Authenticated blind server-side request forgery in Tandoor Recipes before 2.6.10 allows a user with privileges to create a Space and configure an AI provider URL to force the server to connect to arbitrary internal addresses. The AI actions behind TARGET/api/ai-import/ and api/ai-step-sort/ pass the attacker-supplied provider URL straight to LiteLLM, bypassing the application's safe_request outbound filtering, and the resulting connection success, refusal, or timeout is surfaced as a reachability oracle that can be used to map internal hosts, ports, and cloud metadata endpoints. Exploitation requires an authenticated account (PR:L) and the AI provider feature to be in use, and exposure is limited to a blind oracle rather than confirmed response-body exfiltration; no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV).
Missing authorization checks in ERPNext versions prior to 15.121.0 and 16.34.0 let any authenticated user with a low-privilege role invoke state-changing whitelisted endpoints - such as Ledger Merge, Process Period Closing Voucher start/pause/cancel, Repost Payment Ledger, Delivery Note sales return, payment order, and bulk transaction processing - without the write, submit, cancel, or role permissions those operations should require, allowing tampering with financial and transactional records beyond the user's assigned role. The flaw is rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), so exploitation requires a valid low-privileged account but no admin rights, no user interaction, and no non-default configuration; integrity impact is high while confidentiality is unaffected. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the attack surface is standard functionality present in every affected deployment, so multi-user or internet-exposed instances should treat this as high priority. Vendor-released patch: 15.121.0 and 16.34.0.
Heap exhaustion denial of service in FasterXML jackson-core 2.16.0 and later allows an unauthenticated remote attacker to force allocation of roughly 100 MB or more per oversized JSON property name whenever untrusted JSON is parsed from a character-based source (String, Reader, or char[]), which is the normal path for a request body already read into a String. Because the maxNameLength bound (default 50,000 characters, ~100 KB) is only validated after the entire name has been buffered, the much larger maxStringLength bound (default 100,000,000 characters, roughly 200 MB with segment bookkeeping overhead) governs first, and repeating this across concurrent requests can exhaust the heap and crash the process. The impact is availability-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H); no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
A previously paired Moonlight client that still holds its private key can bypass Sunshine's 'Disable' control and regain GameStream access by presenting an alternate certificate derived from its stored paired certificate. Affected builds (2026.329.165800 through pre-2026.906.222525) validated only that the presented certificate chained to a stored paired-client anchor and compared certificate text without canonicalizing equivalent PEM encodings, so the server never confirmed the connection came from the exact enabled paired identity. This is CWE-863 (Incorrect Authorization) and carries CVSS 3.1 base 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L); the vector's PR:L aligns with the requirement for a previously paired client identity, no public exploit code was identified at time of analysis, and removing (rather than merely disabling) the paired client severs the trust relationship.
Unauthenticated remote attackers can steal OAuth2 authorization codes from smart-sso deployments running version 2.1.1 or earlier by abusing an unvalidated redirectUri parameter in the /login handler (CWE-601). A victim who already holds an active SSO session must be induced into opening a crafted /login link, after which the attacker - who must additionally hold any valid OAuth2 client credentials - redeems the leaked code at /oauth2/access_token to obtain the victim's access token, giving both high confidentiality and integrity impact (CVSS 7.6 v4.0: AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N). Exploitation is conditional rather than trivial: it fails if the victim has no active session, does not click the link, or if the attacker lacks valid client credentials, though no authentication to the SSO server itself is required (PR:N). No public exploit identified at time of analysis, although a public technical writeup describing the authorization-code leak path has been published; this is a genuine but conditional risk rather than a drop-everything emergency.
Unauthenticated path traversal in the 10Web Booster WordPress plugin (versions up to and including 2.34.5) lets remote attackers create arbitrary directories outside the plugin's cache root, with 0777 permissions applied recursively, and plant a cached page inside them by feeding unsanitized GET parameter names and values into the cache path. The write primitive is strictly limited - the filename is hard-coded to source.html and the body is the server-rendered page buffer rather than attacker-supplied content, so no executable file can be planted and code execution is not achievable, with the realistic outcomes being cache poisoning and stray directory creation (published CVSS 7.5 with I:H; the independent assessment revises integrity impact to Low), and no public exploit identified at time of analysis.
