Cypher injection in Flexible GraphRAG 0.6.0 through 0.8.1 lets attacker-influenced document content reach FalkorDB queries when GRAPH_BACKEND=langchain and GRAPH_DB=falkordb are configured. A crafted ingested document can steer the extraction model into producing malicious entity or relationship values, and the broken _escape() helper fails to neutralize a quote, allowing injected Cypher clauses to modify or delete graph data and, if the calling code surfaces query results to the user or LLM, disclose graph data. The assessed vector is CVSS 3.1 7.1 with AC:H, PR:L and UI:R; the maintainer demonstrated a proof-of-concept against a live FalkorDB instance that deleted every node, and the vendor released 0.8.2 with parameterized queries and backtick stripping.
Stored cross-site scripting in the ACF Extended WordPress plugin, affecting versions through 0.9.2.7, allows script content persisted in plugin-managed fields or forms to execute when a victim later views the page where that input is rendered. CVSS 7.1 reflects network reachability, low complexity, scope change, and required user interaction, with limited confidentiality, integrity, and availability impact; the privilege needed to store the payload is not confirmed in the available sources. No public exploit was identified at time of analysis.
Blind SQL injection in Frappe Framework before 16.33.0 allows any authenticated low-privilege user to submit crafted input to the frappe.desk.doctype.event.event.get_events method and infer sensitive database contents from application behavior. The defect is rated CVSS 7.1 (CVSS 4.0) and assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, meaning exploitation is network-reachable but requires a valid account and no administrator rights. No public exploit identified at time of analysis, and KEV status is not indicated.
Delegated 'Users Admin' accounts in WWBN AVideo before version 29.4.0 can delete, overwrite, or demote full administrator accounts by posting directly to confirmDeleteUser.json.php or userAddNew.json.php with an administrator's user ID, destroying that admin's videos and account in the process. The flaw is a server-side authorization gap: the interface already hides admin-row actions from non-admins, but the endpoints themselves never re-verified that the caller outranks the target, so a crafted request bypasses the cosmetic UI restriction. Exploitation requires an authenticated account holding the Permissions::canAdminUsers() delegated role, so anonymous visitors and ordinary users are not affected; no public exploit code has been identified at time of analysis and no EPSS or CISA KEV signal is present in the available data.
Traefik 2.11.0 through 2.11.57 and 3.0.0 through 3.7.13 can assign an unauthenticated attacker's frontend request to a backend socket that a legitimate user preauthenticated with Authorization: Negotiate (NTLM/Kerberos), letting the attacker read or write with the victim's identity. The root cause is Traefik's globally shared backend connection pool, which does not isolate sockets bound to a particular frontend identity; exploitation requires an active victim socket and favorable pool-reuse timing, so this is a mid-to-high priority issue for deployments fronting connection-bound Negotiate backends rather than a universal emergency. No public exploit code or CISA KEV entry is identified at time of analysis, and fixed releases are 2.11.58 and 3.7.14.
Unauthenticated clients can inherit a victim's NTLM/Negotiate-authenticated backend session in Traefik v3.2.0 through v3.7.13 when the experimental FastProxy connection pool is enabled, because pooled keep-alive backend connections are not pinned to the frontend client that originally authenticated. An attacker who lands on a reused connection after a victim completed a handshake can read that victim's data and perform actions as them on the backend, while the Traefik instance itself is not directly compromised. Exploitation is opportunistic and configuration-dependent: it requires the non-default experimental FastProxy pool, NTLM or Negotiate authentication on the backends, and a timing window in which the attacker is handed the victim's pooled connection; no public exploit code or CISA KEV entry was identified at time of analysis.
Access-control bypass in Traefik v3.7.13's Kubernetes Ingress NGINX provider allows unauthenticated remote attackers to reach ssl-passthrough Ingress backends protected by auth-type, auth-url, or whitelist-source-range annotations when a non-TLS entry point is exposed and the attacker knows the Ingress host. The flaw is configuration-gated-affected deployments must use the Ingress NGINX provider with ssl-passthrough Ingresses and a reachable plain HTTP entry point-and the bypass is silent because nothing is logged. No public exploit code or active exploitation is identified in the provided intelligence; upgrade to v3.7.14.
