OttoKit (SureTriggers) WordPress plugin through 1.1.40 contains an incorrect privilege assignment flaw that can allow remote attackers to escalate privileges, and the vendor CVSS vector scores it 9.8 with network reachability, low attack complexity, no privileges required, and no user interaction. Successful exploitation could lead to full WordPress site compromise given the high confidentiality, integrity, and availability impact, though the provided data does not clarify whether a specific integration or API must be enabled or whether a pre-existing low-privileged account is required despite the PR:N rating; no public exploit identified at time of analysis.
Heap-based buffer overflow in snac2 before 2.93 enables unauthenticated remote attackers to crash the ActivityPub server by sending a single crafted application/activity+json POST whose JSON string contains a \u0000 escape; the vulnerable parser runs before HTTP signature verification, so federation endpoints are exposed. Publicly available exploit code exists, and the assessed impact is availability-only (server crash/denial of service), with no confirmed code execution or data exposure.
SQL injection in Modern Events Calendar Lite and Pro versions before 7.37.0 allows authenticated users with Subscriber-level access or higher to read arbitrary data from the WordPress database. Publicly available exploit code exists, though CISA's SSVC assessment finds no active exploitation; the practical barrier is the requirement for a valid low-privilege account, making this a credible mid-tier priority rather than an emergency.
Privilege escalation in the Salon Booking System WordPress plugin (10.17 through versions before 10.31.11) lets authenticated users who hold the plugin's custom salon staff role assign arbitrary capabilities, including administrator, to other accounts through the customer-editing function, enabling full site takeover. Publicly available exploit code exists, but the flaw is access-gated: it is not reachable by anonymous visitors or ordinary subscribers and requires a provisioned salon staff account, so exposure depends on how widely that role is granted and on the hygiene of those accounts. It is not confirmed actively exploited (no CISA KEV entry) and no EPSS score was provided.
Reflected cross-site scripting in WP Photo Album Plus before 9.2.11.002 allows remote unauthenticated attackers to inject script through a category navigation value that is reflected into a JavaScript event handler on gallery breadcrumb links. The victim must first open a crafted gallery link and then click the breadcrumb, so exploitation depends on that two-step user interaction; targeting a logged-in administrator yields script execution in a privileged session. Publicly available exploit code exists, and the vendor has released a patched version, 9.2.11.002.
Heap-based buffer overflow in libmng through 2.0.3 allows a crafted MNG file containing MHDR, DHDR, and a multi-record ORDR chunk to overwrite heap memory when an application calls mng_read or mng_readdisplay, producing attacker-controlled out-of-bounds writes and likely application crashes. The attack is local/file-based and requires the victim to open or process the malicious MNG (UI:P), with no confidentiality impact and limited integrity impact but high availability impact. Publicly available exploit code exists; no confirmed active exploitation (CISA KEV) is indicated in the supplied data.
Heap out-of-bounds write in Schism Tracker through 20260524 allows a crafted .ult (UltraTracker) module to corrupt the tracker's instruments pointer array, so that cleanup in csf_destroy() frees attacker-chosen pointers and crashes the application. The defect is in fmt_ult_load_song() in fmt/ult.c, which accepts the file's one-byte sample count without clamping it to MAX_SAMPLES; any build that parses .ult files is affected and no special configuration or privileges are required. Publicly available exploit code exists (the flaw is not in CISA KEV), but the vector is local file parsing that requires the victim to load the file, so the confirmed outcome is denial of service and code execution would additionally depend on controlling heap layout.
WordPress sites running the Salon Booking System plugin before 10.31.11 expose an image-import routine that fetches a caller-supplied URL server-side without validation, letting authenticated accounts with the Salon Staff role or higher pull internal-only resources back through the site and plant attacker-named files in a publicly reachable directory. The same write primitive allows storing a malicious SVG that executes JavaScript in the site's origin for anyone who opens it, giving a staff-level account a path to scripts running against higher-privileged users. Publicly available exploit code exists per the WPScan reference, but the privileged-role prerequisite and the victim interaction needed for the script-execution path keep this a moderate-priority issue rather than an emergency; a vendor patch is available in 10.31.11.
