Unauthenticated SQL injection in Weaver E-cology 8.0, 9.0, and 10.0 before 10.76 allows remote attackers to inject SQL through the doc_datefrom and doc_dateto fields of the /api/doc/out/more/list endpoint when srcType=2 and elementmore is used, then read query results through /api/ec/dev/table/counts to extract database information. The assessed vector requires only network reachability, with no privileges or user interaction, and instances upgraded to 10.76 or later are not affected. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19, and a public PoC reference exists; it is not verified as working exploit code.
CPU exhaustion in libexpat through 2.9.0 lets remote attackers stall XML parsing workloads by supplying a moderately sized document with a large DTD and nested entity definitions, because the billion-laughs amplification check in accountingDiffTolerated() aborts too late and each parse can burn tens of seconds of CPU. Unauthenticated remote attackers (CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N) can trigger it wherever an application passes untrusted XML to libexpat with DTD processing and internal general/parameter entity expansion enabled; impact is limited to availability, with no disclosure or modification. No confirmed active exploitation is known, though a public PoC reference exists; it is not verified as working exploit code, and vendor patch material is available upstream (PR #1433).
Out-of-bounds write in CFITSIO through 4.7.0 lets a crafted FITS file overflow both a fixed 28,800-byte stack buffer (cbuff) and the caller's string array when an application reads a variable-length string column, opening the door to arbitrary code execution in the victim process. The vulnerable path is ffgcls2() in getcols.c, which trusts heap-descriptor length values taken from the file instead of validating them against the destination buffer size. Exploitation is local in vector terms (CVSS:4.0/AV:L, CVSS:3.1/AV:L/AC:L/PR:N/UI:R) and requires the target application to actually parse a variable-length string column ('1PA'-style TFORM) from the file; no privileges are needed beyond inducing the victim to open the FITS file. A public PoC reference (a gist cited in the CVE record) exists but is not verified as working exploit code, EPSS/KEV data is absent, and the vendor has published an upstream fix in PR #184 (commit 579792e0f85bff0c6733ad5ebdf54c3b5c188686), which the vuln.today decision logic labels this_week.
Denial of service in the Python GraphQL-core library (3.0.0 through 3.2.11, plus 3.3.0 pre-releases before 3.3.0rc1) lets an unauthenticated remote attacker pin a worker process for minutes with a single shallow, highly compressible query. The OverlappingFieldsCanBeMerged rule, which ships in specified_rules and is therefore enabled by default on every GraphQL-core server, re-compares flattened inline fragments at every nesting level and can be driven into quadratic - worst case O(n²·m²) - CPU work during validation, before any resolver, depth limiter or complexity analyzer runs; the vendor advisory documents a 364 KB query consuming one core for over 300 seconds on 3.2.8. Severity is availability-only (no confidentiality or integrity impact) and the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5; the advisory includes a proof-of-concept query generator with measured timings, which is a public PoC reference rather than independently verified working exploit code, and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis. Fixed versions 3.2.12 and 3.3.0rc1 enforce a 250,000-comparison budget.
Stored cross-site scripting in the WebP Express WordPress plugin before 0.25.16 lets unauthenticated visitors submit values that the plugin's bundled HTML parser later re-emits into element attributes without escaping, so the payload breaks out of the attribute context and executes in the browser of anyone who loads the affected page, including administrators. The vulnerable code path is only reached when a non-default image delivery mode is enabled; default installations do not exercise it, and the stored payload only fires when a victim views the page, which is why the assessed vector carries UI:R and AC:H despite PR:N. A public PoC reference exists in the WPScan entry but is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation; vendor patch 0.25.16 is available and the issue is prioritized as this_week rather than emergency-level.
Royal MCP, a WordPress plugin, issues preview-link tokens that are not bound to the single preview they were created for; in versions before 1.5.7 any party holding a valid token is authenticated as the token's owning user - an administrator in a default install - across the entire REST API without a nonce check, enabling full site takeover. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that the hard part is obtaining such a token, and the available sources do not describe how a token is acquired or how long it stays valid, so practical acquisition difficulty is unverified. A public PoC reference exists (the WPScan entry) but it is not verified as working exploit code, and no CISA KEV listing or EPSS scoring is present in the supplied data.
