Deserialization of attacker-supplied pickle data in the deprecated pandas packaged builder of Hugging Face Datasets (all versions through 5.1.0) lets a crafted dataset file run arbitrary Python in the victim's process when it is loaded via datasets.load_dataset("pandas", data_files=...). The attacker needs no credentials but does need the victim to actively point the loader at the malicious .pkl/.pickle file, and the builder emits a FutureWarning that it is deprecated; the resulting code executes with the privileges of the loading process, giving high confidentiality, integrity and availability impact. A public PoC reference exists but is not verified as working exploit code, there is no confirmed active exploitation, and the vendor fix (pull request 8879) hard-disables pickle loading in this builder; priority guidance places remediation in the current week rather than as an emergency.
Google ADK for Java's development web server (ADK Web) accepts cross-origin connections by default, letting a malicious web page drive a locally running agent and read its data. The /run_live WebSocket endpoint allowed any origin (hardcoded setAllowedOrigins("*") in 0.1.0-1.5.0, default * via adk.web.cors.origins in 1.6.0-1.12.0) and, since 0.4.0, the REST API returned Access-Control-Allow-Origin: *; combined with the absence of authentication, a developer who visits an attacker-controlled page while the server runs can have tools triggered, responses streamed, and sessions and artifacts listed, read, created or deleted. Unauthenticated remote exploitation is possible per the CVSS vector (PR:N) but requires passive user interaction (UI:P) - the developer must open the malicious page while the dev server is up; a public PoC reference exists (GitHub issue 1257) but it is not verified as working exploit code, and no confirmed active exploitation was reported. Exposure is limited to a developer-facing dev server rather than a production service, and the complete fix is version 1.13.0.
Code injection in Happy DOM 17.0.0 through 21.0.3 allows attacker-supplied module source to execute in the Node.js host process when a Window is created with enableJavaScriptEvaluation: true. A named ESM import alias that is not a valid JavaScript binding identifier is spliced unvalidated into a generated destructuring binding, and combined with a JSON module import attribute the compiled function remains syntactically valid and runs the attacker's initializer - the advisory's proof of concept reaches process.getBuiltinModule('node:fs') and creates a directory on the host filesystem. The issue is a distinct residual path left open by the fix for CVE-2026-33943, rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) with user interaction required; the vendor shipped 21.0.4, no CISA KEV entry is associated, and real-world exposure is gated by the non-default JavaScript evaluation setting plus the need to process attacker-controlled HTML or module source.
Server-side request forgery in @pdfme/common (npm) from 5.5.10 before 6.2.6 allows an attacker who controls a template's basePdf value to make the runtime fetch loopback, internal or cloud-metadata URLs and embed the response as the generated document's base PDF. The isUrlSafeToFetch denylist added for an earlier SSRF report (GHSA-pgx6-7jcq-2qff) is incomplete: WHATWG URL parsing rewrites IPv4-mapped IPv6 forms into hex, so http://[::ffff:127.0.0.1]/ and http://[::ffff:a9fe:a9fe]/ (169.254.169.254) pass the string check, and the unspecified address http://[::]/, NAT64 prefixes such as http://[64:ff9b::a9fe:a9fe]/, and trailing-dot/alias localhost hostnames (http://localhost./) are not matched either. Exploitation requires two preconditions: attacker influence over a basePdf value that reaches getB64BasePdf, and execution in a context where window is defined (a browser or a server-side DOM shim) - plain headless Node without a DOM shim does not take the vulnerable fetch path; a public reproduction of the bypass is documented in the GitHub advisory and no active exploitation is confirmed (not in CISA KEV).
Cross-site scripting in the PraisonAI HTTPApproval dashboard lets an attacker-controlled tool argument run same-origin JavaScript that silently approves a pending dangerous tool call before the human reviewer clicks Approve or Deny, defeating the human-in-the-loop safety boundary. Only deployments using the non-console `http` approval backend (praisonai.bots.HTTPApproval) in versions 4.5.2 through 4.6.58 are exposed (4.5.0 and 4.5.1 do not ship this backend); the CVSS vector (PR:N/UI:R) means no dashboard authentication is needed, but an approver must open the pending request's approval URL for the payload to fire. The issue is fixed in 4.6.59; a public PoC reference exists (a local proof-of-value script in the GitHub advisory that stops at the approval decision and does not run the command), and it is not verified as working exploit code against deployed instances, with no KEV listing or confirmed active exploitation at time of analysis.