Remote MMS Read requests can crash libIEC61850 MMS servers running versions prior to 1.6.2 when the server's data model contains array-typed variables. An unauthenticated attacker (CVSS vector PR:N, AV:N) sends an alternate-array-access read with numberOfElements greater than zero and a sub-array range that exceeds the array bounds; the resulting out-of-range MmsValue_getElement call returns NULL, which is then passed to MmsValue_isDeletable and dereferenced, producing a NULL pointer dereference and process crash. Impact is availability-only (CVSS 7.5, C:N/I:N/A:H) and scoped to the array sub-access code path, since the single-element error path handles the same invalid index safely; no public exploit identified at time of analysis.
Unauthenticated path traversal in Countly Server before 24.05.50 and 25.03.44 lets remote attackers read arbitrary files that are readable by the server process, by abusing wildcard routes that serve public images and screenshots. The flaw affects deployments configured with the local filesystem backend of countlyFs (api/utils/countlyFs.js) - installs using the GridFS/database backend cannot be reached through these routes - and carries a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), so no credentials, privileges, or user interaction are required. Impact is limited to file disclosure (no integrity or availability effect); vendor-released patches exist in 24.05.50 and 25.03.44, and no public exploit identified at time of analysis.
Denial of service in pupnp (portable UPnP SDK) versions prior to 2.0.2 affects remote, unauthenticated deployments whose applications parse attacker-controlled XML and invoke ixmlElement_removeAttributeNode, causing the process to crash when ixmlNode_compare passes NULL nodeValue, namespaceURI, prefix, or localName fields to strcmp. The NULL fields arise legitimately from non-namespaced attributes created by ixmlDocument_createAttribute, and the crash occurs only when find_condition_node compares two distinct attribute objects with the same nodeName so the pointer-identity shortcut does not apply. No public exploit code or active exploitation was identified at time of analysis, and the vendor fixed the issue in 2.0.2 via commit 4b2f775e; impact is limited to availability (CWE-476, CVSS 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no code execution or data disclosure.
Unauthenticated attackers can read other customers' stored billing and shipping address PII on WordPress sites running the FluentCart plugin through version 1.7.0, exploiting an insecure direct object reference in the plugin's public AJAX checkout endpoint. Because the attacker supplies both the order_id and the address ID being compared, the plugin's internal id-equality guard is trivially satisfied, and sequential AUTO_INCREMENT order/address IDs can be enumerated at the soft rate limit of five requests per sixty seconds to harvest street address, city, state, postcode, phone, company name, VAT number and legal registration ID. The issue is confidentiality-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with no write, modification or availability impact; it is not listed in CISA KEV and no public exploit code was identified at time of analysis.
Privilege escalation in the InstaWP Connect - 1-click WP Staging & Migration WordPress plugin (all versions up to and including 0.1.4.1) lets any authenticated user at Subscriber level or above read the site's plaintext InstaWP master API key from a plugin settings page and redeem it for a full administrator session. The key is disclosed because the admin page is registered with a role name returned by InstaWP_Setting::get_allowed_role() in place of a real capability, and because generate_section_field() prints the master API key directly into a plain-text HTML input without a manage_options check; the attacker then derives the bearer secret from that key, satisfies the plugin's REST validate_api_request(), and calls POST /wp-json/instawp-connect/v2/auto-login to mint a 30-second single-use login URL that sets an administrator authentication cookie. Exploitation is not default-configured: it additionally requires the site to be actively connected to InstaWP (a valid master API key in instawp_api_options) and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (instawp_sync_tab_roles) while still retaining administrator in that list, so realistic exposure is narrower than the 7.5 base score implies. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); authentication requirements are authenticated (CVSS PR:L) with high attack complexity (AC:H).
Denial of service in pupnp (libupnp) releases prior to 22.0.4 lets remote unauthenticated attackers stall the UPnP miniserver by feeding it hostnames that resolve slowly or not at all: parse_hostport() in uri.c synchronously calls getaddrinfo() while parsing inbound HTTP request targets and GENA SUBSCRIBE CALLBACK headers, so each request pins a worker thread for the resolver timeout. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with only availability impact (C:N/I:N/A:H, 7.5), a small number of crafted requests can exhaust the bounded miniserver worker pool and deny UPnP service to legitimate devices; no public exploit code was identified at the time of analysis, though the upstream fix commit and advisory are public. Realistically the issue is bounded and self-recovering - once the hostile requests stop, threads free up - and exploitation in practice presumes LAN reachability, since miniservers are normally bound to the local network.
