Privilege escalation through SQL injection in on-premises Arista VeloCloud Orchestrator lets any valid VCO account cross into operator-level access and impersonate the built-in superuser operator, reaching internal-only functions and potentially compromising the orchestrator host and managed data. The vendor rates the issue CVSS 9.4; hosted and Dedicated VCO deployments were affected and are reported already patched, so on-prem VCO is the remediation focus, and the supplied priority label is act_now. No public exploit identified at time of analysis, and no CISA KEV status is supplied in the provided intelligence.
Remote code execution in GitLab CE/EE can be triggered by a specially crafted regular expression processed through a vulnerable compilation path, potentially allowing an unauthenticated network attacker to run arbitrary code on the GitLab server. The flaw is an integer overflow (CWE-190) affecting a broad version range from 7.0 through 19.5.1; exploitation is conditional on reaching the relevant regex-compilation functionality, and our assessment rates attack complexity as high despite the advisory CVSS of 10.0. Publicly available exploit code exists, but no CISA KEV designation is indicated in the provided data.
Unauthenticated SQL injection in Weaver E-cology 8.0, 9.0, and 10.0 before 10.76 allows remote attackers to inject SQL through the doc_datefrom and doc_dateto fields of the /api/doc/out/more/list endpoint when srcType=2 and elementmore is used, then read query results through /api/ec/dev/table/counts to extract database information. The assessed vector requires only network reachability, with no privileges or user interaction, and instances upgraded to 10.76 or later are not affected. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19, and a public PoC reference exists; it is not verified as working exploit code.
CPU exhaustion in libexpat through 2.9.0 lets remote attackers stall XML parsing workloads by supplying a moderately sized document with a large DTD and nested entity definitions, because the billion-laughs amplification check in accountingDiffTolerated() aborts too late and each parse can burn tens of seconds of CPU. Unauthenticated remote attackers (CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N) can trigger it wherever an application passes untrusted XML to libexpat with DTD processing and internal general/parameter entity expansion enabled; impact is limited to availability, with no disclosure or modification. No confirmed active exploitation is known, though a public PoC reference exists; it is not verified as working exploit code, and vendor patch material is available upstream (PR #1433).
Out-of-bounds write in CFITSIO through 4.7.0 lets a crafted FITS file overflow both a fixed 28,800-byte stack buffer (cbuff) and the caller's string array when an application reads a variable-length string column, opening the door to arbitrary code execution in the victim process. The vulnerable path is ffgcls2() in getcols.c, which trusts heap-descriptor length values taken from the file instead of validating them against the destination buffer size. Exploitation is local in vector terms (CVSS:4.0/AV:L, CVSS:3.1/AV:L/AC:L/PR:N/UI:R) and requires the target application to actually parse a variable-length string column ('1PA'-style TFORM) from the file; no privileges are needed beyond inducing the victim to open the FITS file. A public PoC reference (a gist cited in the CVE record) exists but is not verified as working exploit code, EPSS/KEV data is absent, and the vendor has published an upstream fix in PR #184 (commit 579792e0f85bff0c6733ad5ebdf54c3b5c188686), which the vuln.today decision logic labels this_week.
Denial of service in the Python GraphQL-core library (3.0.0 through 3.2.11, plus 3.3.0 pre-releases before 3.3.0rc1) lets an unauthenticated remote attacker pin a worker process for minutes with a single shallow, highly compressible query. The OverlappingFieldsCanBeMerged rule, which ships in specified_rules and is therefore enabled by default on every GraphQL-core server, re-compares flattened inline fragments at every nesting level and can be driven into quadratic - worst case O(n²·m²) - CPU work during validation, before any resolver, depth limiter or complexity analyzer runs; the vendor advisory documents a 364 KB query consuming one core for over 300 seconds on 3.2.8. Severity is availability-only (no confidentiality or integrity impact) and the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5; the advisory includes a proof-of-concept query generator with measured timings, which is a public PoC reference rather than independently verified working exploit code, and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis. Fixed versions 3.2.12 and 3.3.0rc1 enforce a 250,000-comparison budget.