An out-of-bounds write in Zephyr's USB device_next Bluetooth HCI transport class (subsys/usb/device_next/class/bt_hci.c) allows memory adjacent to a statically allocated USB transfer pool to be overwritten with attacker-influenced bytes. Zephyr releases from 3.3.0 through 4.4.2 are affected via the CPE cpe:2.3:a:zephyrproject:zephyr, with the remotely reachable triggers applying to full-speed-only builds from v4.2.0 onward where the endpoint pool slot is 64 bytes; an attacker within Bluetooth range needs no authentication and no user interaction, and in the stock full-speed-only configuration the mandatory 70-byte Read Supported Commands event already overruns the slot by six bytes during ordinary host initialization. Silent corruption with potential code execution requires CONFIG_ASSERT=n and no memory protection between subsystems, while assertion-enabled builds panic instead, giving a remotely triggerable denial of service. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the vendor fix is merged upstream but the release containing it is projected rather than shipped.
Event-loop-blocking denial of service in @hapi/content 6.0.1 and 6.0.2 lets unauthenticated remote attackers stall a Node.js process by sending a single multipart upload whose Content-Disposition header carries a long parameter with no equals sign, causing quadratic regex backtracking inside Content.disposition(). The bug is an incomplete fix for CVE-2026-35213: the 6.0.1 regex tightening left one parsing path exploitable, so any hapi service that calls Content.disposition() on attacker-controlled headers (typically multipart/form-data routes handled through @hapi/subtext) is exposed with no authentication, privileges or user interaction, though the impact is availability only. Version 6.0.3 completes the fix; a public regression test in the upstream pull request demonstrates the trigger payload, but there is no CISA KEV listing and no confirmed working exploit code at time of analysis, and the vendor documents no workaround other than upgrading.
Authentication bypass in the CGM CLININET rsyncd service allows an attacker who can spoof an allow-listed source IP address to reach rsync modules without credentials and edit files on the affected host. The flaw is confirmed in versions through 2026.MS3, with later releases potentially affected, and is only reachable where the rsyncd daemon is network-exposed and configured to authorize clients by source IP alone. No public exploit code or active exploitation is identified at time of analysis; the independent assessment keeps a high severity rating but raises attack complexity because the spoofing must succeed against a TCP service, implying an on-path or packet-injection position rather than arbitrary internet access.
Use-after-free in the Linux kernel's ksmbd SMB server lets an authenticated SMB3 client that has bound a multichannel connection leave a stale channel pointing at a freed struct ksmbd_conn when that connection disconnects, so later session teardown or a /proc session walk dereferences freed memory. Exploitation requires ksmbd (CONFIG_SMB_SERVER) to be built and actively serving, valid SMB credentials, and SMB3 multichannel in use, which narrows realistic exposure; the assessed vector is AC:H/PR:L. EPSS is 0.25% (16th percentile), no KEV confirmation appears in the supplied intelligence, and no public exploit was identified at time of analysis; priority is this_week.
A heap out-of-bounds write in the in-kernel SMB3 server ksmbd (ksmbd_krb5_authenticate()/krb5_authenticate()) lets an attacker with authenticated access to the Kerberos session-setup path write an attacker-influenced AP-REP blob past the end of response_buf into adjacent kernel heap memory. Only systems running the optional ksmbd module with Kerberos authentication configured and reachable over the network are exposed, and the overflow occurs specifically when SMB2_SESSION_SETUP arrives as a non-first element of a compounded SMB2 request, so standalone session-setup traffic does not trigger it. No public exploit code has been confirmed and the kernel fix is available; EPSS is low at 0.21% (10th percentile), but CNA scoring is high (CVSS 8.8, AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H) and the kernel stable commits are published, making this a this-week remediation priority rather than an emergency.
