HPE networking devices are exposed to a critical, unauthenticated attack from an adjacent network position, with the assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) indicating low-complexity exploitation that can produce high confidentiality, integrity, and availability impact and may extend to other systems through changed scope. HPE's own security team reported the issue via advisory hpesbnw05162en_us, and the vuln.today decision label is act_now. No CISA KEV entry or public exploit reference appears in the supplied intelligence, so no public exploit is identified at time of analysis; the supplied tag says Information Disclosure, but the assessed vector indicates impacts well beyond confidentiality alone.
An attacker positioned on an adjacent network can achieve high confidentiality, integrity and availability impact against an affected HPE networking device, reflected in a 9.6 CVSS base score from the vector AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. No authentication and no user interaction are required once the attacker is on the same Layer-2 segment, VLAN or broadcast domain, and the scope-change metric means the compromise can affect resources beyond the vulnerable component itself; the limiting factor is purely the adjacency requirement, so arbitrary internet-side attackers are not in the threat model. No public exploit code has been identified at time of analysis, EPSS and KEV data were not supplied, and the single reference is an HPE support advisory; the vulnerable feature or protocol and the exact trigger are not described in the available sources.
Full-scope confidentiality, integrity, and availability compromise of affected HPE networking devices is possible for an unauthenticated attacker positioned on the same adjacent network (CVSS 9.6, AV:A/AC:L/PR:N/UI:N/S:C). The CVE record supplies no description, CWE, CPE, patch version, KEV status, or exploit reference, so the specific feature and affected models cannot be confirmed from the provided data; the HPE bulletin is the only source carrying product-level detail. No public exploit identified at time of analysis, but the act_now priority label and changed-scope high-impact vector justify urgent validation against that bulletin.
High-impact compromise of affected HPE networking devices is possible for unauthenticated attackers who obtain adjacent-network access in CVE-2026-79869 (CVSS 9.6). The assessed vector is AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, so no credentials or user interaction are needed once the attacker is on the same local or logical network segment, and the scope change plus full confidentiality, integrity and availability impact make this an act_now priority. No public exploit is identified at time of analysis, and the provided sources do not describe the product-specific trigger.
High-severity (CVSS 9.6) compromise of HPE networking devices is possible from an adjacent-network position: an unauthenticated attacker on the same LAN segment, VLAN, or directly attached network can trigger the flaw with low complexity and no user interaction, and the changed-scope impact is rated high for confidentiality, integrity, and availability. The source tag labels this as Information Disclosure, while the assessed vector also scores high integrity and availability impact; the specific triggering feature or protocol is not described in the supplied sources. HPE's bulletin is the sole reference, no public exploit is identified at time of analysis, and the vuln.today priority is act_now.
HPE networking products are affected by a CVSS 9.6 scope-changing flaw (CVE-2026-79867) tagged as information disclosure but assessed with high confidentiality, integrity, and availability impact. Exploitation requires adjacent-network positioning with no authentication and no user interaction, while affected models and firmware versions are not enumerated in the supplied data. The priority label is act_now; no CISA KEV entry or public exploit reference was supplied, so no public exploit is identified at time of analysis.
Pre-boot remote code execution in the TianoCore EDK II PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) lets an unauthenticated network attacker corrupt DXE-phase memory on any machine that is PXE-booting over IPv4 or IPv6, writing attacker-controlled bytes past the fixed 504-byte Mode.IcmpError field in the driver's private context. The reliable outcome is a DXE-core exception and hang that denies OS provisioning or recovery; escalation to arbitrary ring-0 code execution before Secure Boot or measured boot has verified anything requires the attacker to know the exact target firmware build so a counterfeit event can be planted for CoreSignalEvent() dispatch. No CISA KEV entry and no public exploit code were identified at time of analysis, but the vuln.today decision label is act_now and this is a genuine high-priority issue because the vulnerable receive path is open by default during network boot.
