Remote code execution in the Theme-one The Grid WordPress plugin through version 2.8.1 allows network attackers to inject code or commands via the plugin's grid-generation code path, with the supplied CVSS:3.1 vector indicating AV:N/AC:L/PR:N/UI:N (unauthenticated and no user interaction per the vector, though the exact endpoint and authentication prerequisite should be verified in the Patchstack advisory). The provided vector rates this as 10.0 Critical with full confidentiality, integrity, and availability impact, while our independent assessment adjusts scope from Changed to Unchanged but still considers impact High. No public exploit identified at time of analysis, and no KEV or EPSS data was provided.
Privilege escalation in the Theme My Login plugin for WordPress (versions up to and including 7.2.1) allows unauthenticated attackers to change arbitrary user passwords on multisite installations in certain configurations, leading to account takeover and potential full network compromise. The flaw stems from improper validation of user identity before password updates (CWE-269). Exploitation requires a non-default multisite setup, and no public exploit code is identified at time of analysis; the effective attack complexity is higher than the base CVSS 9.8 score implies due to this configuration dependency.
Unauthenticated remote peers can query and download patient demographics and medical imagery from dcm4chee-arc-light archives left in their default configuration, because the DICOM listener accepts association requests from calling AE titles that were never registered. An attacker who can reach the archive's DICOM service (commonly TCP 11112) can use C-FIND and C-GET to enumerate and retrieve patient records, and C-STORE to file fabricated studies under an existing patient identity, corrupting the clinical record. Exploitation requires no credentials and no user interaction (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N); no public exploit code and no confirmed in-the-wild exploitation are identified at time of analysis, so the high severity is driven by the confidentiality and integrity impact on protected health information rather than by observed attacks.
Remote authentication bypass in EseeCloud devices lets an unauthenticated attacker log in to the device management/login interface using a credential hard-coded into the product, yielding full control of the device (CVSS 4.0 base 9.3; independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Every condition for exploitation is attacker-friendly: no account, no user interaction, no non-default configuration, and no special network position beyond reachability of the management interface, so internet-exposed or cloud-reachable units are effectively open doors while NAT/firewall-isolated devices are shielded. No public exploit code or confirmed active exploitation (CISA KEV) is identified in the available data at time of analysis, and no EPSS score was provided, but the credential is embedded in the firmware rather than guessed, so the barrier to abuse is low wherever the interface is reachable. The flaw was reported to CISA's ICS-CERT program and published as advisory ICSA-26-288-02 under the Authentication Bypass tag.
An out-of-bounds write in MariaDB Server's spatial WKT serialization allows an authenticated, low-privileged database user who can execute SQL against a GIS function to corrupt server memory by supplying a deeply nested GeometryCollection to ST_AsText/AsText. Affected builds are MariaDB 10.6.1 through the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (the published score of 9.9 assumes a scope change that the independent assessment does not confirm). There is no confirmation of active exploitation (the issue is not in CISA KEV), but the upstream fix commit contains a public regression test that reproduces the crash and constitutes a working proof-of-concept; the reliable standalone outcome is memory corruption and denial of service, with code execution only achievable in combination with a second vulnerability.
Use-after-free in MariaDB Server's SYS_REFCURSOR handling (12.3.1 through 12.3.2, and the 13.0.x branch before 13.0.2) lets an authenticated, low-privileged database user crash the server and corrupt server memory by declaring and opening more than the default 16 SYS_REFCURSORs inside a stored routine and then fetching from one of them. The flaw is a stale-reference bug in the cursor array: when the array is reallocated to grow beyond its initial 16 slots, routine-context references still point at the freed element, and the resulting use-after-free can be leveraged for remote code execution only when chained with a second, separate vulnerability. Authentication is required (CVSS PR:L, AV:N), and no public exploit code or confirmed active exploitation has been identified at the time of analysis; the vendor CVSS of 9.9 is high, but practical impact is bounded by the narrow affected version range and the need for CREATE ROUTINE/EXECUTE privileges plus a second bug to convert memory corruption into code execution.