Stored cross-site scripting in the WebP Express WordPress plugin before 0.25.16 lets unauthenticated visitors submit values that the plugin's bundled HTML parser later re-emits into element attributes without escaping, so the payload breaks out of the attribute context and executes in the browser of anyone who loads the affected page, including administrators. The vulnerable code path is only reached when a non-default image delivery mode is enabled; default installations do not exercise it, and the stored payload only fires when a victim views the page, which is why the assessed vector carries UI:R and AC:H despite PR:N. A public PoC reference exists in the WPScan entry but is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation; vendor patch 0.25.16 is available and the issue is prioritized as this_week rather than emergency-level.
Royal MCP, a WordPress plugin, issues preview-link tokens that are not bound to the single preview they were created for; in versions before 1.5.7 any party holding a valid token is authenticated as the token's owning user - an administrator in a default install - across the entire REST API without a nonce check, enabling full site takeover. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that the hard part is obtaining such a token, and the available sources do not describe how a token is acquired or how long it stays valid, so practical acquisition difficulty is unverified. A public PoC reference exists (the WPScan entry) but it is not verified as working exploit code, and no CISA KEV listing or EPSS scoring is present in the supplied data.
An OS command injection flaw (CWE-78) in the network management service of affected Kiloview E3 NDI encoder firmware lets a user who holds the static-route configuration permission inject arbitrary operating system commands that execute as root. Exploitation requires an authenticated web management account with route-configuration rights (CVSS PR:H), and the injected route configuration persists across reboots, so a successful attacker gains durable root-level control of the device, with potential exposure of stored credentials and cryptographic material. The vendor directs users to its latest E3 firmware download and CISA has published advisory ICSA-26-295-01; no public exploit code or confirmed active exploitation is identified in the available sources, though the vuln.today decision label is act_now.
Authenticated command injection in Kiloview E3 NDI encoder firmware allows a web user who can configure network settings to execute arbitrary operating system commands as root via the link maintenance address configuration endpoint. Affected firmware is listed as versions from 0 to below 1.30; no public exploit was identified at time of analysis, and a vendor firmware update is available.
Authenticated command injection in Kiloview E3 NDI encoder firmware before 1.30 allows a low-privileged web user to execute arbitrary OS commands as root through the device naming endpoint, resulting in full device compromise. The vendor has released firmware 1.30 and CISA published ICS advisory ICSA-26-295-01; no public exploit was identified at time of analysis. The flaw is rated high priority (act_now) and requires only valid low-privileged credentials plus network access to the web interface.
InterSystems IRIS for Health ships with TLS/SSL encryption turned off by default, so traffic between clients and the superserver can traverse the network in cleartext and be read by anyone positioned on that path. Unauthenticated remote attackers who can observe or intercept the traffic (an on-path requirement reflected by AT:P in the CVSS 4.0 vector) may capture transmitted data, including credentials that can subsequently be reused to log into the device. No public exploit code has been identified at time of analysis, but exploitation is constrained by the interception prerequisite and is neutralized where operators have enabled TLS per the InterSystems securing checklist; the flaw was reported by ICS-CERT in advisory ICSMA-26-295-01 and carries an act_now priority label.
Privilege escalation in the HIPAA Forms WordPress plugin (versions before 3.3.2) lets an account that already holds the plugin's own custom user role push that role up to administrator-level capabilities. The plugin handles a request that rebuilds its custom role without any capability check, so a role holder can rewrite their own permissions; per the assessed vector the attacker must be authenticated and must already possess that specific custom role (PR:H), making this an insider or role-holder escalation path rather than unauthenticated remote takeover, and no victim interaction is required. A public PoC reference exists but is not verified as working exploit code, there is no CISA KEV listing, and a vendor fix is available in 3.3.2.
Stored cross-site scripting in the PixelYourSite WordPress plugin before 11.4.3 and PixelYourSite Pro before 12.6.8 lets unauthenticated remote attackers plant script in a page that is then served to other visitors. The plugin prints an attacker-supplied cookie value into page output without sanitising or escaping it, so on a site running a full-page cache the payload is persisted in the cached copy rather than only reflected back to the sender. Scored CVSS 3.1 at 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) with a scope change because the script executes in other users' browsers; a vendor patch is released (11.4.3 / 12.6.8), a public PoC reference exists but is not verified as working exploit code, and no confirmed active exploitation or KEV listing was reported.