A divide-by-zero in libtta through 2.3 causes an availability-only denial of service: decoding a malformed .tta (True Audio) file whose header declares a zero sample rate triggers a SIGFPE that terminates the host process, including the bundled tta console tool and any third-party application linked against the library. Publicly available exploit code exists - the attacker must recompute the header CRC32 so the corrupt file passes the library's integrity check, then convince a victim to open the file (local vector, user interaction required, PR:N per the supplied vector). Impact is confined to a single-process crash with no privilege gain, code execution, or data disclosure, so real-world priority is low-to-moderate for deployments that actually embed libtta for TTA decoding; no CISA KEV entry is reported for this CVE.
An MPEG system header that declares an undersized packet length causes an integer underflow in stream_header() in MPEGsystem.cpp, wrapping packet_size and letting a crafted file crash any application built on smpeg through version 2.0.0. The attack is local (AV:L) and requires a victim to open the hostile MPEG file through SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data, so exploitation is limited to denial of service via reachable assertion or out-of-bounds copy; there is no path to code execution or data exposure in the assessed impact. Publicly available exploit code exists, but the issue is not in CISA KEV and no active exploitation is confirmed - it is a moderate, availability-only defect rather than a high-priority emergency.
Opening a crafted MPEG file with smpeg through 2.0.0 can crash the hosting application through a heap out-of-bounds read in MPEGsystem::FillBuffer(). The issue is reachable only when a local user opens an attacker-controlled file via SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data, and the assessed impact is availability-only denial of service. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation.
Authenticated Subscriber-level users on WordPress sites running Modern Events Calendar Lite before 7.36.4 can modify the title, content, and excerpt of arbitrary posts, pages, and custom post types because the plugin's post-update handler fails to verify ownership of the target post ID (CWE-639). This integrity-only authorization bypass (CVSS 6.5, PR:L, UI:N) requires only a low-privilege account obtainable where self-registration is enabled; publicly available exploit code exists, but CISA SSVC records no exploitation and the issue is a moderate-priority content-tampering risk rather than an emergency.
PHP object injection in the Conversational Forms for ChatBot WordPress plugin through 1.5.1 allows unauthenticated remote attackers to pass attacker-controlled serialized data into PHP unserialize(), with the potential for full confidentiality, integrity, and availability impact only if a usable POP gadget chain exists in the plugin, WordPress core, or another installed component. The independent assessment scores this as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H because the high-complexity prerequisite is a viable gadget chain, and the provided data contains no public exploit or CISA KEV confirmation.
A use-after-free in the Linux kernel's SCTP receive path lets a remote attacker who acts as an SCTP peer crash or potentially corrupt kernel memory by sending a bundled [ERROR(Stale Cookie)][DATA] packet from a non-primary address of a multi-homed association, after which a FWD-TSN chunk or the delayed SACK timer dereferences a transport that has already been RCU-freed; both a remote peer and a local unprivileged user acting as one can trigger it, and no authentication, capabilities or user interaction are required (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, score 9.8). Exposure is constrained in practice because SCTP is not enabled or used by default on most Linux deployments, and the association must be multi-homed so that a non-primary transport exists to be removed. No public exploit was identified at time of analysis and there is no CISA KEV entry, while EPSS is low at 0.21% (11th percentile); the priority signal is nonetheless act_now, and vendor patches are available for the affected stable branches.
Use-after-free in the Linux kernel's Open vSwitch conntrack helper path lets traffic traversing an OVS datapath corrupt or free conntrack extension memory, with high confidentiality, integrity and availability impact, but only on hosts that combine the conntrack action with a connection-tracking helper such as FTP or SIP - not a default configuration. The trigger is a race: an unconfirmed connection must have its extension area reallocated after a helper has stored a raw pointer in the master expectations list, which is why the assessed vector is AC:H despite AV:N/PR:N, and reachability still depends on the attacker being able to send traffic through the affected OVS conntrack path. Vendor patches exist in 6.12.112, 6.18.55, 7.2.9 and 7.3-rc5; EPSS is 0.20% (9th percentile) and no public exploit has been identified at time of analysis, although the vuln.today decision label is act_now.
Heap buffer overflow in libtta through 2.3 allows a crafted .tta file to crash 32-bit applications and affect integrity via an integer overflow in the seek-table allocation path. Exploitation requires user interaction to open the malicious audio file and is constrained to 32-bit consumers with specific malformed header values (sample rate 1 and a large samples field); 64-bit builds are not indicated as affected. Publicly available exploit code exists, but no CISA KEV confirmation of active exploitation is present in the provided data.