Arbitrary code execution in DeepSeek Harness (dsh) at commit c291e796 stems from an untrusted search path weakness, letting an attacker plant a crafted executable in a location dsh consults when resolving content, so that the malicious file is run in place of the legitimate one. Exploitation is not automatic: per our independent assessment the attacker first needs write access to a searched directory (or control of a shared/current working directory) and then must induce a victim to open or run the substituted content, so the realistic vector is local with user interaction (AV:L/UI:R), not the network-facing, no-interaction 10.0 score supplied in the source feed. Publicly available exploit code exists (SSVC exploitation status 'poc', with a PoC repository referenced), the issue is rated fully automatable with total technical impact, and no CISA KEV listing was provided - so this is a proof-of-concept-stage risk rather than confirmed active exploitation.
Unauthenticated privilege escalation in the My Calendar - Accessible Event Manager WordPress plugin (all versions up to and including 3.8.7) allows remote attackers to overwrite the credentials of the default Administrator account (user ID 1) and gain full wp-admin access. The flaw arises from unsanitized reflection of the `mcs` GET parameter into post content, enabling injection of a nested `[my_calendar above=...]` shortcode that is processed by `mc_generate_calendar_nav()`, which calls arbitrary PHP functions via `call_user_func()` without authorization or callable allowlisting. No public exploit code has been identified at time of analysis, but the plugin's auto-generated `/my-calendar/` page is publicly accessible by default, making exploitation trivially reachable by an unauthenticated attacker.
Unauthenticated file upload in the WordPress plugin Mang Board (all versions up to and including 2.4.4) lets an anonymous visitor place executable content on the server and reach remote code execution, because the mbw_file_upload handler enforces its extension allowlist only on the file_name parameter while the filename actually saved is derived from the unvalidated image_path parameter. Exploitation fits the assessed CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N), requiring no WordPress account and no user interaction: guest posting is the plugin's default board mode, and the nonce the request must carry is printed on every public board page and therefore readable by any unauthenticated visitor. No public exploit code has been identified at time of analysis; the practical limiting factor is configuration, since an administrator who has disabled guest posting removes the unauthenticated attack surface.
Unauthenticated arbitrary file upload in the ELEX WordPress HelpDesk & Customer Ticketing System plugin (all versions up to and including 3.3.7) lets a remote attacker write attacker-controlled files, including potentially executable ones, into the WordPress installation via email attachments processed by the initMailPart function, enabling remote code execution with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No WordPress authentication or victim interaction is required; the only prerequisite is that the plugin's email-piping/IMAP mailbox feature is configured and actively polling an inbox, since the attacker reaches the vulnerable code simply by sending a crafted email to that monitored support mailbox. Exploitation is therefore configuration-dependent rather than universal, and sites that do not use IMAP mail fetching are not exposed; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor fix is available in version 3.3.8.
Unauthenticated PHP object injection in the WordPress plugin Sunshine Photo Cart (all versions up to and including 3.7.4) allows an attacker to store a crafted serialized payload through the plugin's public favorites page, which is then deserialized when any image in a non-viewable or private gallery is viewed. The plugin ships no usable POP gadget chain of its own, so the flaw has no impact on a site running only this plugin; impact materialises only when a separate plugin or theme on the same installation provides a chain, in which case the attacker could delete arbitrary files, retrieve sensitive data, or execute code depending on that chain. No public exploit code or confirmed active exploitation was identified at time of analysis, and while the submitted CVSS is 9.8 the mandatory external gadget-chain precondition means our independent assessment rates it AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity, and availability impact when the precondition is met.
