the Spin Wheel plugin before 2.2.1 can bypass the plugin's spin-validation logic and retrieve the coupon codes stored for any campaign, including campaigns that have not been published. Because the plugin does not confirm that a legitimate spin actually occurred before handing back and consuming a configured prize, an attacker can repeatedly harvest the full pool of stored coupon codes and drain a campaign's prize inventory; the flaw is remotely reachable with no authentication, user interaction, or special configuration, and publicly available exploit code exists. Scored at CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), the impact is confined to the coupon/prize feature and does not provide a path to code execution or broader site compromise.
EspoCRM versions prior to 10.0.3 can disclose restricted record and user fields to an authenticated user who holds both email-template edit access and mass-email sending access, because the template renderer stops applying per-user ACL filtering when messages are generated for mass email and for administrator-controlled group-email auto-replies. Only fields explicitly marked FORBIDDEN, INTERNAL, or ONLY_ADMIN are exposed, so the impact is limited to information disclosure with no code execution, data modification, or availability loss, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (6.5, authenticated remote). Publicly available exploit code exists for this issue, but the prerequisite privilege pairing is not part of a typical default non-administrative role, keeping real-world priority at medium rather than urgent.
Broken object-level authorization in EspoCRM before 9.3.7 allows any authenticated user who has been granted Import scope access to read the row-level error CSV of another user's import job by posting to /api/v1/Import/{id}/exportErrors with a foreign import identifier. The endpoint returns an attachment identifier for the error file, exposing imported data rows (customer records, contact data, and similar) that the caller does not own; the exposure is limited to the contents of that import's error export and requires the attacker to know or enumerate a target import ID. Publicly available exploit code exists (the upstream advisory, fix commit, and 9.3.7 release are publicly linked), but there is no confirmed active exploitation via CISA KEV and no EPSS score was supplied; the vendor-released patch is 9.3.7, which adds the missing entity-level read check.
EspoCRM installations prior to 10.0.2 allow an authenticated user holding the mass-update permission to duplicate an existing Attachment record by supplying its identifier, because the mass-update processor copied the file without performing an ACL read check - the resulting copy is then readable by the attacker, disclosing the file's contents. Impact is confidentiality-only (no integrity or availability effect) and exploitation is constrained: the attacker must already possess an elevated mass-update privilege and must know a valid attachment ID for a file they are not authorized to read, which the vendor acknowledges is difficult to obtain. Publicly available exploitation material exists in the form of the upstream advisory, the fix commit that pinpoints the vulnerable code path (Tools/MassUpdate/Processor.php), and the 10.0.2 release notes; there is no CISA KEV listing indicating confirmed active exploitation of this issue.
An authenticated administrator on EspoCRM instances prior to 9.3.10 can abuse the administrative Label Manager to read, modify, create, or delete JSON files outside the intended language directory by supplying crafted 'scope' and 'language' parameters. Exploitation requires a full administrator session (CVSS PR:H) and is bounded by filesystem permissions and server configuration, which limits the reachable files to those the PHP/web-server process can access, making this mainly a privilege-abuse and defense-in-depth concern rather than a path to arbitrary file compromise. Publicly available exploit code exists (the vendor's advisory and a fix commit were published), but there is no CISA KEV entry confirming active exploitation; EPSS data was not provided, so exploit likelihood should be treated as elevated but not critical.
EspoCRM versions prior to 9.3.9 fail to neutralize spreadsheet formula triggers in exported CSV and XLSX files, because sanitizeCellValue() only inspects the first byte of a cell value. An authenticated low-privileged user can store free-text content such as " =cmd|' /C calc'!A0" (whitespace or a control character before the trigger), so the leading single-quote neutralization prefix is never applied; a separate privileged user must then export the affected records, open the file, and accept the spreadsheet application's formula/security prompts before the cell is evaluated, enabling outbound data disclosure and, on legacy configurations with DDE enabled, command execution. Tracked as CWE-1236 with CVSS 3.1 base score 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and publicly available exploit code exists; no confirmed active exploitation (CISA KEV) was identified. This is a moderate, conditional risk best treated as a medium-priority hygiene fix rather than an urgent emergency.
