Stale AF_XDP buffer release in the Linux kernel mlx5e driver can free XSK frames twice when an MPWQE refill on a striding RQ returns -ENOMEM and a later NAPI poll retries the same WQE, potentially reaching XSK buffers that have already been reallocated. The issue affects systems using NVIDIA/Mellanox ConnectX hardware with AF_XDP zero-copy on mlx5e; the assessed vector is local, high complexity, low privileges (AV:L/AC:H/PR:L/UI:N), so the raw CVSS 9.8 network score overstates practical risk. Vendor patches are available, EPSS is 0.22% (12th percentile), and no public exploit is identified at time of analysis.
Deserialization of attacker-supplied pickle data in the deprecated pandas packaged builder of Hugging Face Datasets (all versions through 5.1.0) lets a crafted dataset file run arbitrary Python in the victim's process when it is loaded via datasets.load_dataset("pandas", data_files=...). The attacker needs no credentials but does need the victim to actively point the loader at the malicious .pkl/.pickle file, and the builder emits a FutureWarning that it is deprecated; the resulting code executes with the privileges of the loading process, giving high confidentiality, integrity and availability impact. A public PoC reference exists but is not verified as working exploit code, there is no confirmed active exploitation, and the vendor fix (pull request 8879) hard-disables pickle loading in this builder; priority guidance places remediation in the current week rather than as an emergency.
Google ADK for Java's development web server (ADK Web) accepts cross-origin connections by default, letting a malicious web page drive a locally running agent and read its data. The /run_live WebSocket endpoint allowed any origin (hardcoded setAllowedOrigins("*") in 0.1.0-1.5.0, default * via adk.web.cors.origins in 1.6.0-1.12.0) and, since 0.4.0, the REST API returned Access-Control-Allow-Origin: *; combined with the absence of authentication, a developer who visits an attacker-controlled page while the server runs can have tools triggered, responses streamed, and sessions and artifacts listed, read, created or deleted. Unauthenticated remote exploitation is possible per the CVSS vector (PR:N) but requires passive user interaction (UI:P) - the developer must open the malicious page while the dev server is up; a public PoC reference exists (GitHub issue 1257) but it is not verified as working exploit code, and no confirmed active exploitation was reported. Exposure is limited to a developer-facing dev server rather than a production service, and the complete fix is version 1.13.0.
Unauthenticated server-side request forgery in MLflow 3.12.0rc0 through 3.16.x lets remote attackers make the tracking server issue outbound HTTP requests to an arbitrary attacker-chosen host, including internal services or cloud-metadata endpoints, with attacker-controlled headers and body. The flaw is reachable through the scorer invoke, register, and GenAI evaluate endpoints (notably POST /ajax-api/3.0/mlflow/scorer/invoke), and is only exploitable when the optional trulens and trulens-providers-litellm packages are installed in the server environment; a model URI outside MLflow's native provider registry forces the LiteLLM fallback that forwards raw api_base and api_key values. It is fixed in MLflow 3.17.0. No CISA KEV listing or confirmed active exploitation exists, and the vendor advisory ships a public proof-of-concept script that has not been independently verified here as working exploit code; the vuln.today decision label places it in the current month's remediation cycle rather than the emergency queue.
Wasmtime versions before 36.0.19, and the 37.0.0 through 42.x line, can silently miscompile attacker-supplied WebAssembly because Cranelift's SSA value-index packing overflows in release builds, letting a specially crafted or very large function make the compiler reference the wrong IR value and produce type confusion that may cross the Wasm sandbox boundary on any architecture using the default Cranelift backend. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) reflects that a low-privileged position plus control of the compiled module is enough to reach a scope-changing impact, and the flaw is only reachable when the host actually compiles untrusted guests; hosts that only run first-party modules are not exposed. The vendor has released 36.0.19 and 43.0.0, and the priority label is act_now, though no public exploit has been identified at time of analysis.
Postiz (gitroomhq/postiz-app) before v2.25.1 allows any signed-in user to invoke arbitrary internal integration methods through the POST /integrations/function endpoint, using a connected channel's token as the first argument. By setting that token to a filesystem path, an attacker can read server files such as the application environment, exposing the session-signing secret, database address and third-party service credentials; a separate internal helper can terminate the backend process with one request. Self-registration is open by default, so an external attacker can obtain the required low-privilege account without any action by another user, and no public exploit code has been identified at time of analysis.