Unauthenticated attackers can take over any WordPress user account, including administrators, on sites running the MailOptin plugin up to version 1.2.78.6 that have a 'WordPress User Registration' opt-in form published. The flaw allows manipulation of the optin_data[form_custom_field_mappings] parameter to override saved mappings, enabling injection of arbitrary wp_users column names (e.g., ID, user_pass) into wp_insert_user(), which then updates the target account's password. No authentication, nonce, or capability check is required, and the only prerequisite is the presence of the registration form; sites using MailOptin solely for mailing-list optins without this connection are not affected. No public exploit identified at time of analysis.
Unauthenticated remote attackers can obtain a valid Mage AI session token without possessing a legitimate OAuth credential, because the platform's session-creation endpoint fails to abort when it encounters an unrecognized OAuth provider. An attacker who supplies an arbitrary token plus an unknown provider string - and knows or guesses a valid user's email address - can impersonate that account, or cause new accounts to be created; the most damaging path is impersonating an already-privileged email. Mage OSS through 0.9.80 (prior to commit 76c4f46) is affected, the flaw carries a 9.8 CVSS rating and is classified as CWE-390 (error condition detected but not acted upon); no public exploit code has been identified at the time of analysis.
Out-of-bounds heap reads in the RIOT OS DHCPv6 client (sys/net/application_layer/dhcpv6/client.c) let an attacker who controls, compromises, or spoofs a DHCPv6 server on the same local link crash an embedded device - and potentially expose or corrupt adjacent heap memory - by sending a REPLY whose IA_PD or IA_NA option body is shorter than the structure it is parsed as. Exploitation requires firmware built with MODULE_DHCPV6_CLIENT_IA_PD enabled and the device operating as a DHCPv6 client; no public exploit code was identified at time of analysis, and the issue is fixed in RIOT 2026.07. The upstream 9.8 score (AV:N/C:H/I:H/A:H) is tempered by DHCPv6's link-local scope and the compile-time gating of the vulnerable code path, consistent with the independent assessment of CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H.
Unauthenticated SQL injection in Apache Kylin 5.0.0 through 5.0.4 lets a remote network attacker reach a backend cache API that lacks authentication and execute injected SQL against the underlying data store, carrying CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, full confidentiality, integrity and availability impact). Exploitation is primarily gated by exposure rather than by attacker capability: the vendor states the issue mainly threatens Kylin services directly reachable from the public internet, which it describes as uncommon, and in-house deployments kept on internal networks are largely unaffected. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.30% (21st percentile).
Remote code execution in WEINVIEW EasyBuilder Pro build v6.10.01.510_20251022 occurs through a buffer overflow in the UtilityManagerEx.exe component when it processes crafted input. Although the published CVSS is 9.8 with a network vector, the assessed vector requires user interaction (UI:R) and higher attack complexity (AC:H) because UtilityManagerEx.exe is a client-side engineering utility that an operator must launch and direct at attacker-controlled data, such as a malicious HMI device or project file. No public exploit was identified at time of analysis, EPSS is low at 0.29% (20th percentile), and the practical impact is concentrated on engineering workstations in OT environments.
SQL injection in the Wheels CFML framework through 4.1.2 lets remote attackers manipulate SQL statements when an application feeds request data into inline-literal query paths - opt-in parameterize=false queries, IN lists, and developer-written where strings at positions the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. The flaw is reachable unauthenticated over the network (CVSS 3.1 9.8, PR:N) but only materialises on MySQL or MariaDB backends running with the default backslash-escaping behaviour (NO_BACKSLASH_ESCAPES absent), and only where the developer has constructed the vulnerable query form; bound/parameterized queries and whereBetween() as of 4.1.2 are not affected. No public exploit code or confirmed active exploitation was identified at time of analysis. The issue is fixed in Wheels 4.2.0.
Authentication bypass in Apache Kylin 4.0.4 through 5.0.4 allows unauthenticated network attackers to reach protected functionality when the Kylin web/REST service is directly exposed, with the 9.8 CVSS vector indicating high confidentiality, integrity, and availability impact. EPSS is just 0.25% (15th percentile) and no public exploit code was identified at time of analysis, while the vendor emphasizes that typical internal-only Kylin deployments are mostly not impacted and that public exposure of Kylin services is uncommon. The practical risk is therefore driven primarily by network exposure rather than by the headline score.