Unauthenticated attackers can invoke several cancellation-related AJAX actions in the eaSYNC Booking WordPress plugin before 1.3.31 because those actions lack authorization and nonce validation, letting them create booking cancellation requests, fire booking notification emails, and overwrite the content of emails the site sends. Publicly available exploit code exists (the WPScan advisory is the exploit reference), but there is no indication of confirmed active exploitation in CISA KEV. The impact is confined to integrity of booking state and outbound email content - there is no code execution, data disclosure, or site takeover - making this a moderate-priority web application flaw (CVSS 5.3).
Unauthenticated attackers can forge payment notifications against WordPress/WooCommerce stores running the Cardinity Payment Gateway plugin before version 3.4.2, because the plugin ships with an empty notification signing secret and fails to properly validate the authenticity of incoming callbacks. By sending a crafted 'approved payment' (or 'failed') notification to the plugin's payment-callback handler, a remote attacker with no credentials and no user interaction can mark arbitrary orders as paid - payment fraud - or force legitimate orders into a failed state. The vulnerability is exploitable against default installations, and publicly available exploit code exists (documented by WPScan), though there is no confirmation of active exploitation in the wild; impact is bounded to order-status manipulation rather than code execution, data theft, or service disruption.
Order status manipulation in Rede Itaú for WooCommerce before 5.5.3 allows unauthenticated remote attackers to change arbitrary WooCommerce order states - including marking unpaid orders as paid and cancelling completed orders - by forging payment gateway webhook requests. Publicly available exploit code exists, though the impact is limited to integrity (CVSS 5.3) and requires the plugin to be installed and its webhook endpoint reachable. No special configuration or user interaction is needed, but exposure is limited to merchants using the Itaú (Brazil) payment gateway.
Unauthenticated attackers can arbitrarily change the status of WooCommerce orders - including orders already marked paid or completed - by sending forged callbacks to the payment webhook endpoint of the Rede Itaú for WooCommerce WordPress plugin, which performs no authenticity verification on incoming requests. Any store running the plugin at a version prior to 5.5.3 with an active, network-reachable webhook URL is exposed remotely and without credentials (CVSS 5.3, AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N), and the impact is confined to order-status integrity with no data disclosure or denial of service. Publicly available exploit code exists and the issue was reported by WPScan, though it is not confirmed as actively exploited (no CISA KEV listing); the deployment base is narrow - merchants using the Itaú gateway, largely in Brazil - which limits real-world exposure and keeps this a moderate-severity integrity flaw rather than an emergency.
CRLF injection in Netgate pfSense CE 2.7.1 through 2.9.0 allows authenticated users with the 'DNS Resolver: Advanced' privilege to inject arbitrary Unbound directives via the sock_queue_timeout parameter. This can override local DNS records and forwarding for all clients, impacting integrity and availability. Publicly available exploit code exists, and the issue is rated medium severity (CVSS 4.0 base 5.1).
Authenticated pfSense CE users holding the 'DNS Resolver: Access Lists' privilege can embed CR/LF characters in the aclname or aclaction fields of an Unbound access list, causing attacker-supplied Unbound directives (local-data, local-zone, forward-zone) to be written into access_lists.conf and letting the attacker control which DNS answers are served to LAN clients. All pfSense CE versions through 2.9.0 are affected (CPE cpe:2.3:a:netgate:pfsense_ce:*), the root cause is CWE-93 (improper neutralization of CRLF sequences), and publicly available exploit code exists; there is no CISA KEV confirmation of active exploitation. Because the CVSS vector requires PR:H, exploitation demands an authenticated account with a specific, highly privileged DNS configuration role, so realistic risk is insider misuse or abuse of a compromised privileged session rather than opportunistic external attack - a genuine but bounded-priority issue rather than an emergency.