Privilege escalation in the HIPAA Forms WordPress plugin (versions before 3.3.2) lets an account that already holds the plugin's own custom user role push that role up to administrator-level capabilities. The plugin handles a request that rebuilds its custom role without any capability check, so a role holder can rewrite their own permissions; per the assessed vector the attacker must be authenticated and must already possess that specific custom role (PR:H), making this an insider or role-holder escalation path rather than unauthenticated remote takeover, and no victim interaction is required. A public PoC reference exists but is not verified as working exploit code, there is no CISA KEV listing, and a vendor fix is available in 3.3.2.
Stored cross-site scripting in the PixelYourSite WordPress plugin before 11.4.3 and PixelYourSite Pro before 12.6.8 lets unauthenticated remote attackers plant script in a page that is then served to other visitors. The plugin prints an attacker-supplied cookie value into page output without sanitising or escaping it, so on a site running a full-page cache the payload is persisted in the cached copy rather than only reflected back to the sender. Scored CVSS 3.1 at 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) with a scope change because the script executes in other users' browsers; a vendor patch is released (11.4.3 / 12.6.8), a public PoC reference exists but is not verified as working exploit code, and no confirmed active exploitation or KEV listing was reported.
Heap out-of-bounds reads and writes affect libsmb2 before release 6.3 through integer overflow in the DCE/RPC NDR decoder in lib/dcerpc.c. A malicious SMB server, or a machine-in-the-middle on an unsigned connection, can return crafted NetrShareEnum replies whose wrapping actual_count or max_count values cause undersized heap allocations and subsequent memory corruption when a client application calls smb2_share_enum_async(); the attacker needs no credentials but must control the server side or the network path, and the client must initiate the share enumeration on an unsigned connection. A public write-up describing the count overflow exists and is tagged as an exploit reference, but it is not verified as working exploit code, and no public exploit is otherwise identified; the vendor has released libsmb2 6.3 as the only complete fix, and the issue is prioritized for remediation this week per vuln.today.
Kiloview E3 NDI encoder firmware before version 1.30 signs session JSON Web Tokens with a single HMAC-SHA256 secret that is hardcoded in the firmware image and shared across every deployed device. Because the firmware is publicly downloadable from the vendor, anyone can extract that secret and forge valid session tokens, including administrative ones, then reach privileged device functions over the network without any credentials and without user interaction. The flaw is remotely exploitable and high impact for confidentiality, integrity and availability in our assessment; no public exploit code or confirmed active exploitation was identified at time of analysis, though the underlying technique requires only offline extraction of a static string plus network reachability to the authentication endpoint. Kiloview has released fixed firmware 1.30, and the vendor advisory (ICSA-26-295-01) is available.
Remote, unauthenticated attackers can change the hostname, DNS servers, and NTP time source on Kiloview E3 NDI encoder firmware before 1.30 through the ONVIF device service, even when authentication is enabled for that service (CVSS 8.7). The flaw is an authentication bypass for configuration write operations (CWE-306) with high integrity impact but no direct confidentiality or availability impact; exploitation requires network reachability to the ONVIF service. No public exploit identified at time of analysis, and the vendor provides a firmware update.
Session tokens issued by the Kiloview E3 web management interface on login are given an expiration far beyond any reasonable session lifetime, so a token obtained through interception or device compromise keeps granting authenticated access long after it should have lapsed. The issue is tracked as CWE-613 (insufficient session expiration) against Kiloview E3 firmware and carries a CVSS 8.3 base score; the CVSS vector includes PR:N, although practical exploitation first requires the attacker to capture a valid token, which is why the assessed attack complexity is High. No public exploit code has been identified at time of analysis, and the authoritative reporting is CISA ICS advisory ICSA-26-295-01, filed by ICS-CERT and prioritized as 'this week' rather than emergency action.
PhpSpreadsheet's XLSX reader can be tricked into parsing attacker-supplied DOCTYPE and entity declarations, because the XML security scanner in XmlScanner::scan() only anticipates NUL-byte interleaving and is defeated by ISO-2022 escape sequences inserted into the declaration. Any application that accepts user-uploaded spreadsheets and processes them with the Xlsx reader is affected, and the prerequisite is only that the file be opened; the CVSS vector shows PR:N/UI:N, so no authentication or interaction beyond the file upload is needed. The reliably exploitable outcome is entity-expansion denial of service on all supported PHP versions (a ~2 KB XLSX produced ~45 MB peak memory in the advisory's testing, roughly a 22,000:1 amplification); local file read and SSRF through external SYSTEM entities are conditional on PHP < 8.0 / libxml2 < 2.9 or on the application explicitly passing LIBXML_NOENT. A public proof-of-concept is published in the GitHub security advisory at https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-3x94-m842-937c; there is no CISA KEV confirmation of active exploitation, and the priority decision is to patch this week.