KVM on x86 can hand a guest's valid-RAM access back to userspace as KVM_EXIT_MMIO because the per-vCPU MMIO cache is filled and validated against address space 0 (kvm_memslots()) instead of the vCPU's active memslots, so entries created while the vCPU runs in SMM (address space 1) can survive an SMM memslot update and appear valid after the vCPU returns to the normal address space. The practical consequence is on the host side: completing that exit through the VMM's RAM path writes a backing page without KVM's write-tracking, and if that page holds a nested EPT table KVM keeps using shadow translations derived from the old contents, which trips the WARN_ON_ONCE() in kvm_mmu_write_protect_fault(). Affected are Linux kernels since 4.2 (commit 699023e23965 introduced the SMM address space), fixed in 6.6.160, 6.12.114, 6.18.58, 7.2.12 and 7.3; per the CVSS vector (AV:L/PR:L) this requires an attacker with local guest-level privileges, no public exploit has been identified at time of analysis, and EPSS is low at 0.21% (10th percentile).
Linux kernel filesystem teardown can disclose content that a mount was meant to hide: when unlink(), rmdir() or rename() removes an entry that is a mountpoint in another mount namespace, the dentry remains hashed and positive between detach_mounts() and d_delete(), so a racing lookup can resolve past the mount to the underlying overmounted file or directory. A local user who can create or clone mount namespaces (open_tree(OPEN_TREE_CLONE) plus move_mount, generally permitted to unprivileged users where unprivileged user namespaces are enabled) and who races lookups against the removal obtains read access to the covered object's content. The race is timing-dependent (assessed AC:H) but the window spans a full synchronize_rcu_expedited() grace period plus the caller's inode_unlock(), so it is not narrow; a maintainer-supplied reproducer is published with the fix commit, EPSS is 0.21% (10th percentile) and the issue is not in CISA KEV at time of analysis.
Race in the Linux kernel's VFS path-resolution (refwalk) code lets a local attacker who can create and move mounts read the contents of a file that is supposed to be hidden behind an overmount, instead of receiving ENOENT or the covering file. The flaw sits in step_into()/step_into_slowpath(): a refwalk takes a reference on the hashed dentry and accepts it without revalidating, so an unlink()/rmdir()/rename() that detaches the mounts and removes the name can leave the walker looking at the underlying entry. Winning the race requires CAP_SYS_ADMIN-style mount manipulation (open_tree(OPEN_TREE_CLONE), move_mount), typically obtained through unprivileged user namespaces, plus a very narrow timing window - the supplied reproducer needed thousands of unlinks and artificial delay widening to trigger it reliably. Impact is confidentiality-only information disclosure (our assessed vector AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N), considerably narrower than the vendor's 8.8 score; a public reproducer accompanies the fix commits, EPSS is 0.21% (11th percentile), and there is no KEV listing indicating active exploitation.
Linux kernels that allow unprivileged user-namespace creation let a local low-privileged user read file content that covering (over-mounted) directories were intended to hide, by calling open_tree() with OPEN_TREE_NAMESPACE and then setns() into the resulting mount namespace. The flaw matters most on hosts running container runtimes that mask parts of /proc and /sys with mounts, or where administrators hide paths behind mounts; systems without such covering mounts, or that disable unprivileged user namespaces, are not exposed through this path. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, with EPSS at 0.20% (9th percentile); vendor fixes are available as upstream stable commits, so patching this week is appropriate.
Any authenticated control panel user in Craft CMS - regardless of privilege level - can escape the Twig sandbox through an element-search condition and use a boolean oracle to recover the site's GeneralConfig::securityKey character by character, then forge Craft's HMAC-signed parameters offline and reach unsandboxed View::renderObjectTemplate(), where Twig string-callable syntax invokes native PHP callables as the web server user. Default installations in the ranges 4.0.0 to before 4.18.9 and 5.0.0 to before 5.11.2 are affected; no non-default configuration is required and no user interaction is involved. The vendor-released fix is 4.18.9 (4.x) and 5.11.2 (5.x); exploitation is not confirmed in the wild and no EPSS or KEV signal was supplied, though the advisory documents a regression proof that invokes a harmless substr() callback rather than an OS command. The vulnerability is a genuine high-priority issue rather than a CVSS-inflated one, though the authentication prerequisite tempers it.