Denial of service in pupnp (the portable UPnP SDK) versions prior to 2.0.2 allows unauthenticated remote attackers to exhaust process resources by sending HTTP messages that use Transfer-Encoding: chunked, which the internal parser decodes and buffers without ever enforcing the configured g_maxContentLength limit on the decoded entity. The flaw is reachable through default-enabled SOAP, GENA, miniserver, and control-point HTTP response paths, so any host that can reach a pupnp-based UPnP endpoint - commonly other devices on the same LAN segment - can trigger memory/resource exhaustion with no authentication or user interaction (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; the vendor has shipped a fix in release 2.0.2.
Denial of service in JavaCV's IPCameraFrameGrabber affects all versions prior to 1.5.14, where an attacker-influenced MJPEG stream can supply an oversized Content-Length header that overflows a 32-bit buffer-doubling loop and traps the frame-grabbing thread in a permanent 100% CPU spin. Unauthenticated remote attackers can trigger this either by operating a malicious or compromised IP camera endpoint the application connects to, or by tampering with the plaintext HTTP response in transit; the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms no privileges or user interaction are required and that impact is limited to availability. No public exploit code was identified at time of analysis and there is no CISA KEV listing, and the vendor has released a fixed version (1.5.14).
SQL injection in the Vitepos - Point of Sale (POS) for WooCommerce WordPress plugin, affecting all versions up to and including 3.5.1, lets an attacker append arbitrary SQL through the 'src_by' parameter on the /vitepos/v1/vendor/list REST route and read sensitive data out of the site's database. Exploitation requires the affected plugin to be installed and active, and our assessment rates the route as reachable by any user holding a low-privileged POS role (for example vtpos-cashier) rather than by a fully anonymous visitor, although the vendor advisory also claims unauthenticated exploitation; no public exploit code has been identified at time of analysis. Impact is confidentiality-only - database disclosure, not modification - with no user interaction required.
Unauthenticated order enumeration and PII disclosure in the Klarna for WooCommerce (Klarna Payments for WooCommerce) WordPress plugin affects all versions up to and including 4.13.3, allowing any remote attacker to retrieve the secret order_key plus full billing and shipping personal data for any order in the store. Because the plugin fails to verify authorization (CWE-862) before emitting order details inline as the klarna_payments_params JavaScript variable on the order-pay endpoint, and WooCommerce order IDs are sequential integers, a full store-wide order dump can be obtained with ordinary sequential GET requests and no session, order_key, or credentials. The CVSS vector confirms the exposure is remote, unauthenticated, and requires no user interaction (AV:N/AC:L/PR:N/UI:N), with high confidentiality impact only; exploitation is trivially automatable, though no public exploit code and no confirmed active exploitation were identified at time of analysis. This is a genuine high-priority information-disclosure flaw rather than an inflated high-CVSS score, since every signal aligns with easy mass abuse across any default storefront running an affected version.
An authorization bypass in the FunnelKit Funnel Builder for WooCommerce Checkout WordPress plugin (all versions up to and including 3.16.0.6) lets unauthenticated attackers pull billing PII - full name, street address, email address, and phone number - for any WooCommerce order on a site by simply iterating sequential order IDs. Exploitation requires no authentication, privileges, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, 7.5), and the sequential ID space makes automated bulk extraction practical, so a single vulnerable store can leak its entire customer billing dataset. The hard precondition is that a FunnelKit thank-you page rendering the [wfty_order_meta] or [wfty_order_total] shortcode must exist and be reachable - stores that do not use these shortcodes are not exposed. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; Wordfence-coordinated disclosure tracks it as a genuine medium-to-high priority data-exposure flaw rather than a drop-everything emergency.