SQL injection in oretnom23's php-travel-agency-system lets remote attackers manipulate the costomer_id, payment_type, amount, description, user, uploadimage, full_name, and visa_no parameters in admin/insert.php, producing high confidentiality impact and limited integrity impact while availability remains unaffected. Authentication is required per the independent assessment (PR:L), even though the vendor CVSS 4.0 vector claims PR:N; the admin/ endpoint implies valid admin credentials or a separate auth bypass are needed. Publicly available exploit code exists, but the independent assessment treats this as a moderate-priority issue that should not be over-escalated; the project has not responded to the issue report and no vendor-released patch was identified at time of analysis.
Arbitrary file write in Incus (before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0) allows an authenticated client permitted to create instances or custom volumes, or a malicious migration source server, to plant symlinks such as rootfs pointing at / in an incoming volume so rsync or btrfs receive writes attacker-controlled files as root on the target host, leading to full host compromise. All rsync-based storage drivers and the optimized btrfs path are affected, while optimized ZFS transfers are not; a symlink check added in 7.3 runs after the transfer and does not prevent the writes. The vuln.today priority is act_now, and no public exploit identified at time of analysis.
Path traversal in Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 allows an authenticated client with permission to create instances to write root-owned directories and attacker-controlled files at arbitrary host paths by importing a crafted instance backup whose index.yaml lists a dependent custom volume with ../ sequences, creating a route to full host compromise. The flaw bypasses the name validation added for CVE-2026-81495 and CVE-2026-81496 because the dependent-volume path reaches volume creation through a different code path, and the attached-device gate can be satisfied by splitting the traversal across the pool and source fields. No public exploit code or CISA KEV entry was identified at time of analysis, but the vendor advisory and an act_now priority decision indicate urgent remediation; CVSS is 9.4.
Stack buffer overflow in Wasmtime (39.0.0 through 48.0.3, and 49.0.0 through 49.0.1) lets a malicious guest component write roughly 16KB of attacker-chosen data onto the host process's native stack by supplying a mistyped component-model-async callback result type, allowing return-address overwrite that can crash the host or, per the vendor, should be treated as a sandbox escape / arbitrary code execution risk. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a scope change from guest to host and requires the low-privileged guest to be able to deliver a component to the runtime; embedders that only run trusted components, or that build without the component-model-async feature, are not exposed. No public exploit code has been identified at time of analysis, but the vendor rates this as a genuine high-priority issue requiring immediate patching to 48.0.4 or 49.0.2.
A critical-severity (CVSS 9.4) flaw affects an as-yet-unnamed HPE networking product, exposed through a network-reachable interface that remote attackers can reach without authentication or user interaction (AV:N/AC:L/PR:N/UI:N), with high confidentiality and integrity impact and a lesser availability impact. The only public reference is HPE advisory hpesbnw05162en_us, and no CVE description, CWE classification, or CPE data was supplied, so the affected product family, version ranges, and the specific interface involved remain unconfirmed. Third-party triage assigns this an act_now priority, but no public exploit code and no CISA KEV entry are associated with the record at time of analysis, so the urgency rests on the severity vector and the vendor's own security-alert notification rather than on observed exploitation.
SQL injection in the TMS Amelia booking plugin for WordPress, affecting versions through 2.4.11, lets remote attackers influence SQL queries in the plugin, with the authoritative assessment emphasizing high confidentiality impact and lower integrity and availability impact. The vulnerable endpoint or parameter is not disclosed, and the provided data contains no public exploit code or CISA KEV entry. The reported CVSS is 9.3, while the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, indicating network-reachable, unauthenticated exploitation with no user interaction once a vulnerable Amelia installation is present.
HPE networking devices are affected by a CVSS 9.3 flaw that an unauthenticated attacker on an adjacent network can trigger without user interaction, producing high confidentiality and availability impact while integrity impact is rated none; the supplied data does not name the affected feature, protocol, or trigger condition. The independent assessment identifies adjacent-network reachability of the HPE device as the key gating prerequisite, and the vuln.today decision label is act_now. No KEV listing or public exploit reference is present, so no public exploit is identified at time of analysis, and the overall signals remain mixed and incomplete.