Authenticated, low-privileged Craft CMS control-panel users (any account holding only the `accessCp` permission) can escalate to arbitrary operating-system command execution as the PHP worker. By sending a fake Craft API response header whose `X-Craft-Plugin-Licenses` value contains embedded newlines, the user abuses a CRLF injection in the `app/process-api-response-headers` action: Craft writes the value into the `.env` file without stripping line breaks, so the attacker can inject an attacker-known `CRAFT_SECURITY_KEY`. Once that key is loaded, the attacker forges a signed login redirect carrying a Twig `system()` callback. Both the 4.x branch (4.0.0 through 4.18.8) and the 5.x branch (5.0.0 through 5.11.1) are affected; vendor fixes exist in 4.18.9 and 5.11.2, and no public exploit code was identified at time of analysis. The vulnerability requires a valid control-panel login, but no admin rights, no user interaction and no non-default configuration, so any CP user with `accessCp` qualifies.
The AES-CBC-with-HMAC JWE path in Eclipse KeyPont gose (published as github.com/ThalesGroup/gose v0.9.0 through v0.13.0-rc1) provides no ciphertext integrity at all: HmacShaCryptor.Hash returned the MAC of the empty message for every input, so the authentication tag is constant per key and independent of the message. An unauthenticated remote attacker who has observed a single legitimately produced JWE under the target key can replay that tag onto arbitrary attacker-chosen header, IV and ciphertext and pass verification, enabling bit-flipping manipulation of the recovered plaintext and padding-oracle-style attacks; confidentiality alone is not broken. Only the CBC-HMAC direct encryption/decryption blocks are affected, AEAD/GCM modes do not use this cryptor, and the evaluator rates it AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N with no public exploit identified at time of analysis.
Unauthenticated memory exhaustion in Twisted's twisted.words.xish.domish XML element stream allows a remote peer to keep a container element open and stream child elements indefinitely, growing an in-memory element tree until the server process is killed. Every Twisted release up to and including 26.4.0 is affected, with the practical exposure limited to deployments that parse attacker-supplied XML streams through this parser - in practice XMPP servers and components built on Twisted, where the stream is parsed during negotiation before any credentials are accepted. The vendor fixed the issue in 26.10.0rc1 (PR #12751) by enforcing byte-size and element-count caps per stanza; there is no CISA KEV entry, and a public PoC reference in the advisory describes the stream-flooding steps but is not verified as working exploit code.
PraisonAI's kernel-enforced SandlockSandbox silently degrades to ordinary subprocess execution when the optional sandlock module imports but reports that Linux Landlock is unavailable, so code that was supposed to be confined can read files outside the configured allowed paths and open network connections even when the native policy was created with network=False. The affected path is code executed through SandboxConfig.native() with SandlockSandbox in the pip package praisonai from 4.5.110 up to (but not including) 4.6.61; the read_file/write_file/list_files helpers still apply safe_sandbox_path checks and are not the exposed surface. CVSS 3.1 scores this 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) because the sandbox escape crosses a security scope with high confidentiality and integrity impact, while the attacker is positioned as a local, low-privileged party able to supply code to the sandbox rather than an unauthenticated network attacker. A public proof-of-concept script ships with the advisory (demonstrated against v4.6.58) that shows both boundary crossings; no confirmed active exploitation (CISA KEV) or public working exploit code is indicated, and the vendor released 4.6.61 as the fix.
OS command injection chained with cross-site request forgery in ASUS router firmware allows an attacker to execute arbitrary commands with root privileges on the device by luring an administrator who is already logged in to the web management interface into visiting a phishing page. Rated CVSS 4.0 8.6 (high) and tracked as CWE-78, the flaw requires no credentials of the attacker's own (PR:N) but depends on user interaction (UI:A) with a valid authenticated administrator session on the victim side, which is the primary limiting precondition. It was reported to the CNA by ASUS, and no public exploit code or confirmed active exploitation was identified at time of analysis; the specific affected models, firmware versions and vulnerable endpoint are not enumerated in the available sources, which instead point to the vendor's security advisory for fixed firmware.