PHP object injection in the AivahThemes Hostme v2 WordPress theme (all versions through 7.0) allows unauthenticated remote attackers to pass serialized data into a PHP unserialize() sink, which can lead to arbitrary object instantiation and, where a usable gadget chain exists, code execution or full site compromise. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) confirms no authentication or user interaction is required, so any site running the theme with the affected code path active is exposed. A public PoC reference exists in the Patchstack advisory; it is not verified as working exploit code, and no CISA KEV entry indicates confirmed active exploitation. The precise request parameter or endpoint that reaches the sink is not described in the available sources, and no fixed version is listed in the evidence.
PHP object injection in the axiomthemes Holistic Center WordPress theme through 1.2.6 exposes a deserialization path for attacker-controlled serialized input, and the input assigns CVSS 9.8 with an act_now priority. The independent assessment records AC:H because concrete impact depends on a usable POP or magic-method gadget chain in the theme, WordPress core, or co-installed plugins, and the supplied sources do not identify the vulnerable sink, exact trigger, or a working chain. No public exploit is identified at time of analysis, and exposure is limited to sites running this theme at an affected version.
PHP object injection through deserialization of untrusted data affects the ThemeREX ZenSoul WordPress theme at all versions through 1.13, exposed over the network with a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) per the supplied vector. The available sources do not identify the specific endpoint, parameter, or theme feature that reaches the unsafe deserialization, nor whether a usable POP gadget chain exists in the theme, WordPress core, or installed plugins - a factor that typically governs whether object injection escalates to code execution, file operations, or data disclosure. No confirmation of active exploitation (CISA KEV) or verified working exploit code was provided; a public reference exists at the Patchstack vulnerability database entry, and the site's priority label is act_now.
PHP object injection in the ThemeREX Save Life WordPress theme through version 1.2.14 lets remote attackers route crafted serialized data into an unsafe unserialize() path, scored 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with high confidentiality, integrity and availability impact. The specific feature, parameter or endpoint that reaches the deserialization sink is not described in the available sources, and a usable POP gadget chain in the theme, an installed plugin or WordPress core is unconfirmed, so realized impact may be narrower than the score implies. No CISA KEV entry or public exploit code is associated with this CVE in the supplied intelligence, although the vuln.today decision label is act_now.
PHP object injection in the ThemeREX Group HotLock WordPress theme through version 1.3.9 can let an attacker who reaches a deserialization sink supply serialized data that instantiates arbitrary PHP objects, with severe confidentiality, integrity and availability impact if a usable gadget chain is loadable. The CVSS vector rates the issue 9.8 with network reachability, no required privileges and no user interaction, although the specific vulnerable feature or parameter is not described in the provided sources and the unauthenticated path should be confirmed against the Patchstack advisory. No public exploit was identified at time of analysis, and the act_now priority rests on limited sourcing rather than confirmed exploitation.
PHP object injection in the ThemeREX 'Vagabonds' WordPress theme (all versions through 1.3.10) lets remote unauthenticated attackers pass untrusted serialized data into PHP's unserialize() path, carrying a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and full High confidentiality, integrity and availability impact per the assessed vector. The concrete endpoint or parameter that feeds attacker data into the unserializer is not described in the available sources, and real-world impact - code execution, file read/write, or denial of service - depends on a usable POP gadget chain being reachable in the theme, an installed plugin, or WordPress core, which is not confirmed in the data. Exploitation presupposes the Vagabonds theme is installed and active at version 1.3.10 or below; no public exploit code has been identified at time of analysis, and the issue carries an act_now priority label from the reporting intelligence.
PHP object injection in the Axiomthemes Rhodos WordPress theme, affecting versions through 1.3.3, allows remote attackers to feed untrusted serialized data into a PHP unserialize() sink; the supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N with 9.8 severity, so no authentication or user interaction is required per those metrics. Beyond the injection itself, meaningful impact depends on whether a usable POP gadget chain is loadable in the theme or in co-installed plugins, which the available sources do not confirm; the trigger endpoint, parameter and configuration are not described in the available sources. No CISA KEV entry or confirmed public exploit is indicated at time of analysis, and the vuln.today decision label is act_now based on the Patchstack report.