Sensitive information exposure in Modula Image Gallery 3.0.11 and earlier allows unauthenticated remote attackers to read the plaintext Password Protect password and username for published galleries by requesting the core WordPress REST route /wp-json/wp/v2/modula-gallery/{id}. The plugin redacts the same modulaSettings values on its dedicated /wp-json/modula/v2/gallery/{id}/settings endpoint, but the custom post type's show_in_rest=true registration leaves the core route without equivalent redaction. No public exploit identified at time of analysis; exploitation requires the target site to have enabled Password Protect for a gallery, so practical exposure is narrower than the 7.5 CVSS score suggests.
Privilege escalation in the Nexter Extension WordPress plugin (all versions up to and including 4.7.11) allows an authenticated Subscriber-level or higher user to restore a stale stored Administrator role onto their own account, effectively becoming an Administrator. Exploitation is tightly constrained: the attacker's account must previously have held the Administrator role, must have used the plugin's View Admin Role Switcher, and must have been demoted specifically through the wp-admin/users.php?action=promote bulk role-change control rather than the Edit User screen. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, and the assessed conditions are why the effective risk is lower than the 7.5 (HIGH) base score implies.
Rendering untrusted Markdown with the Go library github.com/gomarkdown/markdown while the html.Safelink hardening flag is enabled can crash the calling process: parser.IsSafeURL slices a link destination before validating its length and panics on empty, '.', or '..' destinations such as the input `[x]()`, and every version before 0.0.0-20260724235538-61af6e1e6971 is affected. The same panic is reachable without that flag by any downstream caller that passes a 0/1/2-byte attacker-controlled URL directly to the exported parser.IsSafeURL function, yielding a remote, unauthenticated, availability-only denial of service (CVSS 3.1 score 7.5; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation is conditional rather than universal - the default render path with Safelink disabled never reaches the vulnerable code, there is no confirmed active exploitation (not in CISA KEV), and the upstream advisory itself publicly documents the minimal crash trigger.
Account enumeration in ikas E-Commerce Infrastructure (all versions through 2026-07-13) allows unauthenticated remote attackers to determine whether a given customer account exists by observing distinguishable responses from authentication-related endpoints such as login, registration, or password reset. The flaw is reached remotely with low complexity and no user interaction, but only discloses account existence rather than credentials or data, and no public exploit code has been identified at time of analysis. Note that the input score of 7.5 (HIGH) assumes a high confidentiality impact, whereas the assessed vector (C:L, no I/A) reflects a more limited information-disclosure impact typical of username enumeration; treat the exposure as a reconnaissance enabler for credential stuffing and phishing rather than as direct system compromise.
Apache Kylin versions 4 through 5.0.4 expose sensitive information to unauthorized actors through a CWE-200 flaw that, per the CVSS vector, can be reached remotely without authentication or user interaction (CVSS 3.1: 7.5). The advisory does not specify the exact endpoint or configuration condition, so practical exposure depends on whether a vulnerable Kylin instance is network-reachable; Kylin is typically deployed inside internal big-data and analytics clusters. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.20% (9th percentile).
Apache Kylin versions 4 through 5.0.4 expose their SQL black list - the defensive configuration that enumerates blocked SQL patterns - to an unauthorized actor, allowing unauthenticated network-reachable parties to read it (CWE-200). The official CVSS v3.1 vector scores this 7.5 (AV:N/AC:L/PR:N/UI:N with C:H), while our assessed vector reduces confidentiality impact to C:L because the disclosed data is defensive configuration rather than business data; integrity and availability are unaffected in either reading. Exploitation requires only that the Kylin service be reachable and the SQL black list feature be configured, with no authentication or user interaction needed; EPSS is low at 0.20% (9th percentile), no public exploit code was identified, and the issue is not confirmed actively exploited (CISA KEV).
Unauthenticated, network-reachable Apache Kylin instances (versions 4.0.0 through 5.0.4) allow cross-project job manipulation that exposes job data belonging to other projects, giving remote attackers a confidentiality impact rated 7.5 by the vendor. The realistic attack surface is narrow: Apache explicitly notes that only Kylin deployments directly exposed to the public internet are meaningfully at risk, calling that configuration 'not common' and stating in-house deployments are 'mostly not impacted.' No public exploit code has been identified at time of analysis and EPSS is just 0.20% (9th percentile), so despite the high base score this is a low-priority item for most organizations; the vendor-released fix is version 5.0.5.