Unauthenticated access control bypass in Apache Kylin 4.0.0 through 5.0.4 allows network-reachable attackers to invoke the platform's normally protected system cleanup actions without any credentials, giving them integrity and availability impact against the Kylin service (CWE-287; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N with I:H/A:H). The vendor emphasizes that only Kylin instances directly exposed to the public internet are materially at risk and that typical in-house/internal deployments are mostly not impacted, so exposure is governed by network reachability rather than by any configuration toggle. EPSS is low at 0.25% (15th percentile) and no public exploit code has been identified at time of analysis; there is no KEV listing.
Text::CSV_XS before 1.65 can inject a spurious 0xFF byte into parsed data when parse() is given a string ending in a field separator followed by a lone CR and the final field is empty, causing corrupted field values or malformed UTF-8. This affects the in-memory string parsing API in the Perl module, and an attacker who controls CSV input could alter application data integrity but cannot achieve code execution, confidentiality loss, or availability impact through this defect alone. No public exploit was identified at time of analysis, EPSS is 0.19% (8th percentile), and the independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
CSV record splitting in Text::CSV_XS before 1.65 allows an attacker-controlled field that has been used in a numeric context to be serialized without quotes, so an embedded newline, carriage return, or delimiter can terminate the record early and turn the remaining fields into a separate row. The flaw is limited to the combine()/print() write path in binary mode (the default) and requires the attacker to control that specific field plus the application to perform a numeric operation on it before serialization; the assessed vector is network-reachable but high-complexity, unauthenticated, with integrity-only impact. No public exploit was identified at time of analysis, and EPSS is 0.19% (8th percentile), indicating low predicted exploitation activity despite the serious record-splitting consequence.
Text::CSV_XS versions before 1.65 for Perl silently corrupt the final record written with print() when a UTF-8 flagged (decoded) field is followed by a field ending in bytes that are not valid UTF-8: the held-back trailing byte, any closing quote, and the line ending are never flushed, yet print() still returns true. The practical result is fused records - the next record lands on the same line, or, in the quoted case, the missing close quote makes downstream readers absorb every following row into that field - an integrity impact on generated CSV rather than code execution. According to CISA KEV no active exploitation is confirmed and no public exploit code was identified at time of analysis; EPSS is 0.19% (8th percentile), and the reported 9.8 AV:N/AC:L vector is not supported by the exploitation prerequisites, which require a specific mixed-encoding data condition.
A use-after-free in the Perl XS module Text::CSV_XS (versions 1.46 through 1.64) lets attacker-supplied CSV content crash the parsing process when an application combines three specific features: bind_columns(), the non-default skip_empty_rows option (or its 'eof' mode), and input containing an empty line. The defect drops a reference from the caller's bound scalar while it is still in use, so subsequent application code touches freed memory and typically aborts - the independent assessment scores this as availability-only impact (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) rather than the headline 9.8, because the vulnerable code path never runs under default configuration. EPSS is low at 0.19% (8th percentile), no public exploit code was identified at time of analysis, and no CISA KEV entry exists; a vendor patch is available in Text::CSV_XS 1.65.
Apache Answer through 2.0.2 fails to enforce content-visibility controls in its reaction API, allowing remote unauthenticated attackers to read reaction metadata from restricted content and to add or remove their own reactions. The assessed impact is limited to reaction confidentiality and integrity-attackers cannot alter the protected content, manipulate other users' reactions, or affect availability-despite the input's 9.8 base score. No public exploit code has been identified at time of analysis, and the vendor recommends upgrading to 2.0.3.