Affected HPE devices allow adjacent-network attackers to achieve high confidentiality and integrity impact without authentication or user interaction, per the assessed vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N; the exact product line, models, and software versions are not identified in the supplied data. The vuln.today decision label is act_now, but no CISA KEV entry or public exploit reference is present in the supplied intelligence, and no public exploit was identified at time of analysis. Security teams should treat the issue as high severity for devices reachable from Layer 2/adjacent segments while confirming affected product details through the HPE advisory.
An unauthenticated, low-complexity security flaw affects an as-yet-unnamed HPE product documented in HPE security bulletin hpesbnw05162, carrying a base CVSS 3.1 score of 9.3 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) and triaged as act_now. The only barrier to exploitation is network position: an attacker must sit on an adjacent Layer 2 segment, broadcast domain, or directly connected logical network, after which no credentials or user interaction are required and impact extends past the vulnerable component to a separate security authority with high confidentiality and integrity consequences. No public exploit code or proof-of-concept reference was identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV); the specific triggering feature, protocol, or configuration is not described in the available sources, and no CWE has been assigned.
Unauthenticated attackers positioned on the same adjacent network segment can both read and modify data on affected HPE networking devices, according to CVE-2026-79873 (CVSS 3.1 base 9.3, AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). The flaw requires no credentials and no user interaction and changes scope, meaning the attacker's control can extend beyond the vulnerable component, but the attack path is confined to the local LAN, VLAN, wireless, or management segment rather than being reachable from the open internet. No description has been published and no public exploit code has been identified at time of analysis; the vulnerability is not in CISA KEV, and the accompanying HPE advisory (hpesbnw05162en_us) is the authoritative source for affected models, trigger conditions, and fixes, which the reporting feed has tagged as involving information disclosure.
Man-in-the-middle interception and modification of NT OneAPP client-server communications is possible because the application fails to validate both the server certificate and hostname. Network-adjacent, unauthenticated attackers who already hold a position on the traffic path - such as a rogue Wi-Fi access point or compromised LAN segment - can present an arbitrary certificate and read or alter sessions. No public exploit was identified at time of analysis, and exploitation is bounded by the requirement to intercept live traffic; the independent assessment rates this as adjacent-network, high-complexity, with high confidentiality and integrity impact.
FluentCart (A New Era of eCommerce), a WordPress eCommerce plugin, before version 2.2.0 fails to verify that a stored customer address selected during checkout belongs to the requester, so unauthenticated visitors can attach another customer's saved address to an order they place and read it back - exposing postal addresses, phone numbers and company details. Only sites below 2.2.0 with an active public checkout flow and customers who have previously saved addresses are in scope; the attacker must supply or enumerate a valid stored-address identifier, and disclosed data is limited to contact/shipping details, with no payment data, credentials, or write/availability impact reported. Severity is medium (CVSS 5.3, PR:N via the provided vector), there is no CISA KEV entry, and the WPScan reference is a public PoC/advisory reference that is not verified as working exploit code; overall priority is this_month rather than emergency.
Command injection in Microsoft Azure Pipelines permits remote, unauthenticated code execution with high confidentiality and integrity impact, and the independent assessment also rates availability impact as high (CVSS base 9.1). The CPE identifies microsoft:azure_pipelines without a version restriction, and the available sources do not name the specific pipeline feature, input field, or deployment mode that carries the injectable parameter. A vendor patch is available; active exploitation is not confirmed by CISA KEV, although the CVSS temporal metric E:P indicates proof-of-concept exploit code is assessed to exist.
Arbitrary file read in Mistune's RST `.. include::` directive affects versions before 3.3.0: unauthenticated attackers able to submit markdown to a renderer with the Include plugin enabled can embed any file the rendering process can open - `/etc/passwd`, `/proc/self/environ`, an application's `.env`, `~/.aws/credentials` - into the rendered HTML via `../` traversal or an absolute path. The directive is opt-in: only integrations that register `RSTDirective([Include()])` and set `state.env['__file__']` are exposed, while default Mistune deployments and renderers that never set `__file__` are not affected. The GHSA advisory includes a proof-of-concept verified against mistune 3.2.1, and the flaw is fixed in 3.3.0.