Heap out-of-bounds reads and writes affect libsmb2 before release 6.3 through integer overflow in the DCE/RPC NDR decoder in lib/dcerpc.c. A malicious SMB server, or a machine-in-the-middle on an unsigned connection, can return crafted NetrShareEnum replies whose wrapping actual_count or max_count values cause undersized heap allocations and subsequent memory corruption when a client application calls smb2_share_enum_async(); the attacker needs no credentials but must control the server side or the network path, and the client must initiate the share enumeration on an unsigned connection. A public write-up describing the count overflow exists and is tagged as an exploit reference, but it is not verified as working exploit code, and no public exploit is otherwise identified; the vendor has released libsmb2 6.3 as the only complete fix, and the issue is prioritized for remediation this week per vuln.today.
A maximum-severity, network-reachable flaw (CVSS 3.1 base 10.0) in an as-yet-unnamed HPE product allows remote attackers to achieve high confidentiality, integrity and availability impact across a scope boundary without authentication or user interaction. The affected product line, feature, protocol and version range are not stated in the available data; the only authoritative source is HPE security bulletin hpesbnw05162en_us, which must be consulted to identify the exact product and fixed build. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the vulnerability is tagged 'Information Disclosure' while the assessed vector also scores high integrity and availability impact, so the true impact profile should be confirmed from the vendor bulletin. Vuln.today priority is act_now based on the assessed vector.
Unauthenticated network attackers can potentially achieve high confidentiality, integrity, and availability impact against an HPE networking product, based on the supplied CVSS 3.1 vector scoring 10.0 with scope change. The CVE has no description and no published affected version range; the HPE Security Bulletin hpesbnw05162en_us is the only reference, and the exact product feature, deployment mode, and trigger remain unverified. No public exploit is identified at time of analysis.
HPE security bulletin hpesbnw05162en_us documents a maximum-severity (CVSS 10.0) exposure in an HPE product that is not named in the available data, so the specific affected platform and version range remain unresolved. The assessed vector describes unauthenticated, network-reachable exploitation at low complexity with no user interaction and a changed scope, meaning impact is judged capable of reaching beyond the vulnerable component to give high confidentiality, integrity and availability loss. A single source tag labels the issue as information disclosure, which does not fully reconcile with the High integrity and availability ratings in the vector; no CVE description, CWE, CPE data, KEV entry or public exploit reference was supplied, so active exploitation is not confirmed and no public exploit was identified at time of analysis. The vuln.today priority decision is act_now, driven by the maximum severity score rather than by corroborated in-the-wild activity.
HPE advisory hpesbnw05162en_us covers a product flaw carrying a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), meaning remote, unauthenticated access with no user interaction and full confidentiality, integrity, and availability impact across a scope change. The affected product, versions, and trigger are not stated in the supplied data and must be confirmed from the bulletin; no CISA KEV entry was supplied and no public exploit was identified at time of analysis, though the vuln.today decision label is act_now.
Unauthenticated remote attack against an HPE networking product carries the vendor's maximum CVSS 3.1 base score of 10.0, reflecting network reachability with low complexity, no privileges and no user interaction, a scope change, and high confidentiality, integrity and availability impact. The HPE bulletin referenced as hpesbnw05162en_us is the only source supplied: no description, CWE, CPE, version range or fixed-version information was provided, so the specific affected product line, exposed interface and trigger remain unconfirmed. No public exploit code was identified at time of analysis, and CISA KEV status is not indicated, but the single-source nature of this record means the product and version scope must be confirmed directly against the advisory before exposure can be judged.
HPE's security bulletin hpesbnw05162en_us covers a maximum-severity flaw (CVSS 3.1 base score 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) in an HPE networking product that remote, unauthenticated attackers can reach with no user interaction and low attack complexity; the scope-change metric means the impact can cross the vulnerable component's security boundary, with high confidentiality and integrity loss and no availability impact scored. The exact product, version range and exposed feature are absent from the available intelligence - no CPE, no CWE and no description were supplied - so the affected deployment must be identified from the HPE advisory itself. No public exploit identified at time of analysis: there is no CISA KEV entry and no PoC or exploit reference in the supplied data, while the vuln.today priority decision is act_now and the report originates from HPE's own security-alert mailbox.