Stored cross-site scripting in Aureus ERP through 1.6.0 allows an authenticated user who can create or edit Inventory Operation Types and Location names to embed HTML/JavaScript in those fields, which are rendered without escaping by the Filament-based Rule form and infolist and then execute in the browser session of any warehouse manager or administrator who views or edits an affected Inventory Rule. The attack is not anonymous and not autonomous: the attacker must already hold an account with inventory-configuration permissions (CVSS PR:L), and the payload only fires once a privileged victim opens the affected screen (UI:R), limiting impact to actions available in that victim's session. Publicly available exploit code exists (a HackMD write-up is referenced), the issue is not listed in CISA KEV and shows no confirmed active exploitation, and the vendor fix is available upstream via pull request 1619.
Stored cross-site scripting in Webkul's Aureus ERP through version 1.6.0 allows an authenticated user holding permission to create Public Holidays or Mandatory Days to store JavaScript in a holiday name, which is then rendered unescaped as an HtmlString inside the Time-Off plugin's Holiday modal. The payload executes in the browser of any HR manager or administrator who opens that modal, enabling session hijacking or privileged actions in the victim's context. Publicly available exploit code exists, but the issue is moderate-priority rather than an emergency: the CVSS 4.0 vector (PR:L/UI:P) requires a valid low-privilege account with holiday-creation rights, and the script only fires when a privileged user actually opens the affected modal rather than self-triggering.
Stored cross-site scripting in Netgate pfSense CE 2.3.0 through 2.9.0 lets an authenticated WebGUI user who holds the Firewall: Rules or NAT: Port Forward privilege plant a crafted separator[] color value that display_separator() writes unencoded into an HTML class attribute, so the payload executes in the browser of any administrator who subsequently opens the firewall rules or port-forward page. Because the script runs inside that administrator's authenticated session, it can drive WebGUI actions at the higher privilege level; publicly available exploit code exists, but there is no CISA KEV entry, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) frames this as a moderate, insider-flavoured privilege-escalation issue rather than an urgent unauthenticated compromise.
Stored HTML injection in EspoCRM versions prior to 9.3.9 lets an unauthenticated remote sender place arbitrary HTML into the plain-text body of an email sent to a monitored group, IMAP, or email-to-Case mailbox; EspoCRM stores that body and renders it without escaping inside 'Email Received' stream notification emails delivered to users following the related record, allowing HTML injection and, in mail clients that execute embedded markup, JavaScript execution. Exploitation is constrained by the inbound-mail prerequisite, by required victim interaction (the follower must open the notification email, CVSS vector UI:R), and by mail-client behavior, yielding a moderate CVSS 3.1 score of 4.3 with limited integrity impact and no confidentiality or availability impact. Publicly available exploit code and the upstream fix commit are both public, but no confirmed active exploitation has been reported at time of analysis.
Unauthorized integrity change in EspoCRM before 9.3.7 lets an authenticated, low-privileged user flip the opted_out state on Contacts or Leads they are not permitted to read or edit, by calling the TargetList opt-out or cancel-opt-out action with record identifiers they do not legitimately control. The attacker must already hold a valid account with access to a shared TargetList, and the resulting impact is confined to the opt-out relationship flag on the targeted records - there is no confidentiality or availability impact, consistent with the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) and score of 4.3. Publicly available exploit code exists, the issue is fixed in EspoCRM 9.3.7, and there is no confirmed active exploitation (not in CISA KEV).
Missing capability checks in the Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 allow any authenticated user - a Subscriber is sufficient per the CVSS vector (PR:L, authenticated) - to invoke plugin AJAX actions that read the URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs. Exploitation is conditional rather than opportunistic: the attacker needs a low-privileged account on the site, and an administrator must have already run the plugin's content scanner so that the harvested URL set exists, which is what drives the High attack complexity (AC:H) in the CVSS 4.2 score. Publicly available exploit code exists and the issue is fixed in version 2.0.2, but it is not listed in CISA KEV, and the exposure is meaningfully reduced on sites that disable open registration. This is a genuine but modest-priority issue, not a high-severity emergency.