Unauthenticated network access to Apache Kylin 4 through 5.0.4's job-management interface can expose job-discard operations and related information to an unauthorized actor, with the independent assessment rating confidentiality, integrity, and availability impact as low despite the official 7.5 CVSS score. Exploitation depends on the Kylin service being directly reachable from an untrusted or public network; vendor guidance says this deployment pattern is uncommon, and segmented in-house instances are largely unaffected. No public exploit identified at time of analysis, no CISA KEV confirmation was provided, EPSS is 0.20% (9th percentile), and upgrading to 5.0.5 resolves the exposure.
Perl's Text::CSV_XS module (versions before 1.65) contains a buffer under-read in its XS whitespace-stripping routine: when parsing an all-blank field with the non-default allow_whitespace option, cx_strip_trail_whitespace walks backwards past the start of the field's heap buffer, reading and potentially zeroing one byte before it. Reaching that path requires a specific input shape - an unquoted all-blank field preceded by an escape_char that differs from quote_char, or a quoted field in getline whose line ends in two carriage returns - and an allocator layout where the physically preceding byte is itself a space or tab, so the effect is layout-dependent and reliably observable only under valgrind/ASan. Remote unauthenticated attackers who can influence CSV input to an application that enables allow_whitespace are the exposure surface; the impact ranges from a one-byte out-of-bounds read (the CVE's information-disclosure reading, 7.5) to limited memory corruption (I:L/A:L in this independent assessment), and no public exploit code or active exploitation (CISA KEV) was identified at time of analysis, with EPSS low at 0.19% (8th percentile).
Quadratic CPU consumption in Text::CSV_XS releases before 1.65 lets remote attackers exhaust CPU on Perl applications that parse attacker-supplied CSV through getline() with the default (unset) eol and classic Mac CR-only line endings. Because CR-only input arrives from Perl's default line reader as a single chunk, the parser re-copies the entire unparsed remainder after every record, so parsing cost grows with the square of the input size - seconds of CPU per megabyte and escalating rapidly with larger payloads. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), and EPSS is low at 0.19% (8th percentile); no public exploit code or CISA KEV entry has been identified at time of analysis, making this a high-scored but low-urgency availability issue.
Memory exhaustion in the Perl Text::CSV_XS library before version 1.65 allows remote attackers to terminate a process by supplying an oversized RFC 7111 fragment selector. The fragment() and csv() methods expand row=, col=, and cell= selectors into one array element per requested index before any data is read, so a selector such as row=1-400000000 against a two-line file allocates 400 million elements and ends the process with an out-of-memory error that Perl's eval cannot catch. Only applications that pass request-supplied fragment strings into this feature are affected; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.19% (8th percentile).
Denial of service in OpenModSim 1.11.0 and earlier is triggered when the Modbus master simulator processes a maliciously crafted Modbus response containing a length or count value that causes a CWE-190 integer overflow, resulting in a crash or availability loss. The assessed vector requires user interaction because the operator must connect the tool to an attacker-controlled or compromised Modbus slave/server; no authentication is required (PR:N), and impact is limited to availability with no code execution or data disclosure. No public exploit was identified at time of analysis, CISA KEV does not list this issue, and EPSS is low at 0.15% (4th percentile).
Multiple out-of-bounds read and write defects in the X.Org X client libraries (libX11, libXi, libXpm, libXrender, libXtst) let a malicious or compromised X server send crafted replies that drive client-side parsers past the end of the received buffer, crashing the linked application and, in the libX11 XKB case, writing past an allocated array. Affected are libX11 before 1.8.14, libXi before 1.8.4, libXpm before 3.5.20, libXrender before 0.9.13 and libXtst before 1.2.6; exploitation requires the victim's client to connect to an untrusted server and, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (6.5), the craftwork is unauthenticated but needs user interaction, with demonstrated impact limited to denial of service rather than code execution. No CVSS vector, EPSS score, KEV entry or POC indicator was supplied for CVE-2026-109090 specifically, so no public exploit identified at time of analysis and quantitative exploitation signals are absent.