SQL injection in mem0's Databricks vector store backend (mem0/vector_stores/databricks.py) affects versions 0.1.117 up to but not including 1.0.8, and lets remote unauthenticated attackers inject SQL that runs on the configured Databricks SQL warehouse by supplying crafted memory text, metadata values, or message names that reach unescaped string interpolation in the insert() and update() statements. Successful injection gives high confidentiality, integrity, and availability impact on the warehouse, though the assessed vector (AC:H/AT:P) indicates exploitation is not deterministic and requires the non-default Databricks backend to be configured; the trigger mechanics for reliably carrying a payload through mem0's ingestion pipeline are not described in the available sources. No public exploit code or CISA KEV entry was identified at time of analysis, the vendor has released the v1.0.8 fix, and the issue carries an act_now priority label with a CVSS 4.0 base score of 9.2.
Unauthenticated OAuth state values can be redeemed as Magic Link tokens in Better Auth 1.4.0-beta.18 through 1.7.6, letting an attacker who knows a victim's email address obtain a full session for that account without mailbox access or completing the provider callback. The flaw only applies to deployments that enable the Magic Link plugin with plain token storage (or hashed tokens plus globally hashed verification identifiers), enable a built-in social or Generic OAuth provider, and use database-backed OAuth state - the default when a database or secondary storage is configured. Successful abuse yields an existing user's session with all its permissions, or, when Magic Link sign-up is enabled, a new account incorrectly flagged as email verified; no public exploit code has been identified at time of analysis, but the vendor advisory and a public fix commit fully document the technique.
Hard-coded cryptographic key in the NT OneAPP login flow enables remote attackers to decrypt captured authentication requests and recover plaintext user credentials and device information. The issue affects NT OneAPP from NewType Infortech (CPE version wildcard, so all versions unless the vendor states otherwise); exploitation requires the attacker to first obtain encrypted login traffic, which is why the independent assessment rates attack complexity high despite the unauthenticated network vector. No public exploit was identified at time of analysis, and no CISA KEV entry is associated with this CVE.
Unauthenticated attackers who know a registered device's serial number can obtain that device's MDM client certificate and private key from OCO-Server's Apple MDM enrollment endpoint and then impersonate the device on all subsequent MDM traffic. The /api-mdm.php/profile handler verifies enrollment plists with openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...), so an arbitrary self-signed certificate satisfies the check and the SERIAL/UDID claims in the payload are trusted without being bound to the signer; the response returns a PKCS#12 bundle containing a certificate with CN=<serial> issued by the server's internal MDM device CA together with its private key, and the victim's mobile_device row is overwritten with the attacker-chosen UDID. Affects OCO-Server 1.2.0 through 1.2.2 (the MDM feature was introduced in 1.2.0); version 1.2.3 fixes the issue. Reported by GitHub_M and rated act_now by vuln.today priority; no public exploit identified at time of analysis, active exploitation is not confirmed, and the reporter states a proof of concept and full reproduction evidence were offered privately under coordinated disclosure.
Server-side template injection in Drupal Webform (CWE-1336) allows code injection, with the independently assessed impact rated high for confidentiality, integrity, and availability. The independent assessment identifies Webform 0.0.0 through 6.2.11 and 6.3.0 as affected, with vendor-fixed releases 6.2.12 and 6.3.1. No public exploit was identified at the time of analysis and EPSS is low at 0.22%, but the vuln.today decision is act_now because of the high severity.
Argument injection in Incus 7.3.0 through 7.4.x lets a user confined to a restricted project smuggle the forbidden block.create_options setting onto a custom volume, then trigger a copy or move onto a storage pool that formats new volumes, so the injected value is appended to the mkfs command line executed as root. The flaw is an incomplete fix for CVE-2026-62867, which only rejected the option on the direct custom-volume creation path while leaving update, copy and move operations unchecked; the package range is go/github.com/lxc/incus/v7/cmd/incusd >= v7.3.0, < v7.5.0. Exploitation requires an authenticated restricted-project user with permission to create or edit custom volumes, and root-level code execution only materialises on pools that format on copy such as non-thin LVM - on other drivers the forbidden option lands on the volume config without reaching mkfs. No public exploit code was identified at time of analysis, but the weakness class is straightforward and the priority signal is act_now given the root-level outcome on affected storage backends.