PhpSpreadsheet's SpreadsheetML reader (Reader\Xml) can be induced to pass a DOCTYPE/ENTITY block into SimpleXML despite its entity-blocking scanner, because the scanner's html_entity_decode callback runs after the pattern check and the content is scanned twice. Files containing a double-encoded less-than character (&#60; or &#x3C;) smuggle a literal '<!DOCTYPE' past both passes, so processing attacker-controlled XML with the Xml reader yields entity-expansion denial of service on all PHP versions, plus local file read or SSRF where external entities are still resolved (PHP before 8.0, libxml2 before 2.9, or any PHP build with LIBXML_NOENT enabled). Affected releases are 3.3.0 through 3.10.7 and 4.0.0 through 5.9.0; vendor fixes are released as 3.10.8 and 5.10.0. No CISA KEV listing or confirmed active exploitation is reported, but the vendor advisory itself publishes a proof-of-concept that was reportedly exercised against PhpSpreadsheet 5.9.0, and the priority signal places remediation in the this-week band rather than emergency.
Filesystem sandbox escape in Wasmtime's wasmtime-wasi crate allows an untrusted WebAssembly guest that has been granted a sandboxed directory to read and write arbitrary files the host process can access. The flaw lives in the bundled cap-std dependency (CWE-61, symlink following): a path or symlink containing a trailing slash is mishandled, so a guest with write access to any sandboxed directory gains full host filesystem read/write, while a read-only guest can disclose host files only when exploitable symlinks already exist in its directory. Per the CVSS 4.0 vector the attacker needs low privileges (PR:L) and must already be running as a guest inside the affected embedding; only macOS and Linux kernels lacking openat2 (pre-5.6 or where the syscall is unavailable, e.g. blocked by seccomp) are exposed, because Linux 5.6+ hosts cause cap-std to use RESOLVE_BENEATH. No public exploit code or CISA KEV entry was identified at time of analysis; the vendor rates this a full sandbox escape and states there is no workaround other than upgrading.
Privilege escalation in Cozmoslabs Profile Builder through 4.0.4 allows an authenticated low-privilege user to raise their own level of access, with high impact on confidentiality, integrity and availability (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The practical barrier is obtaining an initial account, which is materially lowered on WordPress sites that enable open self-registration, since an attacker can then create their own low-privilege foothold and escalate from it. There is no public exploit identified at time of analysis, and the vendor-published Patchstack record is the only reference available; the priority label places it in this week's remediation queue rather than an emergency response.
Unauthenticated attackers positioned on an adjacent network segment can compromise an HPE networking device with high impact to confidentiality, integrity, and availability, scored CVSS 3.1 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The affected product line, feature, protocol, and version range are not stated in the supplied data, which contains no description and only a single HPE advisory reference (hpesbnw05162en_us); the one limiting prerequisite confirmed by the vector is network adjacency, meaning the attacker must share an L2 broadcast domain or logically adjacent network rather than reaching the device from the open internet. No public exploit code or KEV entry is indicated at time of analysis, the priority label is this_week, and no vendor-released fix version is specified in the available intelligence.
Unauthenticated attackers positioned on an adjacent network segment can achieve high confidentiality, integrity, and availability impact against affected HPE networking equipment, per HPE security bulletin hpesbnw05162en_us. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates the attack needs no credentials or user interaction and is low-complexity once network adjacency is established, which is the primary limiting factor; internet-wide exploitation is not implied. No CVE description, CWE mapping, or public exploit reference was supplied, and no confirmed active exploitation (CISA KEV) status is available at time of analysis.
An unauthenticated, low-complexity flaw in HPE networking equipment (reported to HPE PSIRT under advisory hpesbnw05162en_us) allows an attacker positioned on the same Layer-2 segment, VLAN, or directly-connected local network to achieve high confidentiality, integrity, and availability impact, per the assessed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector (base 8.8). No CVE description or CWE was published, so the specific feature, protocol, or configuration that must be reached to trigger the flaw is not identified in the available sources, and the 'Information Disclosure' tag is narrower than the assessed impact triad. No public exploit code or CISA KEV entry is present in the supplied intelligence, and the vulnerability is not reachable from a routable internet path - the adjacency requirement is the primary limiting factor. The vuln.today decision label places remediation in the 'this_week' queue.