Out-of-bounds reads in the X.Org X client libraries - libXrender before 0.9.13 and libXtst before 1.2.6 in the parsing paths covered by this entry, alongside the sibling fixes shipped in libX11 1.8.14, libXi 1.8.4 and libXpm 3.5.20 - let a malicious or compromised X server crash connecting clients by returning malformed protocol replies. The clients trust length, count and category fields supplied by the server (for example the depth, visual and subpixel counts used when building XRenderInfo, and the datum/category handling in libXtst's XRecord reply parser) without validating them against the actual received buffer, so parsing walks past the end of the packet and causes a denial of service. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (6.5), the attacker is unauthenticated from the network but exploitation requires user interaction - the victim must launch or connect an affected client to the hostile server (for example via ssh -X/-Y X11 forwarding to a compromised display) - and there is no public exploit identified at time of analysis.
Unauthenticated denial of service in Countly Server prior to 24.05.50 and 25.03.44 lets any remote network attacker crash the Node.js process that serves the analytics API by requesting a public image or screenshot route (star-rating/images/, dashboards/images/screenshots/, /appimages/*, /memberimages/*, and other */screenshots/* paths) whose path contains a URL-encoded dot. On deployments using Countly's local filesystem storage backend, that crafted path makes createReadStream open a directory instead of a file; the resulting asynchronous EISDIR error has no listener on the piped stream, so it surfaces as an unhandled exception and terminates the server process. Repeated requests keep the API unavailable; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a low-complexity, unauthenticated, availability-only impact with no confidentiality or integrity effect, and no public exploit code or CISA KEV entry was identified at time of analysis.
An unauthenticated remote client can disclose stale memory contents from a libIEC61850 server running the MMS file service, because a crafted out-of-range initialPosition in a fileOpen request drives an unsigned integer underflow in the fileRead path and produces an oversized response that appends leftover bytes from the reused connection buffer. All versions prior to 1.6.2 are affected, and exploitation requires only network reachability to the MMS/TCP listener with the file service enabled - a non-default configuration. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, though the independently assessed confidentiality impact is moderate rather than catastrophic since the attacker cannot select or guarantee the sensitivity of the leaked bytes.
Out-of-bounds heap reads and writes in spice-server's SPICE_MSGC_MIGRATE_DATA handling let an authenticated SPICE client read arbitrary heap memory or corrupt the heap while a VM is undergoing live migration. Consistent with the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H vector, the attacker must already hold a valid SPICE session and must land the malicious message inside the migration window, so real-world exposure is concentrated in deployments where the SPICE endpoint is reachable by low-privilege or untrusted users. No public exploit code and no CISA KEV entry were identified at time of analysis.
Heap buffer overflow in spice-server's GLZ encoder dictionary restore path allows an authenticated SPICE client to corrupt memory during a VM live migration by supplying a crafted max_encoders value; a size_t allocation size is truncated to int before the malloc callback, enabling a large out-of-bounds heap write. Exploitation requires an authenticated SPICE client connection (PR:L) and an active live migration with GLZ compression in use, which narrows the practical window; no public exploit identified at time of analysis. An upstream fix is proposed in GitLab merge request 253.
Unauthenticated exposure of system-level configuration information in Apache Kylin 4.0.0 through 5.0.4 lets any client that can reach the Kylin service retrieve sensitive deployment details, rated CVSS 3.1 base 7.5 (HIGH) with high confidentiality impact but no integrity or availability effect. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or non-default configuration is required, so default-reachable instances are exposed; exposure is limited mainly by whether the instance is network-reachable, and deployments confined to internal networks or placed behind authenticating proxies are significantly less at risk. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied, so prioritization should be driven by network exposure of Kylin installations rather than by observed exploitation. Upgrading to 5.0.5 is the vendor-recommended fix.
Stored cross-site scripting in the HivePress Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 1.7.32) allows unauthenticated attackers to persist arbitrary JavaScript that executes whenever a user views a page rendering an affected custom user attribute. The published CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); our assessment retains that score but raises attack complexity to High (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) because exploitation depends on a site administrator having configured a custom user attribute whose display_format template places the %value% token inside an href, src, or style attribute context - a documented but non-default use of the plugin's attribute display feature. No public exploit identified at time of analysis, and although an upstream fix has been merged (PR #375 / changeset 3747070), the realistic affected population is limited to sites with such an attribute template already in place.