Unauthenticated remote command execution inside containers managed by Dockhand (Finsys) affects all versions prior to 1.0.34: the WebSocket upgrade request for the in-browser terminal endpoint /api/containers/<id>/exec is served without any authentication check, so an attacker who can reach the instance and knows a running container ID can open a raw terminal session and run commands inside that container. No authentication is required (CVSS:3.1/PR:N, CWE-306), and the S:C/C:H/I:H/A:H scoring reflects realistic container-to-host escalation when the target container is privileged or exposes sensitive host mounts such as the Docker socket; exploitation is constrained in practice because the attacker must know or enumerate a specific container ID and the target must have an interactive shell. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the pre-auth nature and high EPSS-relevant profile make the issue high priority; a vendor-released patch exists in version 1.0.34.
Stored cross-site scripting in the Audit Logs component of Crafty Controller (the crafty-4 project by Arcadia Technology, LLC) allows an unauthenticated remote attacker to plant script payloads through attacker-influenced HTTP header values that the panel writes into its audit entries, with the payload executing in the browser of a privileged administrator who later opens the Audit Logs view. Per the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N), the planting step requires no authentication, but realistic impact depends on the web interface being reachable from the attacker's network path and on an administrator actually viewing the poisoned log entry, which is the primary limiting factor. No public exploit identified at time of analysis, no CISA KEV listing is present in the supplied data, and no EPSS score was provided; exact affected and fixed versions are not stated in the available data.
Memory corruption in RIOT OS (versions prior to 2026.04) with the ATWINC15x0 Wi-Fi driver and MODULE_ATWINC15X0_DYNAMIC_CONNECT enabled allows an adjacent unauthenticated attacker to trigger a buffer overflow by advertising a malformed or oversized SSID, potentially leading to a hard fault, denial of service, or code execution. Exploitation requires the device to perform a Wi-Fi scan and the attacker to be within radio range. No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 2026.04.
Missing authentication in LangChat lets unauthenticated remote attackers reach the application's REST controllers, because a default deployment up to commit 2a6285a never registers a Sa-Token interceptor. Calling endpoints such as /api/v1/auth/users returns user records containing plaintext passwords, and the same absent authorization check lets an attacker read LLM provider API keys, create super-admin accounts, and modify or delete stored data. The independent assessment scores this 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) with no special conditions beyond network reachability; the technical detail is publicly documented, but no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status.
Unauthenticated configuration write in Misaka Danmu Server 2.8.9 and earlier allows remote attackers to bypass authentication entirely and gain administrative access by abusing the unprotected POST /api/ui/config-history/rollback endpoint. An attacker can write arbitrary configuration keys, such as setting ipWhitelist to their own /32 address, modifying trustedProxies, or altering webhookApiKey, which then grants access to every protected endpoint as the administrator. The flaw carries a critical severity rating (CVSS 4.0 base score 9.3; independent assessment confirms a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and requires only network reachability of the web API - no authentication, user interaction, or non-default configuration is needed. No public exploit identified at time of analysis.
Authentication bypass in Simple Admin Core through v1.8.7 lets unauthenticated remote attackers forge a valid super-administrator JWT by signing it with the hard-coded Auth.AccessSecret (jS6VKDtsJf3z1n2VKDtsJf3z1n2) shipped in api/etc/core.yaml, then set roleId 001 to obtain full administrative control over users, roles, menus, API authorities, configuration and token issuance. Exploitation requires only network reach to the core API (default port 9100) against a deployment that still runs the vendor's default secret - no credentials and no user interaction - and the CVSS 4.0 base score is 9.3, corroborated by the independently assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (unauthenticated, network-exploitable, full confidentiality/integrity/availability impact). No public exploit identified at time of analysis, although a public technical writeup detailing the bypass exists, and deployments that rotated AccessSecret to a private value before deployment are not exploitable via forged signatures.
DataBuff ai-apm-web through 0.1.10 ships with a hard-coded administrator account (admin / Databuff@123), allowing unauthenticated remote attackers to POST those credentials to /webapi/api/v1/auth/login and receive an administrator token. That token grants access to all protected /webapi routes, yielding full confidentiality, integrity, and availability impact on affected deployments. No public exploit identified at time of analysis, but exploitation is trivial if the built-in admin password remains default and the login endpoint is network-reachable; independent assessment finds this a genuine high-priority issue, not an inflated-CVSS artifact.