Information disclosure in an unspecified HPE Networking product is tracked as CVE-2026-79844, but the supplied record contains no CVE description, CWE, CPE, or affected-version data, so the exact component at risk is unconfirmed. The independent assessment rates the issue as network-reachable, low-complexity, unauthenticated, and no-interaction, with high confidentiality impact and no integrity or availability impact; the source's 10.0 score is broader and is not adopted by that assessment. vuln.today assigns an act_now priority, while no CISA KEV status is present and no public exploit identified at time of analysis.
HPE networking products are affected by a high-severity issue (CVSS 9.8) tracked as CVE-2026-79857, with a remote, unauthenticated vector (AV:N/AC:L/PR:N/UI:N) and high confidentiality, integrity, and availability impact. The CVE record contains no description, CWE, CPE, or version data, and the supplied tag labels it as information disclosure; the exact feature and affected configurations are not described in the available sources. No KEV designation or public exploit code is present in the supplied intelligence, so no public exploit was identified at time of analysis, but the vuln.today decision label is act_now and the HPE advisory hpesbnw05162en_us is the authoritative source for scope and fixes.
HPE networking equipment is affected by a CVE with no published description, but its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes unauthenticated network-reachable access with high confidentiality, integrity, and availability impact. The supplied tag says Information Disclosure, while the vector indicates broader impact; the affected feature, protocol, and exact models are not identified in the available data. No public exploit was identified at time of analysis; HPE bulletin hpesbnw05162en_us is the only remediation reference, and the vuln.today decision is act_now.
Stored cross-site scripting in the Link Library WordPress plugin before 7.9.6 allows users with Contributor-level access or higher to place script content in a link field that is later rendered inside a link-preview attribute. The preview is generated without authentication and without a published-status check, so an unapproved submission can reach any visitor who opens the preview, although the victim must interact with the crafted content. The independent assessment rates it medium severity (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) and assigns a this_month priority, so scheduled rather than emergency remediation is appropriate; the vendor fixed it in 7.9.6, no CISA KEV active-exploitation confirmation was provided, and a public PoC reference exists but is not verified as working exploit code.
Stored cross-site scripting in the Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 allows authenticated users with author-level access or higher to save collection and gallery names containing script, which is stored unsanitised and rendered unescaped in the administrative dashboard. The injected code only executes when a privileged user, typically an administrator, later views that dashboard, so successful abuse requires a site that grants author-or-higher accounts to untrusted parties; single-admin installations face little practical exposure. A public PoC reference exists but is not verified as working exploit code, there is no confirmed active exploitation, and the vendor patch is available in 6.5.8.
Kiloview E3 NDI encoder firmware before version 1.30 signs session JSON Web Tokens with a single HMAC-SHA256 secret that is hardcoded in the firmware image and shared across every deployed device. Because the firmware is publicly downloadable from the vendor, anyone can extract that secret and forge valid session tokens, including administrative ones, then reach privileged device functions over the network without any credentials and without user interaction. The flaw is remotely exploitable and high impact for confidentiality, integrity and availability in our assessment; no public exploit code or confirmed active exploitation was identified at time of analysis, though the underlying technique requires only offline extraction of a static string plus network reachability to the authentication endpoint. Kiloview has released fixed firmware 1.30, and the vendor advisory (ICSA-26-295-01) is available.
Remote, unauthenticated attackers can change the hostname, DNS servers, and NTP time source on Kiloview E3 NDI encoder firmware before 1.30 through the ONVIF device service, even when authentication is enabled for that service (CVSS 8.7). The flaw is an authentication bypass for configuration write operations (CWE-306) with high integrity impact but no direct confidentiality or availability impact; exploitation requires network reachability to the ONVIF service. No public exploit identified at time of analysis, and the vendor provides a firmware update.
Session tokens issued by the Kiloview E3 web management interface on login are given an expiration far beyond any reasonable session lifetime, so a token obtained through interception or device compromise keeps granting authenticated access long after it should have lapsed. The issue is tracked as CWE-613 (insufficient session expiration) against Kiloview E3 firmware and carries a CVSS 8.3 base score; the CVSS vector includes PR:N, although practical exploitation first requires the attacker to capture a valid token, which is why the assessed attack complexity is High. No public exploit code has been identified at time of analysis, and the authoritative reporting is CISA ICS advisory ICSA-26-295-01, filed by ICS-CERT and prioritized as 'this week' rather than emergency action.