Incus servers that use multi-project tenancy expose in-flight operations across project boundaries because the GET /1.0/operations/{uuid} handler performs no authorization check, letting any authenticated client - including one holding a TLS certificate restricted to a single project - read operations that belong to other projects. The disclosed data includes the full command line, the process environment (where deployment tooling typically stores database passwords, API tokens and cloud credentials), the operation's websocket fd secrets and resource URLs, and, when an 'incus config trust add' operation happens to be pending, the trust-enrolment token itself, which the reporter demonstrated could be exchanged for an unrestricted certificate and full server admin. Exploitation is constrained: the attacker must already hold a project-restricted certificate and must obtain the 122-bit crypto/rand UUIDv4 of a specific in-flight operation out of band, since Incus discloses no enumeration path to a restricted client. The issue carries no CISA KEV entry or reported active exploitation; the upstream advisory includes a step-by-step reproduction sequence, which is the only published proof of concept.
Authentication bypass in Traefik Proxy 3.7.0 through 3.7.13 allows unauthenticated remote attackers to impersonate mTLS identities by supplying forged Ssl-Client-* headers (notably Ssl-Client-Verify: SUCCESS plus a chosen certificate subject and issuer) to the plaintext HTTP router. Exploitation is gated on a non-default configuration: the Kubernetes Ingress-NGINX provider must be in use, ssl-redirect must be disabled so the HTTP router is reachable, auth-tls-pass-certificate-to-upstream must be enabled so Traefik forwards client-supplied headers, and the upstream backend must trust those headers as proof of mutual-TLS identity. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the advisory (GHSA-mwrr-6hp4-pxr6) covers releases before v3.7.14.
Mutual TLS enforcement in Traefik Proxy can be bypassed, allowing unauthenticated remote clients to reach routers that are configured to require client certificates without presenting one. The flaw affects builds made with the Go 1.27 toolchain, where the request TLS state can be evaluated as nil and the SNI check is consequently skipped; an attacker sends an HTTP/2 request carrying the ':scheme http' pseudo-header over the TLS connection to sidestep certificate validation. Fixed in v2.11.58 and v3.7.14, the issue is exploitable only when an mTLS-protected router actually exists and the binary was compiled with the affected Go version, so default deployments that do not use client-certificate authentication are not exposed; no public exploit code was identified at time of analysis.
Client-certificate authentication bypass in Traefik v3.7.0 through v3.7.13 lets a holder of a certificate issued by one host's client CA reach a different host that requires its own separate client CA, while that host's legitimate clients are locked out. The defect only manifests when the Kubernetes Ingress NGINX provider is enabled and mTLS client authentication (auth-tls-secret) is configured on multiple hosts whose secret names collide once dots are normalized to dashes, causing Traefik to merge the two trust pools; the independent assessment rates this CVSS 3.1 7.4-class impact (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) because exploitability depends on that naming pattern (AT:P). No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation additionally requires the attacker to already hold a valid certificate from the colliding CA.
HPE Networking products are affected by a network-reachable, unauthenticated flaw scored 7.0 (High) under CVSS 3.1, with low confidentiality and integrity impact and high availability impact. High attack complexity means exploitation depends on conditions outside the attacker's direct control, and the supplied sources do not describe the trigger, affected feature, or exact product versions. No public exploit or CISA KEV entry is identified at time of analysis; HPE bulletin hpesbnw05162en_us is the authoritative reference for affected scope and fixes.
TLS client-configuration reuse in Traefik Proxy 2.11.0 through 2.11.57 and 3.0.0 through 3.7.13 allows an unauthenticated client to bypass a backend service's configured root CAs, SNI/server name, and certificate verification. When one backend issues an NTLM or Negotiate (Kerberos) challenge, Traefik stores the resulting round tripper in a client-connection slot that is not keyed by ServersTransport; an attacker who arms that slot can then reach a different service over the same keep-alive connection and inherit the wrong TLS client settings, undermining trust in the downstream backend rather than in Traefik itself. Exploitation is conditional - it requires connection-reuse timing, an NTLM/Kerberos-authenticating backend, and multiple services with divergent ServersTransport TLS settings behind the same proxy - and no public exploit code or active exploitation has been identified at time of analysis; vendor fixes are available in 2.11.58 and 3.7.14.
Authenticated page editors in Grav CMS 2.0.0 through 2.2.4 can abuse flex-*@ frontmatter directives to invoke Flex object methods in another editor's session when that editor opens a crafted page, allowing unauthorized deletion of protected pages. The flaw is an access-control/confused-deputy issue in FlexDirectory::dynamicFlexField() and carries a High CVSS 4.0 score of 7.0, though exploitation requires an existing page-edit account plus a second editor opening the page. No public exploit code or confirmed active exploitation was identified at time of analysis.