Missing authorization in OpenRemote's GatewayServiceResource lets any authenticated, non-administrative user start, stop, or query edge-gateway tunnels, opening persistent bidirectional TCP circuits into an edge gateway's network or tearing down tunnels operators depend on. All OpenRemote deployments from 1.2.0 through versions before 1.31.0 are affected, but exposure is gated on the instance actually using gateway tunneling with at least one configured edge gateway, since the vulnerable POST/DELETE tunnel endpoints must be reachable and operational. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the attacker only needs a low-privileged account (CVSS PR:L) and no user interaction, which keeps the bar low wherever tunneling is deployed.
Unauthenticated denial of service in the ONVIF service of Kiloview E3 encoder firmware, where malformed or incomplete requests to certain ONVIF operations render the service unresponsive while the rest of the device continues normal operation. The service recovers automatically after a period, but the condition can be retriggered repeatedly by any party able to reach the ONVIF port over the network. No public exploit code or confirmed active exploitation is identified in the available sources; the CISA ICS advisory and vendor firmware download page are the primary references, and no public exploit was identified at time of analysis.
Kiloview E3 firmware leaves certain ONVIF informational requests unauthenticated, so a remote party that can reach the device service can retrieve device identifiers and configured user-account names with privilege levels (CVSS 5.3, CWE-306). The exposure is information disclosure that supports fingerprinting and targeted credential attacks, not direct account takeover; reachability of the ONVIF service is the practical constraint. No public exploit identified at time of analysis and no CISA KEV confirmation is provided; the vuln.today decision label is this_month.
Missing authorization checks in the Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 allow authenticated users holding the author role or higher to delete arbitrary media attachments, including files uploaded by other users and administrators. The issue is an integrity-only authorization bypass (CWE-639) on the attachment-handling action: no confidentiality exposure, no code execution and no stated availability impact beyond the deleted media. No KEV listing or confirmed active exploitation is reported in the available data, only a public PoC reference that is not verified as working exploit code, and the vulnerability is treated as a moderate, this-month priority rather than an emergency; exposure is confined to sites running the plugin with author-level or higher accounts.
PhpSpreadsheet's XLSX reader can be tricked into parsing attacker-supplied DOCTYPE and entity declarations, because the XML security scanner in XmlScanner::scan() only anticipates NUL-byte interleaving and is defeated by ISO-2022 escape sequences inserted into the declaration. Any application that accepts user-uploaded spreadsheets and processes them with the Xlsx reader is affected, and the prerequisite is only that the file be opened; the CVSS vector shows PR:N/UI:N, so no authentication or interaction beyond the file upload is needed. The reliably exploitable outcome is entity-expansion denial of service on all supported PHP versions (a ~2 KB XLSX produced ~45 MB peak memory in the advisory's testing, roughly a 22,000:1 amplification); local file read and SSRF through external SYSTEM entities are conditional on PHP < 8.0 / libxml2 < 2.9 or on the application explicitly passing LIBXML_NOENT. A public proof-of-concept is published in the GitHub security advisory at https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-3x94-m842-937c; there is no CISA KEV confirmation of active exploitation, and the priority decision is to patch this week.
PhpSpreadsheet's SpreadsheetML reader (Reader\Xml) can be induced to pass a DOCTYPE/ENTITY block into SimpleXML despite its entity-blocking scanner, because the scanner's html_entity_decode callback runs after the pattern check and the content is scanned twice. Files containing a double-encoded less-than character (&#60; or &#x3C;) smuggle a literal '<!DOCTYPE' past both passes, so processing attacker-controlled XML with the Xml reader yields entity-expansion denial of service on all PHP versions, plus local file read or SSRF where external entities are still resolved (PHP before 8.0, libxml2 before 2.9, or any PHP build with LIBXML_NOENT enabled). Affected releases are 3.3.0 through 3.10.7 and 4.0.0 through 5.9.0; vendor fixes are released as 3.10.8 and 5.10.0. No CISA KEV listing or confirmed active exploitation is reported, but the vendor advisory itself publishes a proof-of-concept that was reportedly exercised against PhpSpreadsheet 5.9.0, and the priority signal places remediation in the this-week band rather than emergency.