Privilege escalation in Microsoft VM Inspector for Azure Virtual Machines allows unauthenticated, network-reachable attackers with no user interaction to gain elevated privileges, and the vendor scores it CVSS 10.0 with a scope change (S:C) indicating impact extends beyond the initially vulnerable component. The root cause is a link-following defect (CWE-59): the component resolves a link before accessing a file, so an attacker who can influence a symbolic link or junction can redirect privileged file operations. Microsoft has published a fix through its MSRC update guide and the vuln.today priority is act_now; no public exploit code or CISA KEV entry was identified at time of analysis.
Privilege elevation in Azure Kubernetes Configuration Service is possible for unauthenticated network attackers because a critical function lacks authentication, and the CVSS 3.1 base score is 10.0. Because the service is Microsoft-managed, real-world exposure depends on network reachability to the vulnerable endpoint and on whether Microsoft has already completed server-side remediation; no customer-side non-default configuration is stated as required. Vendor patch information is available and the vuln.today priority label is act_now; no public exploit identified at time of analysis.
Improper authentication in Microsoft Entra Application Proxy (formerly AAD App Proxy) allows an unauthenticated, remote attacker to elevate privileges across a trust boundary, with the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) scoring 10.0 - no privileges, no user interaction and low complexity, with high confidentiality and integrity impact and a scope change. Exposure is deployment-specific: the target organization must actually run Application Proxy to publish internal applications for remote access, and the proxy endpoint must be reachable by the attacker; organizations not using the service are not exposed to this flaw. Microsoft is the reporting party and a vendor patch is available per the MSRC update guide, and the vuln.today decision label is act_now; no public exploit code or confirmed active exploitation was identified in the supplied data, although the trigger conditions themselves are not described in the available sources.
Unauthenticated remote code execution in YOOtheme Pro 5.0.0 through 5.0.52 allows a remote attacker to reuse a request signature disclosed in a legitimate public image URL, inject image operations, traverse out of the cache directory, and write an attacker-controlled PNG/PHP polyglot into a public media directory. Joomla sites running the affected extension with the image-transformation handler reachable are at risk, and code execution depends on the media directory being PHP-executable; no account or user interaction is required. No public exploit is identified in the supplied intelligence at time of analysis, but the priority decision is act_now.
Privilege escalation to proxy administrator with follow-on arbitrary command execution affects the LiteLLM proxy server (AI Gateway) from 1.87.0 up to the fixed releases 1.100.4, 1.101.3, 1.102.2, 1.103.1 and 1.104.0-rc.2. An authenticated account holding internal_user privileges can submit crafted metadata through the API-key creation flow so the proxy encrypts and returns a forged administrator credential, then replay that ciphertext as a bearer token to be trusted as a proxy admin and run commands via the MCP stdio endpoint. Versions after 1.91.0 are vulnerable in the default configuration, while 1.87.0 through 1.90.x are only exposed when EXPERIMENTAL_UI_LOGIN=true is explicitly set; CVSS 3.1 scores this 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), the priority label is act_now, and no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated, network-reachable compromise of an HPE networking product is described by HPE security bulletin hpesbnw05162en_us, which is scored CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - meaning an attacker who can reach the affected interface needs no credentials and no user interaction, and the impact spans confidentiality, integrity and availability. The supplied record contains no CVE description, no CWE and no CPE, so the specific product line, deployment mode and version range cannot be named from the available data; the vendor bulletin must be consulted to determine exactly which devices and firmware are in scope. Only a single reference (the HPE advisory) is available, no EPSS score or CISA KEV listing was supplied, and no public exploit has been identified at time of analysis, although the vendor-priority signal for this record is act_now. Note the record-level tag 'Information Disclosure' is narrower than the assessed vector, which rates integrity and availability impact as high as confidentiality.