Plane (makeplane/plane) through version 1.4.2 makes security decisions based on the client-supplied X-Forwarded-For header without validating it against a trusted reverse-proxy chain, letting unauthenticated remote attackers spoof their perceived source IP. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), impact is limited to low confidentiality - no integrity or availability effect - and only materializes where the deployment actually uses client IP for access control, rate limiting, or source-IP logging. Publicly available exploit code exists (VulDB and an upstream GitHub issue reference); there is no CISA KEV confirmation of active exploitation.
Improper access control in light0011 CMS allows unauthenticated remote attackers to bypass Captcha Validation enforced in App/Home/Controller/UserController.class.php, enabling limited unauthorized user-related actions. The project has not responded to the reported issue and no vendor-released patch has been identified, while publicly available exploit code exists; CISA KEV does not list this CVE. The assessed impact is limited integrity impact rather than confidentiality or availability compromise.
Missing authentication in the isAdmin() function of admin/admin.php in itsmeravitejak's Online Examination System (rolling-release, no fixed version boundary) lets remote unauthenticated attackers reach administrative logic over the network; publicly available exploit code exists. The assessed impact is low confidentiality only (C:L), with no integrity or availability effect, though CWE-306 on an admin check may expose broader administrative functionality that should be validated against the deployed source. The vendor has not responded to the early issue report, and no CISA KEV entry was provided.
Business logic errors in the light0011 CMS Vote Handler (App/Home/Controller/VoteController.class.php) let unauthenticated remote attackers craft HTTP requests with a manipulated, forged, or omitted X-Requested-With header to defeat the application's AJAX-request detection and drive the voting workflow into unintended states. Because the CVSS vector is PR:N/UI:N/AC:L, no credentials, no user interaction, and no non-default configuration are needed against a reachable deployment; impact is limited to low integrity and availability effects on vote handling (VC:N), with no confidentiality loss. Publicly available exploit code exists and the flaw is documented in the project's GitHub issue tracker (issue #16, VulDB 421676), but there is no confirmed active exploitation (not CISA KEV), and the vendor has not responded to the report or shipped a fix.
Unauthenticated file and directory existence disclosure in light0011 CMS (commits c774dce31c6df0055568a8d5c53d964d99be199d and f72cf46f601efb2a0618c3814cc2f61380b38930) allows remote attackers to probe the filesystem through the Uploadify check-exists.php endpoint by controlling the filename argument. Publicly available exploit code exists, and the vendor has not responded to the issue report; CISA KEV does not list this CVE. Despite a CVSS 4.0 score of 6.9, our assessment scores it 5.3 because the flaw only reveals existence metadata-no file contents, write access, or availability impact.
SQL injection in the AJAX endpoint of itsmeravitejak Online Examination System (exammanger.php, MySQLDB::topicslist) lets remote attackers manipulate the subject parameter to alter database queries. The project is rolling-release with no version pinning; code through commit e6208e630b14657999bbfe4c9912302d2a1e2449 is affected, and the CVSS vector marks exploitation as unauthenticated (PR:N) with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, but no CISA KEV entry was provided and EPSS was not supplied; the maintainer was notified via GitHub issue #7 and has not responded, so no vendor-released patch is identified.
SQL injection in the PHP-based Online Examination System (itsmeravitejak repository, rolling-release up to commit e6208e630b14657999bbfe4c9912302d2a1e2449) lets remote attackers manipulate the id, user, and topic arguments passed into the MySQLDB helper methods, which are concatenated into SQL statements without sanitization. According to the CVSS v4 vector the flaw is remotely reachable without privileges or user interaction, though in practice the affected results.php and reporting endpoints in this class of application typically sit behind a login, so authenticated access may be required - this is not confirmed in the available data. The issue was reported to the maintainer through a public GitHub issue and remains unanswered, and publicly available exploit code exists; EPSS and KEV data were not provided, so active exploitation is unconfirmed. Independent assessment rates the realistic risk medium-to-low: an unauthenticated SQL injection whose practical impact is bounded by low confidentiality, integrity, and availability weighting (VC:L/VI:L/VA:L).