Filesystem sandbox escape in Wasmtime's wasmtime-wasi crate allows an untrusted WebAssembly guest that has been granted a sandboxed directory to read and write arbitrary files the host process can access. The flaw lives in the bundled cap-std dependency (CWE-61, symlink following): a path or symlink containing a trailing slash is mishandled, so a guest with write access to any sandboxed directory gains full host filesystem read/write, while a read-only guest can disclose host files only when exploitable symlinks already exist in its directory. Per the CVSS 4.0 vector the attacker needs low privileges (PR:L) and must already be running as a guest inside the affected embedding; only macOS and Linux kernels lacking openat2 (pre-5.6 or where the syscall is unavailable, e.g. blocked by seccomp) are exposed, because Linux 5.6+ hosts cause cap-std to use RESOLVE_BENEATH. No public exploit code or CISA KEV entry was identified at time of analysis; the vendor rates this a full sandbox escape and states there is no workaround other than upgrading.
Privilege escalation in Cozmoslabs Profile Builder through 4.0.4 allows an authenticated low-privilege user to raise their own level of access, with high impact on confidentiality, integrity and availability (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The practical barrier is obtaining an initial account, which is materially lowered on WordPress sites that enable open self-registration, since an attacker can then create their own low-privilege foothold and escalate from it. There is no public exploit identified at time of analysis, and the vendor-published Patchstack record is the only reference available; the priority label places it in this week's remediation queue rather than an emergency response.
Stored shortcode injection in the WP Ultimate Review WordPress plugin affects every version before 2.4.5: the public review form does not neutralise shortcode syntax in all review fields, so an unauthenticated visitor can submit a review containing arbitrary shortcodes that are then executed when that field is rendered on the site, provided user reviews and that field's display are enabled. The vendor has released 2.4.5 as the fix, and a public PoC reference exists; it is not verified as working exploit code, and there is no confirmed active exploitation (not in CISA KEV). Tracked as CVE-2026-103234 with a CVSS 3.1 base score of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) and an EUVD record (EUVD-2026-108009), the realistic impact is bounded by which shortcodes are registered on the target site and by whether the affected field is actually displayed to a viewer.
Unauthenticated attackers positioned on an adjacent network segment can compromise an HPE networking device with high impact to confidentiality, integrity, and availability, scored CVSS 3.1 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The affected product line, feature, protocol, and version range are not stated in the supplied data, which contains no description and only a single HPE advisory reference (hpesbnw05162en_us); the one limiting prerequisite confirmed by the vector is network adjacency, meaning the attacker must share an L2 broadcast domain or logically adjacent network rather than reaching the device from the open internet. No public exploit code or KEV entry is indicated at time of analysis, the priority label is this_week, and no vendor-released fix version is specified in the available intelligence.
Unauthenticated attackers positioned on an adjacent network segment can achieve high confidentiality, integrity, and availability impact against affected HPE networking equipment, per HPE security bulletin hpesbnw05162en_us. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates the attack needs no credentials or user interaction and is low-complexity once network adjacency is established, which is the primary limiting factor; internet-wide exploitation is not implied. No CVE description, CWE mapping, or public exploit reference was supplied, and no confirmed active exploitation (CISA KEV) status is available at time of analysis.
An unauthenticated, low-complexity flaw in HPE networking equipment (reported to HPE PSIRT under advisory hpesbnw05162en_us) allows an attacker positioned on the same Layer-2 segment, VLAN, or directly-connected local network to achieve high confidentiality, integrity, and availability impact, per the assessed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector (base 8.8). No CVE description or CWE was published, so the specific feature, protocol, or configuration that must be reached to trigger the flaw is not identified in the available sources, and the 'Information Disclosure' tag is narrower than the assessed impact triad. No public exploit code or CISA KEV entry is present in the supplied intelligence, and the vulnerability is not reachable from a routable internet path - the adjacency requirement is the primary limiting factor. The vuln.today decision label places remediation in the 'this_week' queue.