Unauthenticated remote compromise of HPE networking products is described by a maximum-severity CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), a profile that implies full loss of confidentiality, integrity and availability from a network-reachable position with no privileges and no user interaction. The only substantive source is the HPE Security Bulletin hpesbnw05162en_us; the CVE record itself carries no description, no CWE mapping and no CPE data, so the vulnerable service, required configuration and affected version range cannot be confirmed from the supplied material. No CISA KEV entry and no public exploit code were identified at time of analysis, although the item is triaged act_now; the supplier-supplied tag reads 'Information Disclosure', which may point to a narrower real-world impact than the full-CIA vector suggests, and that discrepancy is unverified.
Unauthenticated, network-reachable exploitation of an HPE networking product carries a CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning an attacker with only network access could achieve high confidentiality, integrity and availability impact without credentials or user interaction. The only source in the supplied intelligence is the HPE security bulletin hpesbnw05162en_us; no CVE description, CWE, CPE, affected version list or fixed-version information was provided, so the specific vulnerable component and the trigger conditions are not described in the available sources. The vuln.today decision label is act_now, and no KEV listing or public exploit code was identified at time of analysis, though the bulletin itself could not be retrieved to confirm either signal. The supplied tag reads 'Information Disclosure', which is narrower than the assessed high impact on all three security pillars and should not be relied on as a description of scope.
HPE products covered by Security Bulletin hpesbnw05162 carry a critical-severity (CVSS 9.8) flaw reachable over the network, and vulnerability intelligence flags it as an act-now item, yet the affected component, configuration, and version range cannot be named from the supplied data. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U vector with C:H/I:H/A:H means exploitation would require only network reachability to the affected service, with no authentication and no user interaction, against whatever deployment is ultimately confirmed applicable. The record is tagged Information Disclosure, which sits awkwardly against a vector scoring full integrity and availability impact, so the actual impact class should be confirmed from the bulletin before it is relied upon. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so no confirmed active exploitation exists; the trigger itself is not described in the available sources.
A critical-severity flaw (CVSS 9.8) affects an unspecified HPE product per an HPE security advisory (hpesbnw05162en_us), allowing network-reachable, low-complexity attacks that require no authentication or user interaction and can fully compromise confidentiality, integrity, and availability. The available intelligence contains no CVE description, no CWE classification, and no product or version detail, so the precise vulnerable component and trigger cannot be confirmed; the single NVD reference resolves to the HPE support advisory, which must be consulted for the authoritative affected-product list. No public exploit or active-exploitation reporting is included in the supplied data, but the internal decision label is act_now, so treat remediation as immediate and verify exposure against the vendor advisory before assuming any deployment is unaffected.
Remote, unauthenticated exploitation of an HPE networking service carries a vendor-scored CVSS 9.8 critical impact: low-complexity network access with no user interaction can affect confidentiality, integrity and availability at high severity. The supplied intelligence provides no CVE description, CWE, CPE or version range, so the exact product feature, configuration and trigger remain unconfirmed and must be established from HPE bulletin hpesbnw05162en_us. An 'Information Disclosure' tag is the only mechanism clue; no CISA KEV status is included and no public exploit identified at time of analysis, while the vuln.today decision is act_now.
HPE networking equipment carries a maximum-severity CVSS 9.8 rating under a CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector, meaning a network-reachable attacker without credentials or user interaction could fully compromise confidentiality, integrity and availability. The CVE record itself ships with no description, no CWE and no CPE data, and the only reference is an HPE support document (hpesbnw05162en_us), so the specific product line, firmware branch, exposed protocol and version range cannot be confirmed from the available sources. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, yet the vuln.today priority label is act_now - urgency signals therefore conflict with the absence of confirmed exploitation activity, and the HPE advisory should be treated as the authoritative source before scoping exposure.
Remote, unauthenticated attackers can achieve full confidentiality, integrity, and availability impact against an affected HPE networking product, per a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The specific vulnerable component, protocol, and affected version range are not described in the available sources; HPE published only a support bulletin (hpesbnw05162en_us) and no CVE description or CWE mapping was supplied, and the record carries an Information Disclosure tag that is difficult to reconcile with the full impact triad. No CISA KEV listing, no public exploit code, and no EPSS score were provided, but the vuln.today priority decision is act_now, so treat exposure as urgent pending confirmation from the HPE bulletin.