SQL injection in itsmeravitejak's PHP-based Online-Examination-System lets remote, unauthenticated attackers inject arbitrary SQL through the query, qtype, sortname, and sortorder arguments processed by qsdb.php, usersdb.php, brandb.php, topicsdb.php, and subjectsdb.php. Because the project uses no versioning, there is no reliable way to determine which snapshots are affected; the repository's latest known commit e6208e630b14657999bbfe4c9912302d2a1e2449 is in scope, and the maintainer has not responded to the issue report. Publicly available exploit code exists (the CVE record's CVSS 4.0 vector carries E:P), but there is no KEV listing or other indication of active exploitation, and independent assessment rates the practical risk as low-to-moderate and opportunistic because deployments of this obscure, unmaintained application are rare and seldom internet-facing.
SQL injection in the kishan0725 Hospital Management System through commit 777fda46 lets authenticated attackers manipulate the ID parameter in admin-panel.php's Appointment Cancellation Handler and execute arbitrary SQL against the application database. Exploitation requires access to the administrative panel, and publicly available exploit code exists but no CISA KEV active-exploitation entry is associated. The vendor has not responded to the issue report, so no fixed release is available.
Broken access control in the Salon Booking System WordPress plugin before 10.31.11 lets authenticated users who hold the plugin's Salon Staff or Salon Worker role edit arbitrary accounts through the plugin's customers management screen, including demoting administrators to the 'customer' role and overwriting profile fields - resulting in loss of administrative access and possible site lockout. Publicly available exploit code exists, and the vendor has released a fix in version 10.31.11; because the attacker must already hold a staff/worker account, the realistic exposure is insider or compromised-staff-credential abuse rather than unauthenticated remote takeover. The flaw is rated medium severity (CVSS 5.5, CWE-863).
Otter Blocks for WordPress before 3.2.3 allows an open redirect through its Stripe Checkout flow because a user-supplied return URL is not validated as belonging to the site, so victims who complete or cancel checkout can be sent to an arbitrary external destination. Publicly available exploit code exists, but exploitation requires the target site to use the vulnerable Stripe Checkout feature and requires victim interaction during checkout, limiting practical impact to phishing-style redirection rather than server compromise.
Default cluster-admin credentials in Vanus 0.8.0 through 0.9.0 allow unauthenticated remote attackers to take full control of a cluster by presenting a hardcoded Bearer token to the gateway gRPC proxy port. Because the token is embedded in the product source at internal/primitive/constants.go, any deployment exposing that port is exploitable without authentication, user interaction, or non-default configuration, and attackers can manage namespaces, eventbuses, users, tokens, and role bindings and read or publish events. The vendor CVSS 4.0 score is 9.3; no public exploit identified at time of analysis and no CISA KEV entry is provided, though the hardcoded token is publicly visible in the source tree.
SQL injection in the Arraytics Booktics WordPress plugin, affecting sites running versions through 1.0.29, allows remote attackers to influence SQL queries and access or alter backend database data. The assessed CVSS vector indicates network reachability, no required privileges or user interaction, high confidentiality impact, low integrity impact, and no availability impact, although the advisory does not name the vulnerable endpoint or parameter and authentication requirements should be verified. No public exploit identified at time of analysis.
A use-after-free in the Linux kernel's RISC-V KVM guest-timer teardown path lets a guest that arms its vCPU timer via SBI TIME and then requests shutdown via SBI legacy shutdown or SRST race the hrtimer callback against VM destruction, so that kvm_destroy_vcpus() frees the vCPU while kvm_riscv_vcpu_hrtimer_expired() is still calling kvm_riscv_vcpu_set_interrupt() and writing to it. Only RISC-V hosts that emulate the vCPU timer with the non-Sstc hrtimer path, and VMMs that honour KVM_EXIT_SYSTEM_EVENT by destroying the VM, provide both sides of the race; hosts whose CPUs expose the Sstc extension and use the other timer path are not affected by this code. The supplied CVSS of 9.3 (AC:L, PR:N) is contradicted by our assessment of CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H: the race is timing-sensitive (the vulnerable ordering appeared in 12 of 200 trace-build runs and 0 of 1,500 stock-kernel stress runs without an injected delay) and requires the ability to run a guest, so EPSS is low at 0.17% (6th percentile) and no public exploit has been identified at time of analysis; CISA KEV does not list this CVE.