Stored cross-site scripting (XSS) in the Colibri Page Builder WordPress plugin versions up to and including 1.0.390 allows unauthenticated attackers to inject arbitrary web scripts via the comment parameter; the payload is stored and executes when any user views the injected page. The vulnerability has a CVSS v3.1 score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and no public exploit has been identified at time of analysis. While the score is elevated due to scope change and low confidentiality/integrity impact, the practical risk is notable but the raw score overstates the absolute danger; sites with comments disabled are not exposed.
OS command injection in SparkyFitness versions prior to 1.6.0 allows an authenticated global administrator to execute arbitrary operating-system commands on the server by uploading a restore archive with a filename containing shell metacharacters. The vulnerability resides in the api/admin/backup/restore endpoint, which improperly interpolates the user-supplied filename into a shell command. Exploitation requires the highest-level application privilege (global admin), and no public exploit code has been identified at time of analysis. The issue is fixed in version 1.6.0.
Unauthenticated stored cross-site scripting in the WordPress plugin Flying Scripts (Delay JavaScript to Improve Site Speed & Performance) through 1.2.4 lets attackers inject script through comment input that the plugin's output-buffer rewriter later re-emits into an HTML attribute. The bypass relies on a crafted payload using only WordPress kses-allowed markup-an <abbr title> attribute plus a double-quote-bearing <code> body-and the plugin's predictable unsalted ___noise___ placeholder substitution, so the script executes when a victim views the affected page. No public exploit identified at time of analysis, and exploitation requires the vulnerable plugin to be installed with its rewriting active and a comment or equivalent input path enabled, making this a moderate-priority issue despite the CVSS 7.2 scope-changed rating.
Stored cross-site scripting in the GoSMTP Pro WordPress plugin (all versions up to and including 1.2.3) lets unauthenticated attackers plant arbitrary JavaScript inside the plugin's email-log records by submitting a comment crafted so that it survives WordPress comment kses moderation while entity-encoded, then is decoded into live HTML by core email notification handling and written verbatim to the plugin's log table. The script fires only when a privileged user, typically an administrator, opens the email-log page in wp-admin, which keeps real-world impact moderate despite the network-reachable, unauthenticated injection path; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. Exposure is limited to sites that accept comments from unauthenticated visitors and have GoSMTP Pro active with comment notification email logging enabled, while sites with comments disabled or logging unused are not affected.
Stored cross-site scripting in the Schema & Structured Data for WP & AMP plugin (versions up to 1.67) allows unauthenticated attackers to inject arbitrary JavaScript via the 'saswp_review_text' parameter, because the nonce used as the sole authorization check is publicly exposed in the [saswp-reviews-form] shortcode. Exploitation requires the shortcode to be present, making it a genuine but deployment-specific issue that sits in the mid-tier of urgency. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Feedzy RSS Feeds (RSS Aggregator by Feedzy) WordPress plugin, affecting all versions up to and including 5.2.11, allows a remote attacker to place arbitrary JavaScript into a page generated from an imported feed item by embedding a payload in the 'media:thumbnail@url' field, which then executes when a user views that page. The bug is not exploitable against an arbitrary site: the target must already have the plugin configured to import from an RSS feed whose content the attacker controls or can influence, and the script only fires when a visitor or administrator opens the resulting page. The published CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) reads as a low-complexity unauthenticated issue, but the assessed vector raises attack complexity to High (AC:H) because of the feed-control prerequisite; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, and the vendor has released version 5.2.12 that fixes the flaw.
Stored cross-site scripting in the TranslatePress - Translate Multilingual Sites with AI Translation WordPress plugin through version 3.3.7 allows unauthenticated attackers to inject arbitrary web scripts via the 'comment' parameter, which then execute in the browser of any visitor who loads the affected translated page. Successful exploitation depends on two conditions that coincide with the plugin's normal use case: the site must permit unmoderated comment submission on at least one post (WordPress holds first-time commenters for moderation by default, so this usually means a modified Discussion setting), and a secondary language must be configured so that comments are processed by the plugin's translation-render code path. Wordfence rates the issue at CVSS 3.1 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), confirming unauthenticated remote exploitation with no user interaction on the attacker's side and a scope change reflecting how stored script in a comment can act beyond the vulnerable component, and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the SureCart plugin for WordPress (versions up to and including 4.9.4) allows unauthenticated attackers to inject arbitrary web scripts via the 'comment' parameter, which execute when a victim visits a page that loads the SureCart components runtime and lacks an sc-checkout element. While the entry point is unauthenticated, successful exploitation requires a specific combination of page layout (e.g., a post with a [sc_buy_button] shortcode and no sc-checkout element) and victim interaction, significantly limiting the real-world attack surface. No public exploit identified at time of analysis.