PHP object injection in ThemeREX Group's Little Birdies WordPress theme, affecting all versions through 1.3.16, lets unauthenticated remote attackers feed attacker-controlled serialized data into an unsafe deserialization sink reachable over the network, carrying a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N) with full confidentiality, integrity and availability impact in the assessed worst case. The realistic ceiling depends on gadget availability: object injection only escalates to code execution or comparable compromise where a usable POP chain exists in the theme, an installed plugin or WordPress core, and without one the practical impact may be well below the headline rating. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the vendor-neutral Patchstack disclosure and the act_now priority label make this a patch-now item for any site running the theme.
PHP object injection in the Axiomthemes Redy WordPress theme through version 1.3.5 lets unauthenticated remote attackers pass untrusted data into a deserialization path, rated 9.8 under the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). Whether object instantiation converts into concrete impact such as file write, SQL injection or code execution depends on a usable POP gadget chain being present in the theme, WordPress core or an installed plugin; the specific vulnerable feature, parameter or configuration is not described in the available sources. Patchstack reported the issue and the CVE org record points to its advisory, while the priority decision is act_now; no KEV listing, no confirmed public exploit code and no EPSS value were supplied, and no fixed version is listed in the available evidence.
Authentication bypass in WizLearn LMS, rated CVSS 9.8, allows an unauthenticated remote attacker to circumvent both password-based login and the OAuth flow with a crafted POST request, potentially taking over user accounts and gaining administrative control of the platform. The affected release range is not established in the available data because the CPE version is a wildcard, so organizations should confirm vulnerable versions against the CSA advisory. No public exploit identified at time of analysis.
Sandbox escape in Wasmtime on aarch64 lets a user-supplied WebAssembly module redirect an oversized br_table branch to attacker-chosen code when the default Cranelift backend compiles a table with more than roughly 256,000 targets. The flaw affects Wasmtime/Cranelift builds supporting aarch64 since 2020 up to the fixed releases 36.0.19, 48.0.7, and 49.0.4; x86-64 engines and non-Cranelift backends are outside the affected configuration. CVSS 9.9 reflects scope change with high confidentiality, integrity, and availability impact, and the issue carries an act_now priority; no public exploit was identified at time of analysis.
Code injection into the conda/conda GitHub Actions update workflow lets a remote attacker run attacker-controlled Jinja2 template content inside a job that holds the privileged secrets.SYNC_TOKEN, by opening a fork pull request and commenting the exact string '@conda-bot render'. The pre-fix .github/workflows/update.yml triggered on issue_comment, resolved the PR head repository and branch from the PR API, checked that PR-controlled ref out using SYNC_TOKEN, and then ran the pinned conda/actions/template-files@7f6830b action, which loads .github/template-files/config.yml and templates from the checked-out working directory and renders them with an unsandboxed jinja2.Environment. The workflow is triggered from a repository-scoped comment handler where no maintainer approval, author-association check, allowlist, or label gate exists, and the only guard present ('!github.event.repository.fork') checks whether the base repository itself is a fork rather than rejecting fork-originating PRs, which is the core defect. The issue is fixed in commit 9c0f23857282ff5cf7a6b3ad6bf0dd6f9974be55, which removes the issue_comment/render path entirely; there is no CISA KEV entry and no public exploit identified at time of analysis, though the advisory itself includes a maintainer-side validation procedure that is a public PoC reference and is not verified as working exploit code.
PHP object injection (CWE-502 deserialization of untrusted data) in xnau webdesign's Participants Database plugin for WordPress, affecting versions through 2.7.8.5, lets remote attackers supply serialized input that the plugin unserializes, with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) reflecting no authentication or user interaction requirement against a reachable site. The vulnerability is rated act_now by vuln.today priority and reported by Patchstack, though no CISA KEV entry and no public exploit code were identified at time of analysis. Real-world impact depends on whether a usable POP gadget chain exists in the plugin, WordPress core, or another installed plugin; the available sources do not describe the trigger or confirm such a chain, so consequences may vary between installations.