Authentication bypass by spoofing in Brainstorm Force's SureCart WordPress plugin affects versions through 4.9.5 and, per the CVSS vector, is reachable over the network without authentication or user interaction, with high confidentiality, integrity, and availability impact. The exact spoofing mechanism and any required configuration are not described in the supplied sources, and no public exploit was identified at time of analysis. The vuln.today priority is act_now.
Heap-based buffer overflow in AiDot Linkind Matter Smart Plug firmware 1.01.32 allows unauthenticated attackers positioned on the same local network segment to corrupt heap memory through crafted SSDP header parsing, with high confidentiality, integrity, and availability impact. The vendor-facing CVSS of 9.8 uses AV:N, but the independently assessed vector is AV:A because SSDP is a local-discovery protocol-internet exploitation requires a prior LAN foothold or an exposed or forwarded UPnP service on UDP port 1900. No CISA KEV entry or verified working exploit code is present in the supplied data; a public GitHub repository documents the SSDP/UPnP issues, and EPSS is low at 0.19% (8th percentile).
Local file inclusion in the CozyThemes Rootblox WordPress plugin through 1.0.6 allows remote attackers to read files accessible to the web server and, if executable PHP can be placed in an includable location, potentially execute code. The supplied CVSS 3.1 vector rates this 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and the vuln.today decision label is act_now, but the description does not identify the plugin feature, endpoint, or parameter that controls the include path, and the PR:N/UI:N requirement comes only from the Patchstack CVSS rather than independent confirmation. No public exploit identified at time of analysis; installations running versions after 1.0.6 are outside the stated affected range.
Command injection in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 lets remote attackers execute shell commands by manipulating the FileMd5 argument handled by UploadCustomModule in lib/cste_modules/product.so. The supplied CVSS 4.0 vector scores it as unauthenticated network exploitation with no user interaction, though practical reachability depends on exposure of the router management service on the LAN, or on the WAN if remote management is enabled. Publicly available exploit code exists, and impact is constrained to this specific model and firmware build.
HPE networking devices are exposed to a critical-severity (CVSS 9.6) adjacent-network flaw that requires no authentication and no user interaction. The bulletin is tagged Information Disclosure, while the assessed vector indicates high confidentiality, integrity, and availability impact with a scope change; the exact triggering feature or protocol is not described in the available sources. No public exploit identified at time of analysis, and the vuln.today decision label is act_now pending review of HPE bulletin hpesbnw05162en_us.
HPE networking devices carry a CVSS 9.6 flaw that an unauthenticated attacker on the same adjacent or local network segment can use without user interaction; the changed-scope vector (S:C) indicates the impact can cross a security boundary, with high confidentiality, integrity and availability consequences. The affected models, firmware branches and the exact protocol or feature involved are not described in the available sources, so scope must be confirmed against HPE bulletin hpesbnw05162en_us, which is the only reference supplied. Exploitation has not been publicly demonstrated: no public exploit code and no CISA KEV listing was provided, and no EPSS score was supplied, although the vuln.today priority label is act_now, so the exposure should be treated as requiring prompt action pending vendor details.
A critical-severity (CVSS 9.6) unauthenticated flaw affects an unspecified HPE product, reported directly to the vendor by security-alert@hpe.com and tracked in HPE advisory hpesbnw05162en_us. An attacker positioned on an adjacent network segment (same broadcast/L2 domain, VLAN, or wireless network) can trigger it without credentials or user interaction, resulting in scope-changed high impact to confidentiality, integrity, and availability. The vuln.today Decision label is act_now; because no CVE description was published, the specific triggering feature, protocol, and exact affected versions must be taken from the HPE advisory, and no public exploit code or CISA KEV entry is indicated in the available data.
Critical-severity exposure in HPE networking devices (CVSS 9.6) can be triggered by an unauthenticated attacker on an adjacent Layer-2 segment, with high confidentiality, integrity, and availability impact and scope change extending effects beyond the vulnerable component. The only supplied vendor reference is HPE bulletin hpesbnw05162en_us, and no CVE description, CWE, CPE string, or exact affected model/firmware is provided; the report is tagged Information Disclosure even though the CVSS vector scores all three impact categories high. The vuln.today decision label is act_now, and no KEV status, EPSS score, or public exploit code was supplied, so no public exploit is identified at time of analysis.