Predictable session identifiers in the Linksys RE6250 Web Management Interface (firmware 1.0.04.001) can expose session-scoped information because session_id values are generated with insufficient randomness and checked with strcmp. A remote, unauthenticated attacker could exploit this only by successfully predicting a valid token, a high-complexity condition; publicly available exploit code exists, and the impact is limited to low confidentiality with no integrity or availability effect (CVSS 4.0 base 6.3; assessed CVSS 3.1 C:L/I:N/A:N).
Applications using the MongoDB C# Driver (2.0.0 up to but not including 3.13.0) can be induced to write malformed BSON binary elements to the database when they parse untrusted text containing an out-of-range binary subtype value. The subtype is accepted during parsing, bypasses the library's UUID and OldBinary integrity guards, and is then narrowed to a single byte on encoding, so the persisted element misdeclares its type or length; downstream readers either error out or silently interpret the value as shorter than what was originally validated. Impact is integrity and limited availability damage from corrupted persisted data, not code execution or disclosure, and the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VI:L/VA:L) and the independent 3.1 assessment agree it is unauthenticated but low-impact. No public exploit code or active exploitation is reported in the available sources, and the vendor priority is 'this_month' rather than an emergency.
Missing GC rooting in Wasmtime 47.0.0 through 48.0.3 and 49.0.0 through 49.0.1 can leave a GC reference unrooted when it is live across a `try_call`, so a callee that triggers garbage collection can leave the reference stale or dangling and corrupt the GC heap or cause incorrect execution. Exposure is limited to embedders or CLI users who compile and run attacker-supplied Wasm with GC references and exception support enabled, both of which are on by default from v47; the assessed impact is primarily availability (C:N/I:N/A:H) even though one source also tags information disclosure. No public exploit code has been identified at time of analysis, and the vendor has released fixes in 48.0.4 and 49.0.2.
A BSON length-parameter inconsistency (CWE-130) in the MongoDB C# Driver prior to 3.13.0 lets unauthenticated remote attackers inject or remove elements in database commands issued by applications that build raw or lazy BSON documents from externally supplied binary data. Because the pre-fix driver copies the attacker's mismatched length prefix onto the wire verbatim instead of validating it against the actual buffer size, the server parses the excess or truncated elements as part of the command, enabling unauthorized modification and out-of-scope disclosure of stored data bounded by the application's own database privileges. Exploitation depends on that specific application coding pattern rather than on any authentication or user-interaction barrier (PR:N, UI:N); no public exploit code or KEV listing was provided, and the fix is the vendor's 3.13.0 GA release.
Missing authorization in the EverShop customer address API lets remote requests without credentials (PR:N) perform POST, PATCH and DELETE operations against /api/customers/:customer_id/addresses, so saved shipping addresses belonging to other customers can be added, modified or deleted. Only EverShop releases from 1.2.2 up to but not including 2.2.1 are affected, and exploitation is not opportunistic: the attacker must already know a valid customer_id plus the target address UUID, which are random rather than sequential and therefore not feasible to guess, making this a targeted IDOR-style attack that depends on prior knowledge or leakage of those identifiers. Impact is limited to address-record integrity and availability, with no confidentiality read path described in the available sources; no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, while the vendor has released a fix in v2.2.1.
Arbitrary file write on the Incus CLI host occurs when an operator runs 'incus file pull -r' against a virtual machine whose in-guest incus-agent has been replaced with a malicious build; the agent returns the same directory entry name twice, first as a symlink and then as a directory or regular file, so the client recursively creates or writes through the link it just made and lands outside the intended target directory. Affected releases are Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0, and only VM-served transfers are exposed because container transfers are handled by forkfile on the host rather than by an in-guest agent. This is a genuine but conditional integrity threat rather than a mass-exploitation emergency: the attacker must already hold root inside the guest VM (the assessed vector is PR:L) and the operator must voluntarily run a recursive pull from that specific compromised VM (UI:R), with final impact bounded by the operator's privileges on the CLI host; no public exploit has been identified at time of analysis and there is no CISA KEV entry.