A single crafted Kafka record can permanently crash-loop a Motor.NET service running any version before 0.19.0 that consumes a topic with CloudEvents message handling. The record declares content-type application/cloudevents+json but omits the mandatory CloudEvent attributes id, source and type, causing an ArgumentException inside KafkaMessageConsumer.SingleMessageHandlingAsync that the framework treats as fatal; the host stops, and because the same poison record is re-consumed on every restart, the service never recovers until the message is removed or the software is upgraded. The authoritative CVSS 4.0 vector (8.7, AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) rates this as a high-availability-impact, unauthenticated denial of service with no confidentiality or integrity exposure; the key environmental precondition is that the attacker can produce records to the consumed topic (Kafka-level produce authorization). No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released 0.19.0 as the complete fix.
Cross-site request forgery in Xpro Elementor Addons through 1.7.10 can trick a logged-in privileged WordPress user into performing unintended plugin actions; the attacker is unauthenticated (PR:N) but must persuade a victim to visit attacker-controlled content while their session is active (UI:R). Our independent assessment limits impact to low confidentiality and integrity with no availability effect, despite the supplied CVSS 3.1 score of 8.8. No public exploit code or confirmed active exploitation was identified in the provided intelligence.
Denial of service in Motor.NET before 0.19.0 lets anyone able to publish to a queue the service consumes crash it permanently by sending a message with crafted CloudEvents headers - an invalid cloudEvents:motorversion value, a header whose value is a single double-quote, or an unparsable typed attribute such as cloudEvents:time. The malformed header raises an unhandled exception in ExtractCloudEvent that the host treats as fatal; because the message is never acknowledged, the broker redelivers it after restart and the crash repeats as a permanent crash-loop. The impact is availability-only (CVSS 8.7, VA:H) and requires broker-side publish access rather than authentication to Motor.NET itself; no public exploit was identified at time of analysis.
Unauthenticated memory exhaustion in the Erlang esaml SAML library (version 0.1.0 and later) lets a remote attacker crash the hosting Erlang VM by posting a small, highly compressed SAMLResponse to a service provider's assertion-consumer (ACS) or single-logout endpoint. Because esaml_binding:decode_response/2 base64-decodes and inflates the attacker-supplied payload with zlib:unzip/1 before any signature check, a deflate stream with roughly 1000:1 amplification expands tens of kilobytes into hundreds of megabytes of binary and then gigabytes of charlist heap, so only a handful of requests are needed to take the node down. No public exploit code or confirmed active exploitation was identified at time of analysis, but the issue is trivially reachable on any internet-facing esaml service provider and upstream fix commits are already published.
Permanent denial of service in Motor.NET before 0.19.0: any party able to publish to a queue or topic that a Motor.NET service consumes can crash that service and keep it down. The service deserializes incoming payloads with JsonNetDeserializer.Deserialize, and structurally valid JSON that does not match the handler's expected type raises a JsonSerializationException that the code does not catch, so TypedConsumerService.SingleMessageConsumeAsync classifies the message as a CriticalFailure and calls StopApplication. Because the offending message is never acknowledged, it is redelivered on restart and re-triggers the shutdown, producing a crash-loop that persists until the message is removed or the library is upgraded; the CVSS 4.0 score is 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) with no confidentiality or integrity impact, and no public exploit code was identified at time of analysis.
Quadratic denial of service in Mistune's Markdown parser (parse_link_text) affects versions 3.2.0, 3.2.1 and main prior to the 3.3.0 fix: a string consisting of many unmatched opening square brackets followed by a character and many closing brackets causes repeated full forward scans, so cost grows with the square of input length. Per the Python package advisory, roughly 25 KB of brackets stalls a worker past 15 seconds on an Apple M2 and about 50 KB stretches past two minutes, letting remote attackers wedge any server-side caller of mistune.html() that renders attacker-influenced markdown, such as comment fields, web forms or federated content feeds. The CVSS 4.0 base score is 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N, high availability only), exploit code in the form of a timing benchmark is published in the advisory, and no CISA KEV entry or other active-exploitation signal is present in the supplied data.
Denial of service in the PhpSpreadsheet ODS reader allows unauthenticated remote attackers to exhaust a PHP worker's CPU and memory by loading a small crafted .ods file, terminating the process. Every maintained branch is affected - 1.x up to and including 1.30.6, 2.0-2.1 up to 2.1.18, 2.2-2.4 up to 2.4.7, 3.x up to 3.10.7 and 4.x-5.x up to 5.9.0 - whenever an application parses an attacker-supplied OpenDocument Spreadsheet using the default read filter, since no authentication or special configuration is required. A public proof-of-concept payload is documented in the vendor advisory; it is not verified as working exploit code, and no confirmed active exploitation (CISA KEV) is recorded at time of analysis.