A single crafted Kafka record can permanently crash-loop a Motor.NET service running any version before 0.19.0 that consumes a topic with CloudEvents message handling. The record declares content-type application/cloudevents+json but omits the mandatory CloudEvent attributes id, source and type, causing an ArgumentException inside KafkaMessageConsumer.SingleMessageHandlingAsync that the framework treats as fatal; the host stops, and because the same poison record is re-consumed on every restart, the service never recovers until the message is removed or the software is upgraded. The authoritative CVSS 4.0 vector (8.7, AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) rates this as a high-availability-impact, unauthenticated denial of service with no confidentiality or integrity exposure; the key environmental precondition is that the attacker can produce records to the consumed topic (Kafka-level produce authorization). No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released 0.19.0 as the complete fix.
The WordPress plugin MB Custom Post Types & Custom Taxonomies (MetaBox) before version 2.12.3 exposes a legacy data-migration routine that can be re-triggered by an unauthenticated remote request with no capability check, allowing the plugin's custom post type and taxonomy definitions to be rolled back to their pre-2.0 state. The flaw is only reachable on sites that were originally installed at a pre-2.0 release and then upgraded, because those installations still carry the legacy migration path and the old definition data; the practical impact is that administrator changes made after the upgrade are discarded, and where an administrator had tightened a definition's visibility, that restriction is silently removed and the definition and its content become visible to anonymous visitors. Exploitation requires this upgrade history plus admin-made post-upgrade changes (reflected in CVSS AC:H), no credentials or user interaction are needed (PR:N, UI:N), and a public PoC reference exists but is not verified as working exploit code; there is no confirmed active exploitation, and the issue is tracked at low-to-moderate priority (this_month).
Cross-site request forgery in Xpro Elementor Addons through 1.7.10 can trick a logged-in privileged WordPress user into performing unintended plugin actions; the attacker is unauthenticated (PR:N) but must persuade a victim to visit attacker-controlled content while their session is active (UI:R). Our independent assessment limits impact to low confidentiality and integrity with no availability effect, despite the supplied CVSS 3.1 score of 8.8. No public exploit code or confirmed active exploitation was identified in the provided intelligence.
Denial of service in Motor.NET before 0.19.0 lets anyone able to publish to a queue the service consumes crash it permanently by sending a message with crafted CloudEvents headers - an invalid cloudEvents:motorversion value, a header whose value is a single double-quote, or an unparsable typed attribute such as cloudEvents:time. The malformed header raises an unhandled exception in ExtractCloudEvent that the host treats as fatal; because the message is never acknowledged, the broker redelivers it after restart and the crash repeats as a permanent crash-loop. The impact is availability-only (CVSS 8.7, VA:H) and requires broker-side publish access rather than authentication to Motor.NET itself; no public exploit was identified at time of analysis.
Unauthenticated memory exhaustion in the Erlang esaml SAML library (version 0.1.0 and later) lets a remote attacker crash the hosting Erlang VM by posting a small, highly compressed SAMLResponse to a service provider's assertion-consumer (ACS) or single-logout endpoint. Because esaml_binding:decode_response/2 base64-decodes and inflates the attacker-supplied payload with zlib:unzip/1 before any signature check, a deflate stream with roughly 1000:1 amplification expands tens of kilobytes into hundreds of megabytes of binary and then gigabytes of charlist heap, so only a handful of requests are needed to take the node down. No public exploit code or confirmed active exploitation was identified at time of analysis, but the issue is trivially reachable on any internet-facing esaml service provider and upstream fix commits are already published.
Permanent denial of service in Motor.NET before 0.19.0: any party able to publish to a queue or topic that a Motor.NET service consumes can crash that service and keep it down. The service deserializes incoming payloads with JsonNetDeserializer.Deserialize, and structurally valid JSON that does not match the handler's expected type raises a JsonSerializationException that the code does not catch, so TypedConsumerService.SingleMessageConsumeAsync classifies the message as a CriticalFailure and calls StopApplication. Because the offending message is never acknowledged, it is redelivered on restart and re-triggers the shutdown, producing a crash-loop that persists until the message is removed or the library is upgraded; the CVSS 4.0 score is 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) with no confidentiality or integrity impact, and no public exploit code was identified at time of analysis.