QNAP Notes Station 3 versions prior to 3.9.11 contain an OS command injection flaw (CWE-78) that permits unauthenticated network attackers to run arbitrary commands on a NAS where the optional Notes Station 3 add-on is installed and reachable. The vendor's CVSS 4.0 vector (6.9) indicates low confidentiality, integrity, and availability impact, suggesting the injected commands execute in a constrained context rather than granting full system control. No public exploit code has been identified at time of analysis, and the primary exposure is limited to internet-facing or broadly accessible NAS instances running the vulnerable add-on.
Java class-enumeration through the ExtDirect endpoint in Sonatype Nexus Repository 3 allows an unauthenticated, remote attacker to pass attacker-controlled input into a Java class loading call and thereby determine whether specific classes are present in the application, a low-impact information-disclosure issue that does not by itself permit code execution. The attack requires no authentication or user interaction (CVSS v4.0 PR:N/UI:N, assessed CVSS v3.1 6.9-equivalent AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) and is limited to instances of Nexus Repository 3 running versions prior to the 3.97.0 fix that expose the ExtDirect endpoint on an reachable network interface. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the 'RCE' tag in the source feed is misleading because the vendor description explicitly states the flaw does not achieve code execution.
Bandit versions 0.6.0 up to (but not including) 1.13.0 pass an attacker-supplied authority from HTTP/1 absolute-form and authority-form request targets straight into conn.host and conn.port without validating it against the RFC 3986 host grammar, so an unauthenticated remote request such as 'GET http://good.example@evil.example/x HTTP/1.1' overrides the Host header that Bandit does check. The real-world impact is narrow and conditional: it only matters when the hosting Elixir/Phoenix application builds absolute URLs from conn.host/conn.port (Plug.Conn.request_url/1, Phoenix URL helpers) and then uses those URLs in a security-relevant way, and because message framing is untouched and no CR or LF byte can reach conn.host, it cannot be turned into request smuggling or CRLF/response-header injection. The vendor rates this CVSS 4.0 6.9 (Medium) with only low integrity impact (VI:L, no confidentiality or availability loss); no public exploit code or confirmed active exploitation has been identified at time of analysis (no public exploit identified at time of analysis).
Authorization bypass in Eclipse Jetty's declarative security layer lets unauthenticated remote attackers reach resources that a Jakarta security constraint was supposed to protect when that constraint is expressed with 'http-method-omission'. The flaw affects the jetty-security module together with the jetty-eeN-security and jetty-eeN-servlet modules bundled across multiple Jetty release lines, but only for applications that actually use method-omission constraints; the impact is scoped to those protected resources rather than the whole server. The vendor-assigned CVSS 4.0 score is 6.9 and our independent assessment rates it a moderate-severity CWE-863 authorization bypass reachable over the network with no authentication and no user interaction (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N); no public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Authorization bypass in Eclipse Jetty's jetty-security and jetty-eeN-security modules allows a request to slip past intended access restrictions when an application declares two or more security constraints that share the same http-method-omission set and define no url-patterns; Jetty replaces the earlier constraint instead of merging it, so the authorization check that should have applied is silently dropped. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:L/VI:L/VA:N) the flaw is network-reachable and unauthenticated, with limited confidentiality and integrity impact and no availability impact; our independent assessment rates it medium severity and stresses that exploitation depends on the application actually using that overlapping-constraint deployment pattern, making the practical attack complexity higher than the vendor vector suggests. Only applications that both run an affected build and use the duplicate http-method-omission configuration are exposed, and there is no public exploit identified at time of analysis.
Unauthenticated remote attackers can retrieve a complete OpenAPI schema and repeatedly force CPU-intensive schema regeneration on Lychee photo-management installations before version 7.7.0. The GET /docs/api route is exposed by default after installation, lacks authentication and rate limiting, and regenerates the Scramble-generated documentation on every request, enabling both API-surface disclosure and server resource exhaustion. This is a medium-severity resource-exhaustion issue (CWE-770) with bounded impact-no code execution or data compromise-and no public exploit code or confirmed active exploitation identified at time of analysis.