Quadratic-time parsing in Mistune's inline link parser (all versions through 3.2.1) lets remote attackers stall server-side markdown rendering by submitting a small payload made of long runs of unmatched '[' characters. Each '[' triggers a probe of parse_link_text/parse_link_label, so work grows O(N^2): roughly 30+ seconds of CPU for a 16 KB input and proportionally worse as input grows, with the nested '[[..]]' shape costing a further ~4x. The vendor advisory reports a reproducible benchmark proof-of-concept against mistune 3.2.1 in default configuration (no plugins or options required); there is no CISA KEV listing and no confirmed in-the-wild exploitation, and the impact is CPU time only - no memory growth, no confidentiality or integrity effect - so sustained denial requires repeated requests to exhaust a worker or thread pool, most acutely on single-threaded WSGI deployments.
Quadratic-time CPU exhaustion in Mistune 3.0.0 through 3.2.1 allows unauthenticated remote attackers to tie up a rendering worker for minutes using only a few tens of kilobytes of Markdown built from unbalanced '[' or '
XML external entity injection in Apache Abdera (all versions) allows unauthenticated remote attackers to read sensitive data or trigger server-side requests when an application feeds attacker-controlled XML into Abdera's parser or JDBC adapter parsing paths. The project is retired and unsupported, so Apache states it will not issue a fix, and downstream products that still bundle the Abdera artifact remain exposed. No public exploit identified at time of analysis, and exploitation is deployment-dependent: the target must still embed Abdera and route untrusted XML to it.
SQL injection in the Lotus (uselotus/lotus) metering and billing platform through 0.10.2 lets an authenticated organization-level user smuggle SQL into usage-aggregation queries by registering a crafted subscription_filter_key that passes the keyword-only validator and is later rendered as an unquoted GROUP BY identifier. Per the assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), the dominant impact is high-confidentiality disclosure of billing and usage data held in the shared multi-tenant database, with limited integrity impact and no availability effect; the reporter's CVSS 4.0 vector scores it 8.7. No CISA KEV entry or confirmed working exploit code was identified at time of analysis, though a public technical writeup is referenced, and vuln.today sequencing places this in the this-week remediation queue - the practical prerequisite is a valid tenant account on a deployment where aggregation queries span tenants.
SQL injection in the Lotus billing platform through 0.10.2 allows an authenticated organization-level user to execute arbitrary stacked SQL statements through POST /app/metrics/, enabling cross-tenant reads and modifications of data in the shared database. The weakness bypasses first-statement-only validation because semicolon-appended statements are executed unfiltered. Exploitation requires a legitimate tenant account and access to the custom billable-metric query feature; no public exploit has been identified at time of analysis.
SQL injection in JSON-SCADA releases before 0.65-alpha lets an authenticated user inject arbitrary SQL through the OPC historian HistoryRead API implemented by opcApi() in src/server_realtime_auth/index.js, by supplying crafted NodeId.Id, StartTime or EndTime values in a HistoryReadRequest. Because stacked statements are accepted, an attacker with any valid account can read, modify or delete historian data across all locations irrespective of their assigned role, giving high confidentiality, integrity and availability impact to the historian. Exploitation requires network reach to the HistoryRead endpoint plus valid credentials (CVSS 4.0 PR:L, aligned with an assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit code is identified at time of analysis, the issue is not in CISA KEV, and VulnCheck reporting places remediation in the current weekly patch cycle rather than an emergency response.
Roskus Prospero Flow CRM versions 2.0.0 through 5.25.x ship user API routes (GET and DELETE /api/user/{id}) protected only by the auth:api middleware, which validates the JSON Web Token and performs no permission, policy or role check, so any holder of a basic-role account can read the account records of other users in the same company - including administrators and their email address, telephone number, postal address and IBAN - and, from 3.5.0 onward, delete those accounts. Exploitation requires a valid authenticated account (PR:L) and, for deletion of accounts outside the attacker's own company, membership in Company::DEFAULT_COMPANY (company ID 1), where the company comparison is skipped entirely; an account in that company can delete any account of any company, including a company's last administrator, and deletion removes the data held on the account. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vulnerability is tracked with an assessed CVSS 3.1 base of 8.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) and is prioritized for remediation this week.
