OttoKit (SureTriggers) WordPress plugin through 1.1.40 contains an incorrect privilege assignment flaw that can allow remote attackers to escalate privileges, and the vendor CVSS vector scores it 9.8 with network reachability, low attack complexity, no privileges required, and no user interaction. Successful exploitation could lead to full WordPress site compromise given the high confidentiality, integrity, and availability impact, though the provided data does not clarify whether a specific integration or API must be enabled or whether a pre-existing low-privileged account is required despite the PR:N rating; no public exploit identified at time of analysis.
PHP object injection in the Conversational Forms for ChatBot WordPress plugin through 1.5.1 allows unauthenticated remote attackers to pass attacker-controlled serialized data into PHP unserialize(), with the potential for full confidentiality, integrity, and availability impact only if a usable POP gadget chain exists in the plugin, WordPress core, or another installed component. The independent assessment scores this as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H because the high-complexity prerequisite is a viable gadget chain, and the provided data contains no public exploit or CISA KEV confirmation.
A use-after-free in the Linux kernel's SCTP receive path lets a remote attacker who acts as an SCTP peer crash or potentially corrupt kernel memory by sending a bundled [ERROR(Stale Cookie)][DATA] packet from a non-primary address of a multi-homed association, after which a FWD-TSN chunk or the delayed SACK timer dereferences a transport that has already been RCU-freed; both a remote peer and a local unprivileged user acting as one can trigger it, and no authentication, capabilities or user interaction are required (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, score 9.8). Exposure is constrained in practice because SCTP is not enabled or used by default on most Linux deployments, and the association must be multi-homed so that a non-primary transport exists to be removed. No public exploit was identified at time of analysis and there is no CISA KEV entry, while EPSS is low at 0.21% (11th percentile); the priority signal is nonetheless act_now, and vendor patches are available for the affected stable branches.
Use-after-free in the Linux kernel's Open vSwitch conntrack helper path lets traffic traversing an OVS datapath corrupt or free conntrack extension memory, with high confidentiality, integrity and availability impact, but only on hosts that combine the conntrack action with a connection-tracking helper such as FTP or SIP - not a default configuration. The trigger is a race: an unconfirmed connection must have its extension area reallocated after a helper has stored a raw pointer in the master expectations list, which is why the assessed vector is AC:H despite AV:N/PR:N, and reachability still depends on the attacker being able to send traffic through the affected OVS conntrack path. Vendor patches exist in 6.12.112, 6.18.55, 7.2.9 and 7.3-rc5; EPSS is 0.20% (9th percentile) and no public exploit has been identified at time of analysis, although the vuln.today decision label is act_now.
Default cluster-admin credentials in Vanus 0.8.0 through 0.9.0 allow unauthenticated remote attackers to take full control of a cluster by presenting a hardcoded Bearer token to the gateway gRPC proxy port. Because the token is embedded in the product source at internal/primitive/constants.go, any deployment exposing that port is exploitable without authentication, user interaction, or non-default configuration, and attackers can manage namespaces, eventbuses, users, tokens, and role bindings and read or publish events. The vendor CVSS 4.0 score is 9.3; no public exploit identified at time of analysis and no CISA KEV entry is provided, though the hardcoded token is publicly visible in the source tree.
SQL injection in the Arraytics Booktics WordPress plugin, affecting sites running versions through 1.0.29, allows remote attackers to influence SQL queries and access or alter backend database data. The assessed CVSS vector indicates network reachability, no required privileges or user interaction, high confidentiality impact, low integrity impact, and no availability impact, although the advisory does not name the vulnerable endpoint or parameter and authentication requirements should be verified. No public exploit identified at time of analysis.
A use-after-free in the Linux kernel's RISC-V KVM guest-timer teardown path lets a guest that arms its vCPU timer via SBI TIME and then requests shutdown via SBI legacy shutdown or SRST race the hrtimer callback against VM destruction, so that kvm_destroy_vcpus() frees the vCPU while kvm_riscv_vcpu_hrtimer_expired() is still calling kvm_riscv_vcpu_set_interrupt() and writing to it. Only RISC-V hosts that emulate the vCPU timer with the non-Sstc hrtimer path, and VMMs that honour KVM_EXIT_SYSTEM_EVENT by destroying the VM, provide both sides of the race; hosts whose CPUs expose the Sstc extension and use the other timer path are not affected by this code. The supplied CVSS of 9.3 (AC:L, PR:N) is contradicted by our assessment of CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H: the race is timing-sensitive (the vulnerable ordering appeared in 12 of 200 trace-build runs and 0 of 1,500 stock-kernel stress runs without an injected delay) and requires the ability to run a guest, so EPSS is low at 0.17% (6th percentile) and no public exploit has been identified at time of analysis; CISA KEV does not list this CVE.
WhoDB 0.104.0 through 0.134.0 lets a remote attacker open a DuckDB file connection through the query editor without credentials and then misuse DuckDB's filesystem functions (read_text, read_blob, COPY ... TO, ATTACH) to read or overwrite arbitrary files on the host, including session.key and stored database credentials. The exposure is limited to server (non-local) deployments where the DuckDB plugin is reachable over the network, which is the attack-requirements precondition (AT:P) captured in the CVSS 4.0 vector, and the blast radius is bounded by the privileges of the WhoDB process. Vendor-released patch: 0.135.0; no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied in the available intelligence.
Linux kernel TCP retransmission handling can leak plaintext data on hosts that use device-offloaded encryption: an skb queued after a switch to PSP socket TX encryption or kTLS device offload may be collapsed into an earlier, not-yet-acknowledged skb, so bytes written after the switch are retransmitted in cleartext (C:H/I:N/A:H, CVSS 9.1 base, assessed vector AC:H because the merge only happens in specific offload configurations after a no-op fence is followed by a retransmit or SACK shift). On the kTLS device-offload path the merged skb straddles the TLS start marker, which the software fallback and the mlx5, nfp and funeth drivers cannot handle and drop, so every retransmit rebuilds the same skb and the connection stalls. Unauthenticated remote attackers are the relevant threat per the PR:N/AV:N vector, but no CISA KEV entry or public exploit code is associated with this CVE and EPSS is only 0.13% (2nd percentile), while the internal decision label is act_now - the signals conflict sharply and should be reconciled before prioritization, starting with whether the affected offload feature is enabled at all.