Unauthenticated attackers can write design-template data into the metadata of arbitrary posts on WordPress sites running the PickPlugins Product Designer for WooCommerce plugin through 1.0.40, because the plugin performs no capability check, inverts its nonce verification, and does not validate the target post ID. Publicly available exploit code exists and remote unauthenticated exploitation works against default installations with no token harvesting or user interaction, though impact is bounded to integrity of post metadata with no confidentiality or availability effect and no direct code execution. EPSS-style risk signals were not provided, and the issue is not reported as part of CISA KEV, so the practical exposure is a moderate-priority data-integrity problem requiring the plugin to be installed and active.
WhoDB 0.104.0 through 0.134.0 lets a remote attacker open a DuckDB file connection through the query editor without credentials and then misuse DuckDB's filesystem functions (read_text, read_blob, COPY ... TO, ATTACH) to read or overwrite arbitrary files on the host, including session.key and stored database credentials. The exposure is limited to server (non-local) deployments where the DuckDB plugin is reachable over the network, which is the attack-requirements precondition (AT:P) captured in the CVSS 4.0 vector, and the blast radius is bounded by the privileges of the WhoDB process. Vendor-released patch: 0.135.0; no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied in the available intelligence.
Linux kernel TCP retransmission handling can leak plaintext data on hosts that use device-offloaded encryption: an skb queued after a switch to PSP socket TX encryption or kTLS device offload may be collapsed into an earlier, not-yet-acknowledged skb, so bytes written after the switch are retransmitted in cleartext (C:H/I:N/A:H, CVSS 9.1 base, assessed vector AC:H because the merge only happens in specific offload configurations after a no-op fence is followed by a retransmit or SACK shift). On the kTLS device-offload path the merged skb straddles the TLS start marker, which the software fallback and the mlx5, nfp and funeth drivers cannot handle and drop, so every retransmit rebuilds the same skb and the connection stalls. Unauthenticated remote attackers are the relevant threat per the PR:N/AV:N vector, but no CISA KEV entry or public exploit code is associated with this CVE and EPSS is only 0.13% (2nd percentile), while the internal decision label is act_now - the signals conflict sharply and should be reconciled before prioritization, starting with whether the affected offload feature is enabled at all.
A broken access control flaw (CWE-862) in the WordPress plugin AI Engine before 3.7.9 lets users holding the Editor role or higher perform AI media management actions against posts they do not own and are not permitted to edit - modifying that content or changing its post type site-wide. Rated CVSS 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), the impact is integrity-only and gated behind a privileged account, so exposure is concentrated in multi-author, agency, or multisite installations that deliberately distrust Editor-level users; single-administrator sites see little practical risk. Publicly available exploit code exists (WPScan published a proof-of-concept entry), but CISA SSVC records no observed exploitation and the vendor has released a fixed version, 3.7.9.
AI Engine WordPress plugin before 3.7.9 allows authenticated users with the Editor role or higher to permanently delete arbitrary posts of any type by passing an object ID they do not own to a media action. The missing ownership/authorization check (CWE-862) lets such users remove navigation menus, block templates, global styles, and other content they cannot normally delete; publicly available exploit code exists. Exploitation requires an Editor+ account, which limits realistic exposure to insider or compromised-account scenarios and keeps this a moderate-priority issue rather than an anonymous internet-facing emergency.
Authenticated users with as little as Contributor access can create, rename, and permanently delete taxonomy terms across any Tasty Recipes Lite site running versions before 1.2.11, because the plugin fails to enforce capability checks on those term-management actions. This permits tampering with categories, tags, and navigation menus, although exploitation requires a valid low-privilege account and the assessed risk is moderate rather than high priority. Publicly available exploit code exists, and the vendor has released 1.2.11 as the fixed version.
PHP object injection in the WP Chill Strong Testimonials WordPress plugin, affecting all versions through 3.3.12, allows a low-privileged authenticated user to pass serialized data into an unsafe deserialization path and potentially instantiate arbitrary PHP objects. Because the CVSS 8.8 vector is PR:L, exploitation first requires a subscriber-level account, which is trivially obtainable on sites with open registration; user interaction is not needed (UI:N) and the attack is network-reachable with low complexity. Real-world impact beyond the injection itself - such as remote code execution or file manipulation - depends on whether a usable POP gadget chain exists in the site's installed themes and plugins, and no public exploit code or confirmed in-the-wild activity (CISA KEV) has been identified at the time of analysis.