Path traversal in the Vvveb CMS backup controller lets an administrator-supplied 'file' GET parameter be concatenated onto the backup directory path without sanitization in the nextRestore() and nextBackup() actions, allowing arbitrary server-side file reads (and SQL execution of the read content) and arbitrary-path writes of database dump data with a forced .sql suffix. All installations of Vvveb 1.0.8.6 and prior are affected by default; exploitation requires a valid authenticated administrator session (CVSS PR:H), so this is an access-gated issue rather than a drive-by threat. A public PoC reference exists in the GitHub advisory (curl requests against nextRestore); it is not verified as working exploit code, and no active exploitation has been confirmed (not in CISA KEV). Vendor-released fix: commit aa29cb0, shipped in version 1.0.8.7.
Authorization bypass in Apache Vysper's XEP-0077 In-Band Registration implementation allows any authenticated user to compromise other accounts on the XMPP server. All versions are affected, the project is retired and unsupported, and the vendor does not plan to release a fix; no public exploit was identified at time of analysis. The vendor's stated remediation is migration to an alternative XMPP server.
SQL injection in baserCMS 5.0.0 through 5.3.1 and 5.4.0 through 5.4.1 allows a user who can log into the admin panel to execute arbitrary SQL against the application database - including reading password hashes from the users table - by embedding SQL fragments in query parameters such as contain, conditions, fields, finder and order that the list and detail actions pass straight into the ORM. The earlier 5.3.1 and 5.4.1 fixes addressed only public pages and the public API, and setting USE_CORE_ADMIN_API to false does not block the authenticated browser path to the Admin and Api/Admin endpoints. Scoring is 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with CWE-89; exposure is gated by the admin-panel authentication requirement (PR:L), and no public exploit identified at time of analysis.
A heap use-after-free in OpenWrt's odhcpd DHCPv6 IA handler allows an unauthenticated client on the same local link or an adjacent IPv6 network to crash or corrupt the router's DHCPv6/RA daemon. The flaw lives in the per-message `first` lease pointer used to reuse a Reconfigure authentication key across multiple IA options: a REQUEST that binds one IA, then fails the on-link check on a later IA with the same IAID, frees the lease that `first` still references, and a subsequent IA copies 16 bytes from that freed chunk into a new lease's key. The validated impact is adjacent-network denial of service plus Reconfigure/ForceRenew key confusion (deterministically an all-zero key under the traced reclaim pattern); arbitrary code execution is not proven for this UAF alone, and a public maintainer reproduction bundle demonstrates the crash under ASan. It is not confirmed actively exploited (no CISA KEV listing), but it carries a 'this_week' priority and affects essentially every OpenWrt release from 18.06 through the 25.12 package pin.
Arbitrary file write outside the sandbox is possible through the FileChooser.SaveFiles portal method in xdg-desktop-portal before version 1.22.1: a malicious sandboxed application (for example a Flatpak app) can pass the optional 'files' filenames containing path-traversal components, which the frontend does not validate and which common backends append to the user-selected directory without checking. The result is the ability to create files at attacker-chosen paths on the host, bounded to files that do not already exist (existing files cannot be overwritten) and to locations the invoking user can write to, and it depends on the user engaging the save dialog. The vendor rates this 8.8 under CVSS 4.0, while the assessed CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N, which tempers real-world urgency; no public exploit code has been identified and the issue is not in CISA KEV, with a vendor patch released in 1.22.1.
PraisonAI versions 4.6.10 through 4.6.58 allow shell command injection through its compute-bridged file tools: when a LocalManagedAgent or SandboxedAgent is instantiated with a compute provider attached, the bridge rewrites read_file, list_files and write_file into shell command strings built from raw path arguments, so a crafted path can break out of the quoting and run arbitrary commands on the host (compute="local") or inside the container (Docker). Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation needs an authenticated low-privileged actor who can influence a file-tool path argument - for example via prompt injection, a chat endpoint or an automation webhook - and importantly does not require the operator to have granted the critical-marked execute_command tool, so least-privilege tool configurations do not prevent it. The vendor advisory ships a local proof-of-concept reproducer that confirms shell execution through a crafted path; no evidence of active exploitation is provided in the available data, and deployments without an attached compute provider or without the bridged file tools enabled are not affected.