Stale XSK buffer bookkeeping in the Linux kernel's mlx5e driver lets a buffered WQE pointer be freed a second time and the same UMEM frame published twice on AF_XDP zero-copy sockets, producing silent data-integrity and limited information-disclosure effects within the socket's own memory region rather than a crash. Only hosts using Mellanox/NVIDIA ConnectX-class hardware, an XDP program redirecting to an AF_XDP zero-copy socket, and the legacy cyclic RQ mode are affected, and the condition requires an RX ring that fills under sustained high-rate traffic followed by a partially successful batched refill; the published CVE record carries a 9.8 network-vector score, while the locally assessed vector (AV:L/AC:H/PR:L/UI:N/C:L/I:L/A:N) reflects that the feature is off by default and hardware-gated. No public exploit or PoC has been identified at time of analysis and EPSS is 0.21% (10th percentile), so there is no confirmed active exploitation despite the act_now triage label.
A metadata-corruption bug in the Linux kernel's btrfs extended-attribute handling lets a local user who can call setxattr(2) on a file stored on a btrfs volume leave a newly inserted btrfs_dir_item partially initialized, which the tree checker later flags at extent-buffer writeback and which ultimately aborts the transaction. Two conditions must line up: two xattr names must share a crc32c hash so they are packed into one btrfs_dir_item, and the value of one of them must be replaced with a value of a different size. The published CVSS 9.8 (AV:N/AC:L/PR:N) does not reflect the mechanism - there is no network-reachable path; the realistic vector is local, low-privileged (AV:L/AC:L/PR:L, C:L/I:L/A:H), so exposure is confined to hosts running btrfs with untrusted local writers. EPSS is low at 0.21% (10th percentile), the issue is not in CISA KEV, and a reproducer script from the fix commit is public; it is not verified as working exploit code. The prioritisation label is act_now and vendor fixes are available.
Unauthenticated path traversal in Goobi viewer allows a malicious HTTP server to supply an absolute path or ../ sequences in a Content-Disposition filename, causing the Tomcat process to write attacker-controlled content to any path it can write, including the deployed web application directory, which yields remote code execution as the tomcat OS user. Versions 24.03 through 26.04 are affected and 26.05 contains the fix. No public exploit identified at time of analysis, but the vulnerable download flow is reachable without authentication when the viewer fetches external resources.
Goobi viewer 24.03 through 26.04 exposes the DownloadTaskEndpoint WebSocket at /tasks/download/monitor.socket to unauthenticated users, so a remote attacker can drive the server's download machinery without credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Depending on network reachability, that yields server-side request forgery against internal hosts such as the local Solr instance or cloud instance-metadata endpoints, retrieval of local files whose extensions fall inside the application's allow-list, and deletion of the Solr index through the Core Admin UNLOAD action, which leaves the viewer unavailable until a full re-index. The vendor scored the issue 9.8, while the independent assessment keeps the unauthenticated network vector but lowers integrity impact from high to low; no public exploit identified at time of analysis. Vendor-released patch: 26.05.
PHP object injection in the axiomthemes Hallelujah theme (all versions through 1.1.1) lets remote, unauthenticated attackers feed untrusted serialized data into a PHP deserialization sink, and the CVSS 3.1 score of 9.8 reflects high confidentiality, integrity and availability impact with no privileges or user interaction required. The single available reference, the Patchstack vulnerability entry, does not name the parameter, endpoint or theme feature that reaches the unserialize() call, and it is not confirmed whether a usable POP gadget chain exists in the theme, WordPress core or a co-installed plugin. No CISA KEV entry and no public exploit code were identified at time of analysis, while the vuln.today decision label is act_now, so the incomplete exploitability picture rather than a demonstrated attack is what drives urgency.
PHP object injection in the axiomthemes Reprizo WordPress theme, versions through 1.0.8, lets remote attackers supply serialized data that the theme passes to an unsafe deserialization call, potentially leading to object injection in the WordPress runtime. The vendor-assigned CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the priority decision is act_now given the network-reachable, pre-auth vector claimed by the score; only sites running this specific theme at 1.0.8 or earlier are in scope. No public exploit or proof-of-concept has been identified at time of analysis, the issue is not in CISA KEV, and realistic impact hinges on whether a usable POP gadget chain exists in the theme or an accompanying plugin, which the available sources do not confirm.