Blind SQL injection in the halfdata Green Popups WordPress plugin before 7.6.3 lets a remote attacker inject crafted SQL through an HTTP request and extract data from the site's database one inferred bit at a time. The vendor (Patchstack) rates this 9.3 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, indicating network reachability, low complexity, a scope change, and high confidentiality impact, while our independent assessment scores it 9.3 as well but with PR:L instead of PR:N - meaning the true privilege prerequisite is not confirmed from the available data and pre-authentication exploitability cannot be assumed. There is no CISA KEV entry and no public exploit code identified at time of analysis, so this should be treated as a serious but not confirmed actively exploited issue; because it is blind, extraction is inference-based and slower than direct-output injection but still permits theft of user, configuration, and credential-adjacent data.
Unauthenticated SQL injection in TSG Profleet allows remote attackers to fully compromise the application's database via a crafted GET request to the '/cgi-bin/index.php' endpoint using the 'Identificación' parameter. The flaw requires no authentication, user interaction, or special configuration, and affects all versions of the product according to the CPE. No public exploit code or active exploitation has been observed at time of analysis, but the high CVSS score (9.3) and potential for data theft, modification, or deletion make it a critical risk for exposed instances.
FreeRTOS-Kernel V11.3.0 and V11.3.1 contain an incorrect-authorization flaw (CWE-863) in the Memory Protection Unit port for the Arm Cortex-R82 (Armv8-R AArch64), allowing an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it via a buffer argument passed to an MPU system call. Exploitation is strictly local: the attacker must already be able to execute an unprivileged task on the device and invoke an MPU system call with an attacker-controlled buffer argument (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), so remote/network reach and non-MPU or non-Cortex-R82 builds are unaffected. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the flaw is fully fixed in V11.3.2, which is the recommended upgrade target.
Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port allows an unprivileged task running on an MPU-enabled build to read or write privileged kernel memory beyond the validated buffer window by issuing a stream buffer system call. Exploitation requires a narrow configuration: an MPU-enabled build on that specific AArch64 port at those two versions, plus pre-existing ability to execute an unprivileged task that can make stream buffer calls - there is no remote vector, and the affected hardware port is new and narrowly deployed. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV); the vendor has released V11.3.2 to remediate it.
Argument injection in the Claude Agent SDK for Python (claude-agent-sdk) before 0.2.121 allows remote attackers to achieve arbitrary command execution when an embedding application passes untrusted input into the SDK's `resume` option. Because `--resume` is declared by the Claude CLI with an optional value, a session identifier beginning with `-` is parsed as a separate CLI flag rather than the option's value, letting an attacker inject `--mcp-config` and register a stdio MCP server that executes arbitrary commands at CLI startup while bypassing the SDK's permission controls. The assessed CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates no authentication is required but exploitation is high-complexity and conditional on the host application forwarding attacker-controlled data as the session ID; a vendor patch is available as version 0.2.121, and no public exploit code was identified at time of analysis.
An unauthenticated stack-based buffer overflow in the Boa web server embedded in Netcore NR256CN firmware through 1.5.140116 lets remote attackers crash the router's main Boa process - and potentially execute code - by sending an HTTP Basic-auth username longer than 63 bytes to any password-protected /router/*.cgi route. The defect lives in the pre-authentication user_ok() handler, where Basic-auth usernames are copied with unbounded strcpy() into a fixed 64-byte stack buffer, so exploitation requires no credentials and no user interaction; the practical risk is governed almost entirely by exposure, since the attacker must be able to reach the device's HTTP management interface (far more dangerous when it faces the WAN, far less so when confined to the LAN). Per available data there is no confirmed active exploitation in CISA KEV and no public exploit code identified at time of analysis, but the zero-prerequisite access path and the network-facing attack vector make this a high-priority issue for any NR256CN with an internet-reachable admin UI.