PraisonAI's Discord approval backend (praisonai.bots.DiscordApproval, versions 4.5.2 through 4.6.58) treats any later non-bot message in the configured Discord channel as the approval decision for a pending dangerous tool call, so an authenticated low-privileged Discord user who can post in that channel can reply 'yes' to a pending shell command, file write/delete or deployment request without being the intended approver - the message need not be a reply, thread message, button interaction or token-bound response. Exploitation requires a specific deployment posture: DiscordApproval used as the human gate for high-risk tools, a request already pending with its prompt posted, and attacker write access to that channel; realized impact is bounded by whichever tools the agent exposes behind approval. Vendor-released patch: upgrade pip package praisonai to 4.6.59 or later; no public exploit against live deployments is identified - the accompanying proof-of-concept is a local, mock-based harness that is not verified as working exploit code against real Discord channels.
Local privilege escalation in DJI CrystalSky ZS600C firmware 0.3.9.7 through 0.6.6.9 allows an unprivileged process already running on the Android device to write a crafted line to logcat that the root-privileged hardware_monitor helper passes to a shell eval, resulting in arbitrary command execution as root. The attack is strictly local: the attacker must first obtain a foothold on the device, so this is an escalation primitive rather than a remote entry point. No public exploit was identified at time of analysis, and the published CVSS 4.0 score of 8.6 reflects high confidentiality, integrity, and availability impact once the local prerequisite is met.
Disproportionate CPU consumption in Qt's QXmlStreamReader lets remote attackers render an application unresponsive by supplying a crafted XML document for parsing. Any application built on Qt (qtbase/QtCore) that feeds attacker-influenced XML into QXmlStreamReader is affected, with no confidentiality or integrity impact and no code execution - only availability of the parsing process. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (not in CISA KEV); vendor fixes exist as upstream qtbase commits, though a released patched Qt version is not independently confirmed, and the priority label places remediation in the current week.
Zimbra Collaboration Suite copies attacker-controlled URL parameters into servlet request attributes, letting a crafted /h/* link override the authentication token, target account, target item and dispatch state consumed by the Classic Web Client. On ZCS 10.1.16 this attribute override can be chained with CVE-2026-10632 so an attacker who holds their own valid Zimbra token can cause JavaScript to execute in a signed-in victim's browser session when that victim opens the link; the vector reflects network reachability, low privileges and required user interaction, with scope change and high confidentiality/integrity impact. ZCS 10.1.17 changes the document renderer and breaks the XSS chain, but the underlying attribute-override primitive is retained. No public exploit code or confirmed active exploitation was identified at time of analysis, and the priority signal places it in the this-week remediation band rather than an emergency one.
Reflected cross-site scripting in the Classic Web Client of Zimbra Collaboration Suite 10.1.16 lets an attacker who holds an ordinary Zimbra account run JavaScript in another signed-in user's Zimbra browser session when that user opens a crafted URL, allowing mailbox data to be read and authenticated actions to be performed as the victim. The injection point is the packages parameter of the /h/rest document editor, and practical exploitation depends on chaining CVE-2026-50053 so the attacker can supply their own authentication token and document identifiers in the URL. No public exploit identified at time of analysis, and the issue is assessed as a credible, moderately urgent item rather than a mass-exploitation emergency; ZCS 10.1.17 contains the fix.
Password-reset link poisoning in Part-DB Server (through 2.13.2) lets an unauthenticated remote attacker who can reach the public /pw_reset/request endpoint obtain a valid reset token for any known account, including the seeded admin, by submitting a forgot-password request with a spoofed HTTP Host header; the victim is emailed a genuine, valid token inside a link pointing at an attacker-controlled hostname, which the attacker then replays against the real instance to set a new password and take over the account. Exploitation is limited to installations that have email-based password reset enabled (ALLOW_EMAIL_PW_RESET=1) and leave TRUSTED_HOSTS empty, which the shipped configuration does by default, and the token only reaches the attacker if the victim opens the legitimate-looking email or an inbound URL scanner pre-fetches the link. The vendor advisory includes a detailed end-to-end reproduction; there is no CISA KEV listing and no confirmed active exploitation at time of analysis, and the vendor released a fix in 2.13.3.