Unauthenticated remote clients can enumerate the agents deployed on PraisonAI's AgentOS FastAPI surface and invoke them directly, because GET /api/agents and POST /api/chat are registered with no authentication and AgentOSConfig defaults the bind host to 0.0.0.0. This is an incomplete-fix exposure: the previously published patch for GHSA-pm96-6xpr-978x / CVE-2026-40151 (4.5.128) still accepts both no-credential and wrong-bearer requests, as do releases through 4.6.57 and current main, with the advisory's reproducer showing the chat route executing agent.chat() as an observable side effect. PraisonAI 4.6.59 is the version that closes the gap, and the issue is rated act_now because the default configuration puts an agent-control endpoint in reach of any network client, with consequences scaling to whatever tools, memory, private context, API integrations or paid model calls the deployed agents have. A public PoC reference exists in the advisory but is not verified as working exploit code, and no confirmed active exploitation is indicated in the available intelligence.
Adjacent-network attackers can bypass firmware image verification in the Creative Sound Blaster Katana by supplying a modified firmware image, enabling persistent device compromise at the firmware level. The device does not properly verify firmware authenticity or integrity before accepting an upload, and the assessed CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with a score of 9.6 and a vuln.today decision label of act_now. No public exploit code or confirmed active exploitation is identified in the supplied sources.
Authenticated file upload in Part-DB Server 2.12.0 and earlier lets any member of the default users group obtain remote code execution as the www-data web user by uploading a .phar attachment that the shipped Apache configuration routes to PHP-FPM. The upload handler rewrites a fixed denylist of dangerous extensions to .txt but omits phar, and a freshly created attachment type carries an empty file-type filter, so the client-supplied .phar extension survives into the web-served public/media/ directory under the document root. The stock Docker image is exploitable by default, the public advisory documents a live-verified reproduction against jbtronics/part-db1:v2.12.0, and the issue is fixed in 2.12.1.
Remote code execution in CGM CLININET lets unauthenticated attackers on the same local network execute arbitrary code as root by sending a crafted Java-serialized object to the HTTP API used by the administrative module. The flaw affects CLININET installations that expose this API and is fixed in version 2026.MS3; CERT-PL coordinated the disclosure, the priority label is act_now, and no public exploit has been identified at time of analysis.
Relative path traversal during model archive extraction in AWS Multi Model Server 1.1.11 and earlier allows unauthenticated remote actors to write files outside the intended model directory and achieve arbitrary code execution. AWS rates the flaw CVSS 4.0 9.3 (Critical) and has declared the product end of life, so no fixed version will ship; the vendor's guidance is to discontinue use and migrate to a supported model-serving solution. No public exploit code or confirmed active exploitation was identified at time of analysis, and realistic remote exploitation depends on the model registration/load endpoint being reachable rather than bound to localhost.
Code injection in the RunCGI.pm component of CGM CLININET allows an attacker positioned on an adjacent network segment to supply a crafted query parameter naming an arbitrary Perl module, which the component then dynamically imports and executes - resulting in arbitrary code execution with root privileges. Exploitation requires no authentication and no user interaction, but is gated by network reachability to the CGI component from the same local or logical network segment rather than the open internet; all versions prior to 2026.MS3 are affected per the CPE range. Rated 9.4 (CVSS 4.0) and flagged act_now by vuln.today priority scoring, with no public exploit identified at time of analysis; the vendor fixed the flaw in version 2026.MS3.
DJI CrystalSky ZS600C firmware 0.3.9.7 through 0.6.6.9 exposes an unauthenticated adbd shell to anyone with physical USB access because the device ships with ro.adb.secure=0 and USB ADB enabled. An attacker can obtain a uid 2000 shell as a foothold for a separate privilege-escalation step to root; ADB over TCP is not enabled by default, but when enabled out-of-band the same unauthenticated shell is reachable over the network. No public exploit was identified at time of analysis and there is no CISA KEV entry; the assessed CVSS 3.1 score is 7.0 (AV:P) because the default path requires physical access, while the reported CVSS 4.0 base score is 9.3.
Authentication bypass in the public registration form of onPhase/frevvo Forms 11.0.14 allows an unauthenticated remote attacker to impersonate an existing tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands. Exploitation requires the public registration endpoint to be reachable and the attacker to supply a valid tenant name and an existing user identifier; no credentials or user interaction are required. The vuln.today decision is act_now, and no public exploit identified at time of analysis.