Stored DOM-based cross-site scripting in the WordPress plugin Opti-Behavior (Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights) through version 1.9.2.1 lets unauthenticated attackers write arbitrary script content into heatmap/analytics records via the 'targetUrl' parameter, which is later rendered into a DOM sink when a user - most plausibly an administrator viewing the heatmap analytics metabox - accesses the injected page. The write endpoint is gated only by a nonce (optiBehaviorHeatmapConfig.nonce) that the plugin itself publicly emits to every anonymous visitor on tracked pages, so no account or login of any kind is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C, 7.2). Exploitation requires the plugin to be installed and active with heatmap/session tracking enabled on at least one page; no public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, though the code references in the advisory make the vulnerable paths easy to locate.
Stored cross-site scripting in the Mang Board WordPress plugin (all versions up to and including 2.4.3) lets unauthenticated attackers inject arbitrary JavaScript that executes in the browser of any user who later loads the poisoned board content. The injection path is unusually easy because the wp_ajax_nopriv_mb_template endpoint is publicly reachable, nonce verification is not enforced in content_reply mode, and admin-ajax.php answers with Content-Type: text/html so script tags embedded in the JSON body are parsed and executed. Wordfence rates it CVSS 7.2 (scope changed, PR:N/UI:N) and an upstream fix commit is referenced in the plugin's Trac changeset, but no public exploit code has been identified at time of analysis and there is no confirmed active exploitation, so this is an elevated-priority, patch-now issue rather than a top-tier emergency - the residual constraint is that execution requires a victim, ideally a privileged one, to view the injected page.
Cross-team authorization bypass in APIPark through 1.9.7-beta allows an authenticated team manager to read, modify, and delete services and applications belonging to other teams by supplying their own team identifier in the 'team' query parameter to /api/v1/service/info and /api/v1/app. Exploitation requires a valid team-manager account on an instance configured with multiple teams; the attacker first enumerates foreign service and app IDs via /api/v1/simple/services and /api/v1/simple/apps, and no user interaction or non-default settings are needed. The vendor CVSS 4.0 base score is 7.2 (High) with low confidentiality and high integrity/availability impact on other teams' resources, and no public exploit identified at time of analysis, though a public technical writeup documenting the bypass exists.
Stored cross-site scripting in the Ultra Addons for Contact Form 7 WordPress plugin (all versions up to and including 3.5.54) lets unauthenticated attackers upload a text-type file whose contents begin with HTML markup, which is then persisted and executed in the browser of any user who later views the injected page - a classic CWE-79 stored XSS. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), no authentication or user interaction is needed to deliver the payload, though execution depends on a victim subsequently loading the affected page. Exploitation is only reachable on sites that run the plugin and expose its file-upload/database add-on on a Contact Form 7 form; there is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a credible moderate-priority web flaw rather than an emergency.
Stored cross-site scripting in the Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (all versions up to and including 7.5.5) allows unauthenticated commenters to plant script payloads in comment content that execute in visitors' browsers once the comment is approved and rendered. The flaw is a bypass of WordPress's wp_kses comment sanitization: the payload uses only allow-listed tags and hides executable tokens as plain text inside quoted attribute values, and the XSS is only realized when Complianz's own Cookie-Blocker output-buffer filter applies str_replace() rewrites that break out of the attribute context. Attack complexity is assessed as High rather than Low, because exploitation requires the Cookie-Blocker output buffering and the yotu-wp integration code path to be active, and critically requires a moderator to approve the malicious comment before it renders; no public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation. Overall this is a real but non-urgent, lower-tier issue gated by human comment moderation rather than a mass-exploitation priority.