Grav CMS 2.0.0 through 2.2.4 lets page authors harvest visitors' HTTP Basic authentication credentials - including administrator usernames and passwords - by rendering the request Uri object, which embeds PHP_AUTH_USER and PHP_AUTH_PW, into page content such as an inline style background image that beacons the captured values to an external host. Exploitation is precondition-heavy: the site must actually be protected by HTTP Basic auth so those PHP variables are populated, the attacker must already hold a page-author account permitted to write raw Twig/HTML page content (PR:L), and a credential-bearing victim such as an administrator must actively view the authored page (UI:P) before their browser issues the outbound request. No public exploit code was identified at time of analysis, and the vendor addressed the flaw in Grav 2.2.5; the assessed severity is moderate (CVSS 4.0: 6.9; CVSS 3.1: AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) rather than an unauthenticated remote compromise.
CPython's tarfile.tar_filter extraction filter can be bypassed with crafted link members, allowing a malicious tar archive to redirect subsequent members and write files outside the chosen destination directory, with the impact limited to the permissions of the extracting process. Only code that explicitly calls extractall() or extract() with filter="tar" is affected; the stricter data_filter was already hardened against this class of attack by CVE-2026-7774. The source CVSS 4.0 score is 6.9 (integrity-only, unauthenticated per PR:N), vuln.today rates it this_month rather than act_now/emergency, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Supply chain compromise is possible in CloudPirates Open Source Helm Charts prior to commit 271d415, where pull_request_target workflows check out attacker-controlled fork code with base-repository privileges and also write to an Actions cache that release or publish jobs later restore. An attacker able to open a pull request from a fork could exfiltrate repository secrets, tokens and deploy keys, or plant a poisoned cache entry that executes during a release, enabling publication of malicious chart artifacts. The issue is fixed by commit 271d415; there is no CISA KEV entry and no public exploit code identified at time of analysis, but the disclosed pattern mirrors the TanStack supply chain compromise and the current triage label places it at this-month priority, with the caveat that GitHub's default approval requirement for first-time fork contributors (reflected in UI:R) blunts drive-by exploitation.
Denial of service in Wasmtime: Cranelift-compiled `call_ref` callsites and the exceptional catch path of `try_table` mishandle fuel accounting, so a crafted guest can drop the fuel consumed inside a callee and reset to the pre-call remaining balance, letting it run for exponential time on linear fuel and evade timeouts and periodic yields. Exposure is gated hard by configuration - fuel metering is off by default (Config::consume_fuel or -W fuel=N on the CLI), the Cranelift backend must be used (the default unless Winch is configured, and it also covers Pulley interpreter users), and the guest must actually contain the `call_ref` or `try_table` opcode. Only Wasmtime 47.0.0 through 48.0.2 and 49.0.0 are affected; 48.0.3 and 49.0.1 contain the fix, no public exploit was identified at time of analysis, and the vendor rates this medium severity at CVSS 4.0 6.9 (CWE-400 uncontrolled resource consumption).
Authentication bypass in Traefik deployments that enforce mutual TLS can let unauthenticated remote clients reach backends protected by RequireAndVerifyClientCert when an !Host() router rule creates a TLS-options conflict and Traefik falls back to default options without certificate verification. Affected releases are before 2.11.58 and 3.7.13, and exploitation requires the non-default combination of client-certificate enforcement plus a negated Host matcher. No public exploit identified at time of analysis.
Authentication bypass in NT OneAPP allows an attacker with local access to a logged-in device to circumvent the App PIN lock via a crafted Deep Link and reach protected app resources. The flaw requires the victim to already have an active authenticated session protected only by the PIN, so it defeats the at-rest PIN barrier rather than full account authentication and is not remotely exploitable. There is no public exploit identified at time of analysis and no CISA KEV entry in the provided data; the independent assessment classifies the issue as moderate risk rather than high priority.
Wasmtime's wasmtime-wasi-http crate fails to enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP bodies, so a malicious guest module can write buffers far larger than the advertised ~1M chunk allowance and have the host keep those allocations for the lifetime of the guest's store, exhausting host memory. Hosts that embed wasmtime-wasi-http and expose the wasi:http interface to untrusted guests and that run Wasmtime before 36.0.16, 37.0.0 through 48.0.2, or 49.0.0 are affected; impact is limited to availability, with no confidentiality or integrity effect. Vendor-released patches exist in 36.0.16, 48.0.3 and 49.0.1, and no public exploit has been identified at time of analysis.