Privilege escalation in BlueSpice container deployments (bluespice/wiki image, versions 5.2.3 through 5.2.6 and 5.2.7 images published before 2026-10-19 15:37 UTC) lets an attacker who can read the wiki obtain an application token from the REST API and exchange it for a session carrying sysop privileges as the internal service user. Because the token authenticator's IP allow-list is disabled by default when WIKI_SERVICE_TOKEN_AUTH_ALLOWED is unset, no authentication is required on publicly readable wikis (CVSS:3.1 AV:N/AC:L/PR:N/UI:N), while on access-controlled wikis a low-privileged read account suffices. Vendor-released fixes are available (5.2.7 and later, or a 5.2.7 image published on/after 2026-10-19 15:37 UTC); no public exploit code or confirmed active exploitation was identified at time of analysis. Severity is 9.3 (CVSS 4.0), and the priority decision is act_now.
Blind SQL injection in the WordPress plugin Participants Database (xnau webdesign), affecting versions through 2.7.8.5, allows unauthenticated remote attackers to read arbitrary data from the site's WordPress database. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) is confidentiality-only: no integrity or availability impact is established, and the exact endpoint or parameter that exposes the injection is not described in the available sources. No public exploit code has been identified at time of analysis, but the vuln.today decision label is act_now, so any internet-exposed site running an affected version should be treated as high priority.
Local privilege escalation in CGM CLININET allows anyone who already holds the low-privileged uhcapache account to rewrite the scripts and configuration files belonging to the root-running HL7 message-processing service and thereby execute arbitrary code as root on the hospital server. The root cause is an incorrect permission assignment (CWE-732) on a critical resource, scored 9.3 under CVSS 4.0 and carrying a vuln.today decision label of act_now, with CERT-PL reporting impact up to version 2026.MS3 and later builds possibly affected. No public exploit code has been identified at time of analysis, and exploitation is constrained to local access plus prior possession of the uhcapache account, but the resulting root-level compromise of a clinical information system is severe.
Reflected cross-site scripting in the IIIF Auth 2.0 endpoints auth/login and auth/token of Goobi Viewer Core (maven io.goobi.viewer:viewer-core) from version 25.08 up to, but not including, 26.05 allows remote unauthenticated attackers to execute JavaScript in a victim's viewer origin, scoring CVSS 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). The unvalidated origin query parameter is reflected into the Content-Security-Policy frame-ancestors response header and into an HTML body as a single-quoted JavaScript postMessage argument, and because the attacker controls both the login and token calls that initiate the flow, the payload is reachable without any pre-existing trust relationship. Exploitation requires a victim to be induced to open a crafted request (UI:R); the vendor notes a default install remains exploitable via top-level navigation because the shipped reverse-proxy configuration sets no script-src Content-Security-Policy, while the shipped X-Frame-Options: DENY and frame-ancestors 'self' block only the stealthier cross-origin iframe-delivery variant and the CSP-header malformation. No public exploit code was identified at time of analysis, but the priority decision label is act_now and the vendor has released a patch.
Remote code execution in AgenticSeek's bundled llm_server component, which ships with Flask debug mode hardcoded on (app.run(host='0.0.0.0', ..., debug=True)) so the interactive Werkzeug debugger is exposed on every interface by default rather than through an opt-in misconfiguration. Any network-reachable instance running a build prior to commit 409840c033851d861c5c83a91c05fd4a2a75a096 is in scope; an unauthenticated remote attacker (CVSS PR:N, no user interaction) who can reach the llm_server port and obtain the derivable Werkzeug debugger PIN can execute arbitrary Python code and operating system commands with the llm_server process's privileges, giving high confidentiality, integrity and availability impact. The assessed vector (CVSS:3.1 AV:N/AC:H/PR:N/UI:N) reflects that PIN derivation, not application authentication, is the rate-limiting step, while CVSS 4.0 scores it 9.2 Critical with AT:P; no public exploit code and no confirmed active exploitation were identified at time of analysis, though a vuln.today decision label of act_now and a vendor-released fix make prompt patching the priority.