Server-side request forgery in onPhase Forms 11.0.14 lets an unauthenticated remote attacker make the form server fetch an attacker-chosen URL from a publicly accessible, unauthenticated form, exposing sensitive data held in an internal Apache Solr instance. The flaw is rated 8.7 by the CNA and assessed by our team as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, meaning unauthenticated remote confidentiality impact with no integrity or availability effect. No public exploit code or confirmed active exploitation was identified at time of analysis; exploitation depends on the deployment actually publishing an unauthenticated URL-handling form to the internet and on a reachable internal Solr target.
Missing authorization in Zimbra Collaboration Suite 10.1.16 and 10.1.20 allows an authenticated delegated administrator holding no explicit administrative grants to overwrite the global Zimlet configuration through ConfigureZimletRequest. The injected configuration can add an attacker-controlled domain to the proxy allowlist of the default class of service, so a signed-in user in that class who opens a crafted /service/proxy URL is served attacker-controlled HTML from Zimbra's own origin, letting the resulting JavaScript read mailbox data and act as the victim. The admin-side escalation is remote and low-complexity but requires a delegated-admin account with admin SOAP service access (PR:L), and the browser compromise requires the victim to open the crafted URL (UI:R); no public exploit code has been identified at time of analysis, no KEV entry is present, and the vuln.today priority label is this_week rather than emergency.
Unauthenticated payment reuse in the Craft Commerce Mollie plugin (versions 2.1.1 through 4.4.2) allows anyone holding a single valid paid Mollie payment ID from the merchant's account to pair it with an arbitrary Craft Commerce transaction hash, causing that target transaction to be marked paid for its full amount and releasing goods or services without payment. No authentication or user interaction is required; the one concrete prerequisite is obtaining a genuinely paid payment ID belonging to the same merchant account, for example via a low-value legitimate purchase. The plugin is fixed in 4.4.3, and no public exploit has been identified at time of analysis.
Improper authentication in ASUS router firmware lets an unauthenticated attacker on an adjacent network-such as an associated Wi-Fi client or a device on the same LAN segment-send an HTTP request, forge an access ticket, and perform administrator operations. The affected router models and firmware versions are not specified in the available data, which uses a wildcard CPE for ASUS routers, and no public exploit has been identified at time of analysis. The issue is rated 8.7 and is prioritized this week.
XML external entity injection in Kitodo.Production 3.8.x and 3.9.x through 3.9.1 lets any authenticated user who can reach the 'Create process' file-upload dialog read server-side files and trigger outbound server requests by uploading a crafted EAD/XML document. The uploaded bytes are parsed by XMLUtils.parseXMLString, getNumberOfEADElements and checkIfXmlIsWellFormed, which build JAXP parser factories with default settings so DOCTYPE declarations and external entity resolution remain enabled (CWE-611); the upstream advisory documents a reproduction with a local-file canary, an out-of-band callback and a hardened-sibling negative control, though no confirmed weaponized exploit and no CISA KEV listing exist. A vendor patch ships in 3.9.2, and because the path requires only a low-privileged authenticated import user rather than anonymous access or admin rights, our assessment lands at CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L - a genuine but conditional priority rather than a mass-exploitation emergency, scheduled for this week.
Unauthenticated visitors to WordPress sites running the GTM Server Side plugin (stape.io, also published as Stape Conversion Tracking) versions 2.0.0 through 2.1.46 can cause another customer's complete WooCommerce order record - transaction ID, items, value, shipping and, when the plugin's 'User Data' option is enabled, name, email and billing address - to be rendered into the page's JavaScript dataLayer simply by setting the gtm_server_side_order_id cookie to an enumerable, sequential order ID and loading any page of the site. The root cause is that the guard restricting purchase-event output to the WooCommerce order-received endpoint was commented out, so the wp_footer hook trusts an integrity-free client-side value; version 2.1.47 moved the order ID into WC()->session and closed the direct cookie manipulation path, but full remediation only arrived in 2.1.48, which adds a once-per-order sent flag to stop full-page caching plugins replaying a legitimate purchase event to later anonymous visitors. CVSS 4.0 scores this 8.7 (AV:N/AC:L/PR:N/UI:N/VC:H) and the practical prerequisite is WooCommerce plus the 'Ecommerce' dataLayer feature being enabled; a public proof-of-concept reproduction procedure is documented in the GitHub advisory, though it is not verified as working exploit code, and no confirmed active exploitation (CISA KEV) is indicated. Priority is set to this_week rather than emergency because exploitation depends on that configuration prerequisite and yields read-only disclosure.