A dentry reference leak in the Linux kernel's in-tree CIFS/SMB client (cifs.ko) is triggered when a process issues an O_CREAT open that the mounted server resolves to an existing non-regular inode, such as a symlink; cifs_atomic_open() calls finish_open() on that inode and attaches a cifsFileInfo, but symlink inodes carry no CIFS release operation, so the dentry reference held by cifsFileInfo is never dropped, and the wrongly set FMODE_OPENED flag also stops the VFS from following the symlink. Systems are affected only if they mount a share from an attacker-controlled or compromised SMB server and a local process then opens a crafted path (UI:R), and the assessed impact is limited to availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L); the disclosed score of 8.8 overstates confidentiality and integrity impact relative to that assessment. Patch data shows vendor fixes are available, and no public exploit was identified at time of analysis (EPSS 0.17%, percentile 6%, no CISA KEV listing).
Stack-based out-of-bounds read and write in libtta through 2.3 can corrupt decoder memory when an application processes a crafted .tta file whose header declares zero channels. The flaw is local and requires user interaction-the victim must open or decode the malicious file-so systems that never decode untrusted True Audio input are not exposed; impact is assessed as low confidentiality/integrity/availability, consistent with a crash or constrained stack corruption rather than demonstrated reliable code execution. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV) in the provided data, and the risk is moderate rather than urgent.
Missing authentication in Vanus 0.8.0 through 0.9.0 allows unauthenticated remote attackers to publish forged CloudEvents into any eventbus through the gateway's CloudEvents HTTP receiver. Attackers can target /namespaces/{ns}/eventbus/{name}/events or the legacy /gateway/{name} path, bypassing token authentication and authPublish checks, so injected events are stored and delivered to subscription sinks. No public exploit code was identified at time of analysis, and the impact is bounded to event-stream integrity rather than data disclosure or denial of service.
Privilege escalation in ProjectSend 2.0.0 through 2.6.x allows a holder of a restricted API token to reset its own owner's password and disable the owner's two-factor authentication, then log in interactively with the owner's full role permissions. The weakness is an incorrect authorization decision in the users API: a token scoped only to manage_users and edit_users can issue PATCH /api/v1/users/{user} against the token owner's account even though the web interface requires the current password for such self-service credential changes. Exploitation requires an already-provisioned, privileged-but-restricted API token (authenticated, PR:H); no public exploit code or confirmed active exploitation was identified at the time of analysis, and version 2.7.0 contains the fix.
SQL injection in the WordPress plugin Support Genix (support-genix-lite) through version 1.4.54 allows an authenticated low-privilege user to inject SQL through plugin input and read sensitive database contents, with limited integrity impact. Exploitation requires the plugin to be installed and active and the attacker to hold valid low-privilege credentials; unauthenticated exploitation is not indicated by the assessed vector. No public exploit code or CISA KEV entry was provided at time of analysis.
Arbitrary Perl code execution in JQ::Lite before 2.51 allows an attacker who controls any portion of a query's regular expression to run code inside the calling process. The module's internal _build_regex helper interpolates the supplied pattern into a qr'...' literal and compiles it as source text via string eval, so a (?{ ... }) code block embedded in the pattern executes in place even though the caller never enabled `use re 'eval'`; the escaping applied to single quotes does nothing to stop a code block. Perl applications that pass untrusted input into test(), match(), or the match and =~ conditions of select() are exposed, and the independently assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) treats the flaw as remotely reachable without authentication with high confidentiality, integrity and availability impact on the hosting process. Exploitation is not confirmed in the wild, EPSS is only 0.17% (6th percentile), and no public exploit code has been identified at time of analysis, but the flaw is a clean, documented code-injection primitive with a published upstream fix.
Unauthenticated attackers can abuse the model-registration endpoint in Xinference through 4.0.1 on Windows to write or delete arbitrary .json files by supplying a model_name containing backslash traversal sequences such as ..\..\evil. Successful exploitation targets files writable by the Xinference process, so configuration or data corruption is possible while confidentiality is not directly impacted. The vendor has published an upstream fix commit, and no public exploit code was identified at time of analysis.