Quadratic denial of service in Mistune's Markdown parser (parse_link_text) affects versions 3.2.0, 3.2.1 and main prior to the 3.3.0 fix: a string consisting of many unmatched opening square brackets followed by a character and many closing brackets causes repeated full forward scans, so cost grows with the square of input length. Per the Python package advisory, roughly 25 KB of brackets stalls a worker past 15 seconds on an Apple M2 and about 50 KB stretches past two minutes, letting remote attackers wedge any server-side caller of mistune.html() that renders attacker-influenced markdown, such as comment fields, web forms or federated content feeds. The CVSS 4.0 base score is 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N, high availability only), exploit code in the form of a timing benchmark is published in the advisory, and no CISA KEV entry or other active-exploitation signal is present in the supplied data.
Denial of service in the PhpSpreadsheet ODS reader allows unauthenticated remote attackers to exhaust a PHP worker's CPU and memory by loading a small crafted .ods file, terminating the process. Every maintained branch is affected - 1.x up to and including 1.30.6, 2.0-2.1 up to 2.1.18, 2.2-2.4 up to 2.4.7, 3.x up to 3.10.7 and 4.x-5.x up to 5.9.0 - whenever an application parses an attacker-supplied OpenDocument Spreadsheet using the default read filter, since no authentication or special configuration is required. A public proof-of-concept payload is documented in the vendor advisory; it is not verified as working exploit code, and no confirmed active exploitation (CISA KEV) is recorded at time of analysis.
Quadratic-time parsing in Mistune's inline link parser (all versions through 3.2.1) lets remote attackers stall server-side markdown rendering by submitting a small payload made of long runs of unmatched '[' characters. Each '[' triggers a probe of parse_link_text/parse_link_label, so work grows O(N^2): roughly 30+ seconds of CPU for a 16 KB input and proportionally worse as input grows, with the nested '[[..]]' shape costing a further ~4x. The vendor advisory reports a reproducible benchmark proof-of-concept against mistune 3.2.1 in default configuration (no plugins or options required); there is no CISA KEV listing and no confirmed in-the-wild exploitation, and the impact is CPU time only - no memory growth, no confidentiality or integrity effect - so sustained denial requires repeated requests to exhaust a worker or thread pool, most acutely on single-threaded WSGI deployments.
Quadratic-time CPU exhaustion in Mistune 3.0.0 through 3.2.1 allows unauthenticated remote attackers to tie up a rendering worker for minutes using only a few tens of kilobytes of Markdown built from unbalanced '[' or '![' characters. The flaw is reachable from every documented default entry point (mistune.html, mistune.create_markdown(...), Markdown.parse) in both the default escape=False renderer and the escape=True safe mode, with no plugin or non-default option required, so any application that renders attacker-supplied Markdown is exposed. Impact is limited to availability - no confidentiality, integrity, or cross-process effect (scope Unchanged) - and a public proof-of-concept with reproducible timing measurements exists; deployments that require authentication before accepting Markdown effectively raise the bar to PR:L (CVSS 3.1 ~6.5 per the advisory's conservative variant). No CISA KEV listing or confirmed active exploitation is reported at time of analysis; upgrading to 3.3.0 is the fix.
SmileCDR HAPI FHIR can be driven into heap exhaustion and service crashes by unauthenticated attackers who submit highly compressed payloads that are expanded during server-side decompression. The CVSS:4.0 score of 8.7 (assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) reflects an availability-only impact: no confidentiality or integrity loss, no privileges or user interaction required, but a high availability hit against network-reachable FHIR endpoints that decompress untrusted input. No public exploit code has been identified at the time of analysis and the CVE is not listed in CISA KEV; the vuln.today decision label is this_week, so treatment should be scheduled in the current patch cycle rather than treated as an emergency, and deployed instances that accept compressed request bodies should be prioritized.