Host process abort in Wasmtime's wasmtime-wasi crate (WASIp3, default-supported since 46.0.0, fixed in 48.0.4 and 49.0.2) lets a guest crash the Unix host by calling set-times or set-times-at on wasi:filesystem/types.descriptor with a negative seconds value, i.e. a timestamp before the Unix epoch. Only guests that have been given a preopened directory descriptor with mutable access can reach the faulty conversion path - read-only preopens are unaffected, WASIp1/WASIp2 are not vulnerable, and Windows hosts are explicitly unaffected. Per the supplied CVSS vector the trigger is unauthenticated with no user interaction (PR:N/UI:N), and the impact is availability-only (VA:H); no public exploit code or active exploitation has been identified at time of analysis, and the vendor states there are no known workarounds.
Client-side field-level encryption (CSFLE) in the MongoDB .NET/C# driver silently writes fields that should have been encrypted as plaintext when the process runs under certain platform text-encoding configurations, because an internal name conversion loses information and the operation is never matched to its configured encryption rules. Affected are driver versions from 2.10.0 up to but not including 3.13.0, and only deployments that actually have CSFLE configured and in use; an application user able to write data through such an application can cause sensitive fields to be persisted unencrypted with no error raised. There is no integrity or availability impact, no public exploit identified at time of analysis, and the issue is resolved in driver release 3.13.0.
Local users or processes on managed macOS endpoints running WatchGuard Endpoint Security with Full Disk Encryption can read the FileVault Personal Recovery Key from a world-readable diagnostic log, exposing full-disk-encryption recovery material. Exploitation requires only an existing local foothold and no privileges or user interaction; endpoints not enrolled in the FDE feature are unaffected. No public exploit code or CISA KEV entry was identified at time of analysis.
Denial of service via unbounded host memory allocation affects Wasmtime 46.0.0 through 46.0.2 and 47.0.0 through 47.0.3 when a malicious guest writes to WASIp3 file or HTTP streams; the host copies and buffers the entire guest-specified length, limited only by guest linear memory, so host availability can be exhausted. The issue is fixed in 46.0.3 and 47.0.4, and the independent assessment scores it availability-only with PR:L and AT:P/UI:P because the host must expose those streams and run untrusted guests. No public exploit identified at time of analysis, and the vuln.today priority label is this_month.
Guest WASI programs running under Wasmtime can crash the host runtime by supplying a filesystem timestamp whose sub-second field overflows into the seconds field, driving the Rust `std::time::Duration::new` construction into a panic and taking down the host process (denial of service only, with no confidentiality or integrity impact). Affected are wasmtime-wasi releases before 36.0.16, 37.0.0 through 48.0.3, and 49.0.0; the flaw is reachable only when the embedder actually runs untrusted guest code and has granted it WASI filesystem access reachable by the time-setting calls, so hosts executing only trusted first-party modules or withholding set-times capability are not realistically exposed. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified at time of analysis; the vendor has released fixes in 36.0.16, 48.0.3, and 49.0.1.
KNIME Business Hub releases prior to 1.18.5 leak workflow names to authenticated remote users through overly informative error messages returned by the platform's catalog functionality, but only when the attacker already knows the internal workflow identifier. Impact is confined to confidentiality - no integrity or availability effect - and there is no public exploit identified at time of analysis. The vendor states a workaround is not possible, so upgrading to 1.18.5 is the only remediation; the issue is scored by the vendor at 6.9 under CVSS v4.0, while the independent assessment places it at CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, consistent with routine, this-month patching rather than an emergency response.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 can misresolve an authenticated alias login to a user account on a different IMAP host in multi-host installations, exposing another mailbox's confidentiality and integrity. The flaw requires an authenticated login using an alias address that collides with an identity record on another IMAP host, so single-host deployments and installations without cross-host alias collisions are not affected. No public exploit has been identified at time of analysis, and the vendor has released fixed versions 1.6.20 and 1.7.5.
Password changes in Roundcube Webmail can be applied to the wrong mailbox when the password plugin uses the Modoboa driver, affecting releases before 1.6.20 and 1.7.x before 1.7.5. An authenticated Roundcube user can trigger this over the network, but exploitation is conditional on the Modoboa API account search returning another account first, so it is opportunistic rather than reliable. No public exploit was identified at time of analysis; vendor patches are available in 1.6.20 and 1.7.5.