Unauthenticated administrative account creation in WhaTicket Community through commit cf04795 allows remote attackers to self-register as administrators via POST /auth/signup by omitting the profile field or setting it to admin. Successful exploitation grants control over user management, settings, and all tickets, contacts, messages, and WhatsApp connections. The flaw is unauthenticated and network-reachable under the assessed CVSS:3.1 vector, but no CISA KEV active exploitation is confirmed and no public exploit is explicitly identified at time of analysis, although a public technical writeup reference exists.
Authentication bypass in the DataBuff ai-apm-web module through version 0.1.10 lets unauthenticated remote attackers forge administrative JWT session tokens because the application ships and consumes a hardcoded HMAC signing secret ('dev-secret') in JwtTokenService. An attacker who knows that default key can mint a token claiming the admin role with a future expiry and gain full administrative access to protected /webapi routes, most critically the Doris SQL query API, yielding high confidentiality, integrity, and availability impact (vendor score 9.3; independently assessed CVSS:3.1 base 9.8 with PR:N, no privileges or user interaction required). Exploitation is conditional on the deployment retaining the shipped default secret: any instance that has replaced it with a unique strong value is not exploitable through this path. This CVE is not listed in CISA KEV and no public exploit code was identified at time of analysis, though a third-party technical write-up describing the flaw is publicly referenced; note that classic HS256/JWT signing bypasses are trivial to script once the key is known, so the absence of a packaged exploit should not be treated as meaningful protection.
Unauthenticated remote code execution in WeRSS (we-mp-rss) through 1.5.3 allows any attacker who can reach the public GET /rss/{feed_id} endpoint to run arbitrary OS commands as the service account. The flaw is a server-side template injection (CWE-95) in the template parser: by supplying a non-built-in ext value together with a {{=expression}} template, an attacker uses object-subclass traversal to bypass the eval denylist and reach command execution, with no authentication, user interaction, or non-default configuration required. Reported CVSS is 9.3 (CVSS 4.0, AV:N/AC:L/AT:N/PR:N/UI:N) and our independent assessment confirms remote, unauthenticated exploitation with high confidentiality, integrity and availability impact, rating this a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk case; no public exploit code was identified at time of analysis, though a public technical writeup of the exploitation chain and a VulnCheck advisory are referenced.
Unauthenticated account takeover in IceCMS through 4.1.5 allows remote attackers to modify, disable, or delete any account, including administrators, by sending PUT requests to /User/updateUser and setting a new password and role for an arbitrary userId. The root cause is that the /User/** path is excluded from the Shiro JWT authentication filter, so no valid session, token, or credentials are required when the backend user-management endpoints are reachable. It is critical severity (CVSS 9.3; independently assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit identified at time of analysis.
Unauthenticated attackers can obtain a valid JWT session for any account - including superusers - in FastapiAdmin through 3.0 by abusing auto-login endpoints that ship without authentication checks. The attack chain is straightforward: enumerate accounts via /api/v1/auth/auto-login/users, mint a superuser auto-login token, then exchange that token for a full JWT session granting complete administrative control of the application. Exploitation requires only network reachability to the admin API with no credentials, no user interaction, and no non-default configuration, and the referenced public writeup also notes a hardcoded JWT signing secret that further undercuts token-based defenses; no vendor-released patch was identified at time of analysis, and no public exploit code was confirmed.
Unauthenticated attackers can seize full administrative control of Webreaper Damselfly deployments through version 4.5.3 because the authorization attributes on the REST API controllers were shipped commented out, leaving every /api/* route reachable without credentials. An attacker can send PUT /api/users with an Admin role to create their own administrator account, or POST /api/users to reset any existing user's password, then use that access to read, modify, or destroy the entire photo library and its configuration. The flaw is rated CVSS 4.0 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) and classified as CWE-306; no public exploit identified at time of analysis, although a public technical writeup of the missing authorization, the upstream GitHub issue, and a VulnCheck advisory are referenced.