Authenticated administrators of Okta Access Gateway can execute system commands as the OAG service account by submitting specially formatted values to Admin Console configuration inputs that are processed without adequate validation. The flaw is rated CVSS 9.1 with a PR:H vector, so exploitation requires high-privileged Admin Console access rather than an unauthenticated or low-privileged foothold; exact affected version ranges are not enumerated in the supplied data. No public exploit was identified at time of analysis, but the act_now priority and scope change to the host OS make prompt review of the Okta advisory important.
ReqLLM 1.9.0 through 1.28.0 accepts untrusted TLS certificates on its OpenAI WebSocket paths, allowing an unauthenticated on-path attacker to read or modify sessions and capture bearer tokens. Exposure is limited to applications that opt into OpenAI Responses WebSocket mode, Realtime sessions, or the Codex WebSocket path; default HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are unaffected. The vendor has released 1.29.0, the decision signal is act_now, and no public exploit identified at time of analysis.
Remote code execution with root privileges affects CGM CLININET application servers through version 2026.MS3, where HL7 communication processes run as root and parse untrusted data from external systems. An unauthenticated attacker on an adjacent network segment who can deliver data to an exposed HL7 listener can achieve code execution with root privileges; the additional attack requirement encoded as AT:P is not described in the available sources. No public exploit was identified at time of analysis, but the issue is a genuine high-priority item prioritized act_now because of the root-level impact and unauthenticated adjacent-network path.
Missing capability checks in ACF Extended and ACF Extended PRO before 0.9.2.8 let unauthenticated visitors overwrite arbitrary WordPress posts through a front-end form's post-update action, including the posts that hold the site's ACF field definitions, which can escalate to arbitrary code execution on the server. The flaw is only reachable when the site publishes a form whose post-update action maps both the target post and its content to visitor-submitted values, a non-default configuration that raises attack complexity (CVSS 9.0, AC:H) and leads SSVC to mark the issue not automatable. No public exploit has been identified at time of analysis; the vendor has released 0.9.2.8 and the vuln.today priority is act_now.
Code injection in Happy DOM 17.0.0 through 21.0.3 allows attacker-supplied module source to execute in the Node.js host process when a Window is created with enableJavaScriptEvaluation: true. A named ESM import alias that is not a valid JavaScript binding identifier is spliced unvalidated into a generated destructuring binding, and combined with a JSON module import attribute the compiled function remains syntactically valid and runs the attacker's initializer - the advisory's proof of concept reaches process.getBuiltinModule('node:fs') and creates a directory on the host filesystem. The issue is a distinct residual path left open by the fix for CVE-2026-33943, rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) with user interaction required; the vendor shipped 21.0.4, no CISA KEV entry is associated, and real-world exposure is gated by the non-default JavaScript evaluation setting plus the need to process attacker-controlled HTML or module source.
Server-side request forgery in @pdfme/common (npm) from 5.5.10 before 6.2.6 allows an attacker who controls a template's basePdf value to make the runtime fetch loopback, internal or cloud-metadata URLs and embed the response as the generated document's base PDF. The isUrlSafeToFetch denylist added for an earlier SSRF report (GHSA-pgx6-7jcq-2qff) is incomplete: WHATWG URL parsing rewrites IPv4-mapped IPv6 forms into hex, so http://[::ffff:127.0.0.1]/ and http://[::ffff:a9fe:a9fe]/ (169.254.169.254) pass the string check, and the unspecified address http://[::]/, NAT64 prefixes such as http://[64:ff9b::a9fe:a9fe]/, and trailing-dot/alias localhost hostnames (http://localhost./) are not matched either. Exploitation requires two preconditions: attacker influence over a basePdf value that reaches getB64BasePdf, and execution in a context where window is defined (a browser or a server-side DOM shim) - plain headless Node without a DOM shim does not take the vulnerable fetch path; a public reproduction of the bypass is documented in the GitHub advisory and no active exploitation is confirmed (not in CISA KEV).
An out-of-bounds write in Zephyr's USB device_next Bluetooth HCI transport class (subsys/usb/device_next/class/bt_hci.c) allows memory adjacent to a statically allocated USB transfer pool to be overwritten with attacker-influenced bytes. Zephyr releases from 3.3.0 through 4.4.2 are affected via the CPE cpe:2.3:a:zephyrproject:zephyr, with the remotely reachable triggers applying to full-speed-only builds from v4.2.0 onward where the endpoint pool slot is 64 bytes; an attacker within Bluetooth range needs no authentication and no user interaction, and in the stock full-speed-only configuration the mandatory 70-byte Read Supported Commands event already overruns the slot by six bytes during ordinary host initialization. Silent corruption with potential code execution requires CONFIG_ASSERT=n and no memory protection between subsystems, while assertion-enabled builds panic instead, giving a remotely triggerable denial of service. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the vendor fix is merged upstream but the release containing it is projected rather than shipped.