Authlib's default RFC 7523 JWT bearer grant, in all releases prior to 1.9.0, fails to bind an incoming JWT assertion to the authorization server that receives it, because JWTBearerGrant.get_audiences() returns an empty list and verify_claims() therefore only checks that an aud claim is present rather than that it matches the server's token endpoint. An attacker who already holds a legitimately issued assertion for a different audience (obtained as a low-privilege principal) can replay it against a second authorization server that uses the default grant and shares the same JWT signing key, and receive an access token across that trust boundary. Exploitation requires all three conditions to hold - default grant without a get_audiences() override, shared signing key material, and a valid assertion for some other audience - so implementations that override get_audiences() with their own audience identifiers are explicitly not affected; the issue is not listed in CISA KEV and no in-the-wild exploitation is reported, although the vendor advisory includes a proof-of-concept script that demonstrates the bypass against Authlib's own Flask test fixtures.
HPE networking devices are affected by a moderate-severity flaw (CVSS 6.8) that an attacker on an adjacent network can trigger only after obtaining high administrative privileges; no user interaction is required and attack complexity is low. The supplied score indicates high confidentiality, integrity, and availability impact, although the source tag labels the issue as information disclosure and the affected versions and triggering feature are not identified in the available data. No public exploit identified at time of analysis.
Physical access to certain HPE networking devices can be used to read sensitive data and to alter or disrupt the device, with high confidentiality, integrity, and availability impact once an attacker has hands-on access. The CVSS 3.1 score is 6.8 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): no credentials or user interaction are required, but the physical-access prerequisite sharply limits exposure to unattended, field-deployed, or physically insecure hardware. The HPE advisory hpesbnw05162en_us is the only reference supplied; no public exploit was identified at time of analysis, and the specific hardware interface or feature abused is not described in the available sources.
Ghidra releases before 12.2 extract extension ZIP archives without any cap on entry count, so a crafted archive containing a very large number of files can exhaust the local filesystem's inode pool and cause project writes, index flushes, and other host processes to fail. The flaw is availability-only: no confidentiality or integrity impact is assessed, and no credentials are needed, but an attacker must first persuade a victim to install the malicious archive through Ghidra's extension installer (local access plus user interaction). No public exploit code has been identified at time of analysis, and the aggregated signals place this at a 'this_month' priority rather than an emergency; the vendor-released patch is Ghidra 12.2.
Disk-space exhaustion in Ghidra 10.3 through 12.1 lets a crafted theme ZIP fill the host filesystem through the theme importer's icon extraction path. When a user is persuaded to import the archive, icon entries in the image/ subdirectory are written to ~/.config/ghidra/Ghidra*/images without any cap on decompressed size or compression ratio, so a small archive can expand until the partition is full, after which theme imports and other disk-writing applications fail. The flaw is availability-only - no code execution, privilege gain, or data disclosure - and there is no public exploit identified at time of analysis; exploitation requires local interaction with the import feature and user interaction, giving it a medium-severity, this-month remediation priority rather than emergency status.
Inode and disk-space exhaustion in Ghidra 10.3 through 12.1 allows an attacker who can convince a user to import a crafted theme ZIP archive to fill the host filesystem, causing Ghidra's own theme imports and other disk-dependent operations to fail. The flaw sits in ThemeReader.readZipTheme(), which extracts every entry under the archive's image/ directory into ~/.config/ghidra/Ghidra*/images without counting entries or bounding total size; an archive containing a very large number of tiny icon files drains the inode pool. The trigger is local and gated on user interaction (the victim must actively import the untrusted theme), so there is no remote or unauthenticated path, and the impact depends heavily on the target filesystem's free inodes and disk space. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the upstream fix commit caps extracted icon entries at 3000 and Ghidra 12.2 ships that cap.
Heap exhaustion in Ghidra's GZF packed-database import path can crash the JVM when a user or automated headless pipeline opens a crafted DB file whose BinaryField length is set to an arbitrarily large value. The issue is local and requires the victim to import the file; impact is availability-only (OutOfMemoryError, aborted import, and loss of unsaved work), and the supplied data records no public exploit at time of analysis. Version scope is conflicting across sources: the GHSA lists vulnerable versions below 12.2 with the fix in 12.2, while the NVD description and independent assessment refer to Ghidra through 12.2.