TLS certificate verification in the OpenTelemetry Python OTLP/HTTP exporter is silently disabled when the OTEL_EXPORTER_OTLP_CERTIFICATE environment variable is set to an empty string, allowing an unauthenticated on-path attacker to impersonate the OTLP collector and read or tamper with exported traces, metrics and logs - including the authentication headers configured via OTEL_EXPORTER_OTLP_HEADERS. Only deployments running opentelemetry-exporter-otlp-proto-http 1.5.0 through 1.44.x that export over TLS to a remote collector and carry this specific misconfiguration (empty string rather than unset or a valid CA bundle path) are exposed, and exploitation additionally requires the attacker to occupy a man-in-the-middle position on the export path. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a genuine but conditional risk rather than an emergency: the vendor has released a fix in 1.45.0.
Modern Events Calendar Lite before 7.37.0 exposes the personal and payment details of every event booking to any authenticated user, including Subscribers, because its booking-data endpoint lacks capability, nonce, and ownership checks. Publicly available exploit code exists, but exploitation requires a valid low-privilege account, making sites with open registration the most likely targets. The result is a read-only confidentiality breach of names, email addresses, transaction IDs, and payment amounts, assessed as a moderate-priority information disclosure rather than a critical compromise.
Salon Booking System WordPress plugin before 10.31.11 exposes all configured discount coupons-including those hidden from customers-through an insufficiently restricted REST API endpoint reachable by any authenticated user such as a subscriber. The missing authorization check (CWE-284) lets a low-privilege account enumerate coupon codes, amounts, validity dates, and usage limits; publicly available exploit code exists, while the CVSS 4.3 score and PR:L vector reflect limited confidentiality impact. Sites that allow self-registration are the most exposed, though no administrator access, user interaction, or special configuration is required once an account exists.
Linux kernel arm64 KVM running in protected mode (pKVM) fails to remove each CPU's hypervisor stack pages from the host stage-2 mapping, leaving hypervisor-private memory reachable by the host. The flaw sits in the fix_host_ownership() path, which only walks the linear-map alias of memblock regions and therefore misses stacks that are mapped solely in the private VA range for their guard page. Only arm64 systems with pKVM enabled are affected, and the attacker must already hold high privilege in the host kernel (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 8.2), so this is a local isolation-bypass primitive rather than a network-reachable flaw; no public exploit has been identified at time of analysis, it is not in CISA KEV, and EPSS is 0.20% (9th percentile).
Privilege escalation in the Login with phone number WordPress plugin (through version 1.8.77) allows unauthenticated remote attackers to potentially obtain elevated privileges, with high attack complexity reflecting conditions such as timing or a specific registration/login state that the attacker does not fully control. The issue is CWE-266 incorrect privilege assignment and carries a CVSS 8.1 score with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and no CISA KEV status was provided; defenders should prioritize patching internet-facing WordPress sites running this plugin.
Out-of-bounds read and write in the Linux kernel IPv6 header parser: ipv6_find_hdr() walks the extension-header chain and skips each header by the length that header declares (ipv6_optlen() returns up to 2048) without ever checking that skip against skb->len, so the offset it stores can land past the end of the packet. When openvswitch installs that offset as the transport header, update_ipv6_checksum()/inet_proto_csum_replace16() then reads and writes the transport checksum field outside the packet buffer, which the upstream report demonstrates as a KASAN slab-use-after-free in the skbuff_small_head cache on kernels up to the 7.3-rc series and the 5.10/5.15/6.1/6.6/6.12/6.18 stable branches. Exploitation requires the openvswitch kernel datapath configured with IPv6 modify actions (e.g. set_ipv6_addr) and an attacker-supplied IPv6 packet whose extension-header chain declares a length extending beyond the actual buffer; the demonstrated path runs through the OVS packet-execute netlink interface, which normally requires CAP_NET_ADMIN, so the assessed vector is local with high attack complexity even though the CNA scored it AV:N/PR:N. No public exploit is identified at time of analysis and the CVE is not in CISA KEV; EPSS is low at 0.22% (12th percentile).