Server-side request forgery in Chaskiq through 2.0.3 allows unauthenticated attackers to make the server fetch arbitrary URLs-including internal network resources and cloud instance metadata endpoints-by submitting crafted requests to the createUrlUpload GraphQL mutation. The fetched content is stored as an ActiveStorage blob and returned to the attacker, enabling exfiltration of sensitive data such as IAM credentials from IMDSv1 endpoints. With a CVSS 9.2 severity and no authentication required, this is a high-priority issue; at time of analysis, no public exploit code was identified, though a technical writeup is publicly available. Note: confirmed actively exploited (CISA KEV) is not applicable; no public exploit identified at time of analysis.
Improper verification of the source of IPv6 Router Advertisements in Amazon FreeRTOS-Plus-TCP before V4.4.2 allows an unauthenticated attacker on the same local link to send crafted Router Advertisements and influence a device's IPv6 default gateway, on-link prefix, and address configuration, potentially redirecting or intercepting IPv6 traffic (assessed CVSS:3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). Exploitation requires IPv6 Router Advertisement/autoconfiguration processing to be enabled and the attacker to be positioned on the same link, because RAs are link-local ICMPv6 multicast messages that are not routable; no authentication or user interaction is required. No public exploit code has been identified at time of analysis and CISA KEV does not list this CVE; the vendor has released patch V4.4.2.
Authentication bypass in OpenBMB StaffDeck through 0.5.6 lets unauthenticated attackers forge valid administrator session tokens by signing an HMAC-SHA256 token with the hard-coded default app_secret shipped in backend/app/config.py, targeting the seeded 'admin' user in the 'tenant_demo' tenant. Successful exploitation grants full tenant administration, including access to stored model and channel credentials; the assessed CVSS 3.1 score is 9.2 (Critical) with AV:N/PR:N/UI:N but AC:H/AT:P, because only deployments that have not rotated the default secret and that still retain the demo tenant and admin account are affected. No public exploit identified at time of analysis, and no CISA KEV entry or vendor-patched version was provided in the source data.
Python code injection in SGLang 0.5.10 through 0.5.22 allows unauthenticated remote attackers to escape an eval() sandbox in the _evaluate_filter() helper and execute arbitrary Python in the scheduler process. Exploitation is strongly gated: the optional debug dumper server must be explicitly enabled by setting the DUMPER_SERVER_PORT environment variable, which is what exposes the unauthenticated /dumper/configure endpoint; default deployments do not enable it. Once the endpoint is reachable, a crafted filter expression is stored and runs on the next forward pass, giving full code execution with high confidentiality, integrity, and availability impact; no vendor-released patch has been identified at time of analysis, and no public exploit code was identified at time of analysis.
Unauthenticated attackers can take over accounts on Course Tencent Cloud versions 2.0.1 and earlier by brute-forcing 6-digit SMS/email verification codes that are never invalidated or attempt-limited. Exploitation requires knowledge of the victim's registered phone number or email address and rotation of source IPs to bypass per-IP rate limiting, as the codes have no per-account attempt counter. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in WIMOOR through commit ec86736 allows remote attackers to impersonate any tenant and privilege level by forging an unsigned X-USERINFO header, enabling read and modification of other tenants' orders, finance data, and Amazon seller authorizations. Exploitation requires direct network access to backend service ports, bypassing the API gateway that normally signs the header; deployments where backend ports are segmented/firewalled are not exploitable. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) captures this high-severity impact but gated by network positioning, and no public exploit has been identified at time of analysis.
Integer overflow in RIOT OS nanocoap CoAP server allows remote unauthenticated attackers to trigger out-of-bounds memory access, denial of service, or memory corruption by sending a crafted Block2 option with a block number exceeding the 20-bit maximum. Affected versions are prior to 2026.07, specifically builds around master baseline commit aeeae69e on 32-bit targets. No public exploit code or active exploitation has been identified at time of analysis. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).