Event-loop-blocking denial of service in @hapi/content 6.0.1 and 6.0.2 lets unauthenticated remote attackers stall a Node.js process by sending a single multipart upload whose Content-Disposition header carries a long parameter with no equals sign, causing quadratic regex backtracking inside Content.disposition(). The bug is an incomplete fix for CVE-2026-35213: the 6.0.1 regex tightening left one parsing path exploitable, so any hapi service that calls Content.disposition() on attacker-controlled headers (typically multipart/form-data routes handled through @hapi/subtext) is exposed with no authentication, privileges or user interaction, though the impact is availability only. Version 6.0.3 completes the fix; a public regression test in the upstream pull request demonstrates the trigger payload, but there is no CISA KEV listing and no confirmed working exploit code at time of analysis, and the vendor documents no workaround other than upgrading.
Authentication bypass in the CGM CLININET rsyncd service allows an attacker who can spoof an allow-listed source IP address to reach rsync modules without credentials and edit files on the affected host. The flaw is confirmed in versions through 2026.MS3, with later releases potentially affected, and is only reachable where the rsyncd daemon is network-exposed and configured to authorize clients by source IP alone. No public exploit code or active exploitation is identified at time of analysis; the independent assessment keeps a high severity rating but raises attack complexity because the spoofing must succeed against a TCP service, implying an on-path or packet-injection position rather than arbitrary internet access.
Use-after-free in the Linux kernel's ksmbd SMB server lets an authenticated SMB3 client that has bound a multichannel connection leave a stale channel pointing at a freed struct ksmbd_conn when that connection disconnects, so later session teardown or a /proc session walk dereferences freed memory. Exploitation requires ksmbd (CONFIG_SMB_SERVER) to be built and actively serving, valid SMB credentials, and SMB3 multichannel in use, which narrows realistic exposure; the assessed vector is AC:H/PR:L. EPSS is 0.25% (16th percentile), no KEV confirmation appears in the supplied intelligence, and no public exploit was identified at time of analysis; priority is this_week.
A heap out-of-bounds write in the in-kernel SMB3 server ksmbd (ksmbd_krb5_authenticate()/krb5_authenticate()) lets an attacker with authenticated access to the Kerberos session-setup path write an attacker-influenced AP-REP blob past the end of response_buf into adjacent kernel heap memory. Only systems running the optional ksmbd module with Kerberos authentication configured and reachable over the network are exposed, and the overflow occurs specifically when SMB2_SESSION_SETUP arrives as a non-first element of a compounded SMB2 request, so standalone session-setup traffic does not trigger it. No public exploit code has been confirmed and the kernel fix is available; EPSS is low at 0.21% (10th percentile), but CNA scoring is high (CVSS 8.8, AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H) and the kernel stable commits are published, making this a this-week remediation priority rather than an emergency.
KVM on x86 can hand a guest's valid-RAM access back to userspace as KVM_EXIT_MMIO because the per-vCPU MMIO cache is filled and validated against address space 0 (kvm_memslots()) instead of the vCPU's active memslots, so entries created while the vCPU runs in SMM (address space 1) can survive an SMM memslot update and appear valid after the vCPU returns to the normal address space. The practical consequence is on the host side: completing that exit through the VMM's RAM path writes a backing page without KVM's write-tracking, and if that page holds a nested EPT table KVM keeps using shadow translations derived from the old contents, which trips the WARN_ON_ONCE() in kvm_mmu_write_protect_fault(). Affected are Linux kernels since 4.2 (commit 699023e23965 introduced the SMM address space), fixed in 6.6.160, 6.12.114, 6.18.58, 7.2.12 and 7.3; per the CVSS vector (AV:L/PR:L) this requires an attacker with local guest-level privileges, no public exploit has been identified at time of analysis, and EPSS is low at 0.21% (10th percentile).