Cross-tenant conversation-state leakage in the Strands Agents SDK A2A server allows an authenticated remote caller in a multi-tenant deployment to read other tenants' conversation history and plant persistent instructions that alter model behavior for subsequent callers by referencing a different context_id. Python strands-agents before 1.43.0 and TypeScript @strands-agents/sdk before 1.5.0 are affected; single-tenant or single-user deployments are not exposed. No public exploit was identified at time of analysis, and fixes are available in 1.43.0 and 1.5.0.
Cross-site scripting in the Agent Zero Web UI before 1.15 allows injected JavaScript in chat messages or uploaded files to run inside a victim's authenticated session when Agent Zero renders that content back in the chat interface. The flaw is unauthenticated from the attacker's side (PR:N) but depends on a victim viewing the rendered content (UI:R), and impact is confined to the victim's Web UI session (VC:H/VI:H, no assessed scope expansion to other systems); Agent Zero 1.15 and later sanitize chat markdown and are not affected. The vendor shipped a fix in v1.15, the issue is tracked as CWE-79 and catalogued as EUVD-2026-108272, and no confirmed public exploit code appears in the supplied sources, although the advisory cites a GitHub issue report for the bug.
Cross-tenant data access in SmileCDR HAPI FHIR allows an attacker who holds valid credentials for one tenant in a multi-tenant deployment to read from or write to another tenant's storage partition by submitting an untrusted bundle body that replaces a trusted partition identity; storage partition entitlement is not enforced by default. Exploitation requires authenticated access to at least one tenant, and single-tenant deployments or those with partition entitlement enforcement enabled are less exposed. No public exploit identified at time of analysis, and this is a genuine priority rather than an inflated high-CVSS issue, though not a drop-everything emergency.
Authentication bypass in Obot's CLI login flow before 0.26.0 lets an unauthenticated remote attacker obtain a victim's non-expiring API key by choosing a token request ID and persuading a signed-in user to complete the crafted login link, resulting in account takeover. The flaw is a CSRF-class weakness (CWE-352) requiring user interaction, and the stolen key remains valid until manually revoked. No public exploit code was identified at time of analysis, and CVE-2026-114662 is not in CISA KEV.
Vyper compiler releases 0.4.0b1 through 0.5.0b1 can miscompile contracts that import an unfoldable constant or a function with an omitted default argument and then declare a parameter, local, or loop variable with the same name, causing the imported name to resolve in the using function's scope instead of at its declaration. When that name collision exists, attacker-influenced input can replace the intended value, including an out-of-range value for a narrow type such as uint8, corrupting validation or accounting logic. The independent assessment stresses that this is not exploitable against a default or arbitrary Vyper contract, that exploitation requires the specific import-and-shadowing source pattern in an affected beta compiler, and that no public exploit was identified at the time of analysis; the supplied CVSS 4.0 vector is PR:N, but the assessed CVSS 3.1 vector treats the issue as high-complexity and integrity-focused.
Mail header injection in Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows any authenticated mailbox user to inject arbitrary MIME part headers into an outgoing message by placing CRLF sequences in the media type of an inline-image data URI, rated CVSS 8.5 with high integrity impact and changed scope. The flaw sits in rcmail_sendmail::extract_inline_images(), which used the attacker-controlled media type without validation; exploitation needs the standard HTML compose feature and no victim interaction, but it is not available to unauthenticated remote attackers. The vendor has released fixed versions, and there is no public exploit identified at time of analysis.
OS command injection in the Terraform hook of AWS SAM CLI (sam build --hook-name terraform) lets an actor who can influence the Terraform configuration or plan file consumed by a build execute arbitrary commands as the build user on the build host. The flaw affects versions 1.63.0 through 1.166.1; the hook inserted the Terraform resource address of each SAM metadata resource into a shell command while neutralizing only double-quote characters, so a crafted resource address containing shell metacharacters (such as command substitution syntax) was passed through unmodified. No privileges on the host are required (PR:N) and no AWS credentials are needed, but the build must be invoked by a user (UI:A) and the target must actually use the Terraform hook build mode with attacker-influenceable Terraform input, so exposure is limited to builds consuming untrusted or compromised third-party modules, shared repositories, or plan artifacts; no public exploit code was identified at time of analysis, and the risk is a conditional supply-chain/build-time one rather than a mass-exploitable network flaw.
Blind SQL injection in AmentoTech Workreap Core before 3.4.4 allows an authenticated low-privileged user to extract data from the WordPress database; the risk picture is moderate and somewhat conflicting because exploitation requires a plugin account rather than anonymous access. No public exploit was identified at time of analysis, and the specific vulnerable endpoint or parameter is not described in the supplied sources.