Disk-space exhaustion in NSA's Ghidra reverse-engineering suite affects every release before 12.2: the extension installer extracts attacker-supplied ZIP archives into ~/.config/ghidra/Ghidra*/Extensions without any cap on decompressed entry size, per-file size or compression ratio, so a small crafted 'zip bomb' extension can fill the host partition and cause later Ghidra writes and other applications' writes to fail. Exploitation is local and requires the victim to be persuaded to install the malicious archive through File > Install Extensions (the CVSS 4.0 vector is AV:L/AC:L/PR:N/UI:P with availability-only impact), and no public exploit code has been identified at the time of analysis - the practical risk is a social-engineering-driven denial of service rather than remote compromise. A vendor-released patch in Ghidra 12.2 adds a secure extractor that enforces a 100 MB per-entry limit, a 1 GB total limit and a 100:1 decompression ratio threshold.
Java heap exhaustion in Ghidra before 12.2 allows a crafted TAR or ZIP archive with an excessive number of entries to freeze the application when a user opens or batch-imports it. The archive mount code stores every entry through FileSystemIndexHelper without an entry-count limit, so a relatively small file with a huge entry count can block the UI thread and degrade the host until the process is forcibly terminated. Exploitation requires local file delivery and user interaction; no public exploit was identified at time of analysis, and the vendor has fixed the issue in Ghidra 12.2 by enforcing a 500,000-entry cap.
Broken access control in the MasterStudy LMS WordPress plugin (versions 3.7.13 up to but not including 3.7.55) lets an authenticated user who holds the Instructor role rename any account on the site - first name, last name and public display name - including administrator accounts, opening the door to impersonation and phishing. The plugin's student-enrolment feature does not check that the targeted user has any relationship to the requesting instructor, so the only barrier is obtaining Instructor-level access; there is no confidentiality or availability impact and no ability to change credentials or privileges. Severity is low (assessed CVSS 2.7, PR:L), there is no CISA KEV entry or other signal of active exploitation, and a public PoC reference exists but is not verified as working exploit code; priority is monitor.
The MB Custom Post Types & Custom Taxonomies plugin before 2.12.3 allows any authenticated WordPress user with the Contributor role to use its export feature without a capability check, disclosing admin-only custom post type and taxonomy configuration plus titles, dates, statuses and some stored content from other users' non-public posts and pages. Impact is read-only and low severity, and exploitation requires a valid low-privilege account on an affected site. A public PoC reference exists, but it is not verified as working exploit code.
Anyone able to read crawlseo's backing Postgres database before version 0.2.5 can pull every registered user's Google access and refresh tokens in plaintext from the User.googleTokens column, then use the long-lived refresh tokens to retain indefinite access to those users' Google Search Console data. Version 0.2.5 closes the exposure by encrypting Google tokens at rest with the same key used for API keys (NEXTAUTH_SECRET or AUTH_SECRET). The weakness is a post-compromise confidentiality issue (CWE-312) that presupposes database-level access rather than a remotely triggerable flaw in the running app; no public exploit has been identified at time of analysis.
NT OneAPP stores account usernames and passwords in cleartext within Android backup data, so an attacker with local device access can extract credentials after initiating an ADB backup and obtaining the user's on-device confirmation. The issue is tracked as CWE-312 and rated 6.7 under CVSS 4.0, but the chain requires local access, reachable ADB/USB debugging, and explicit user approval, keeping real-world risk low to moderate. No public exploit was identified at time of analysis.
CPU and memory exhaustion in fpdf2 2.5.0 through 2.8.7 lets remote attackers who can submit SVG data to FPDF.image() stall or crash PDF generation workers with a sub-1 KB payload. Nested SVG <use> references are expanded by deep-copying the entire referenced graphics tree at every level, so a handful of groups that each re-reference the previous group produces exponential object growth; the advisory's reproduction (an 895-byte SVG) pinned a process for roughly 14 seconds under a 128 MB address-space limit before raising MemoryError. No public exploit tooling or active exploitation has been reported and the priority label is this_month, but a public proof-of-concept reproduction is included in the advisory; ResourceAccessPolicy does not mitigate it because all references are inline, and the issue is fixed in 2.8.8.
Arbitrary file deletion in ACF Extended through 0.9.2.7 allows a low-privileged authenticated user to use path traversal sequences to remove files outside the intended directory on a WordPress host, affecting integrity and availability without direct confidentiality loss. The flaw is a CWE-22 path traversal reported by Patchstack and rated CVSS 6.5; the vuln.today decision framework places it in the 'this_month' remediation queue rather than emergency action. No public exploit code or active exploitation is identified at time of analysis, and the specific vulnerable endpoint and trigger are not described in the supplied sources.