An out-of-bounds stack read in OpenWrt's odhcpd DHCPv6 server lets an unauthenticated client on the same IPv6 link disclose server stack memory, roughly four bytes per request, by placing a zero-length or otherwise truncated IA_NA/IA_PD option at the very end of the daemon's 8192-byte receive buffer; the disclosed bytes are reflected back to the sender as the IAID in odhcpd's DHCPv6 reply. Every inspected OpenWrt stable release from 17.01.0 through the 25.12.x series pins a vulnerable odhcpd commit, and the impact is confidentiality-only (assessed CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). A validated proof-of-concept reproducer, published alongside the upstream advisory, leaks the saved stack canary on ARM, but there is no CISA KEV listing and each probe returns only about four bytes, so defeating canary and ASLR protections requires many requests.
Code injection in the ConvExpr function of CGM CLININET allows a high-privileged, authenticated user to execute arbitrary Perl code with root privileges on the hospital system by way of crafted RTF document content. The CVSS 4.0 vector (AV:A/PR:H/UI:A, score 8.6) shows the flaw is only reachable from the adjacent network by an account that already holds elevated rights, and it requires the content to actually be processed, so remote unauthenticated exploitation is not possible and the practical threat is a trusted insider or an attacker who has already captured privileged credentials on the hospital network. Affected releases are confirmed through 2026.MS3, the vendor has not published an upper bound, and no public exploit code has been identified at time of analysis.
Missing authorization in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows a local application with no Android permissions to invoke binder transaction 1018 on android.dji.server and execute arbitrary OS commands as root through the root-privileged assistant daemon. The attack is local only and requires the ability to run code on the physical device; no public exploit has been identified at time of analysis. The reported CVSS 4.0 base score is 8.6 (High), and the independent CVSS 3.1 assessment is AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Uni-CLI before 0.225.2 leaves the legacy stateless JSON-RPC-over-HTTP MCP transport listening on loopback without validating browser Origin headers, so a malicious page loaded in a browser on the same host can send a CORS simple POST (for example with Content-Type text/plain) to the local /mcp endpoint and reach the JSON-RPC dispatcher, driving tools/call requests against the user's local server. The flaw is unauthenticated (PR:N in the assessed vector) but requires user interaction - the victim must open the attacker's page - and only applies when the user has explicitly started the non-default legacy HTTP MCP transport; the stdio default and the Streamable HTTP transport, which already enforced the boundary, are not affected. Patched in 0.225.2; no public exploit code has been identified at time of analysis, and the issue is confined to the browser-to-localhost boundary rather than changing Uni-CLI's local-code-execution trust model.
Stored cross-site scripting in Phoca Gallery 4.5.0 through 6.1.5 allows an attacker who can create or edit gallery content to inject HTML attributes that execute in a victim's browser when the affected gallery page is viewed. The vendor/EUVD CVSS 4.0 base score is 8.6, while our independent CVSS 3.1 assessment uses PR:L/UI:R and rates impact as low confidentiality/integrity with scope change. No public exploit identified at time of analysis, and vuln.today assigns a this_week decision label.
Unauthenticated remote agent invocation in PraisonAI LinearBot 4.6.56 through 4.6.58: because LINEAR_WEBHOOK_SECRET is treated as optional and defaults to an empty string, the aiohttp webhook listener bound to 0.0.0.0 skips Linear-Signature HMAC verification entirely, so any network caller who can reach the endpoint can POST a forged 'Linear-Event: AgentSession' request that is parsed, backgrounded, and dispatched into BotSessionManager.chat(), causing the bot to run the configured agent and post comments back to Linear under the bot token. Exploitation requires the operator to have started LinearBot with a Linear token but without a webhook secret, and the listener to be reachable; deployments that do set the secret reject missing and invalid signatures with 401 before dispatch. A public proof-of-vulnerability harness exists that exercises the handler offline and monkey-patches the outbound comment path; it is not verified as working exploit code against deployed instances, and there is no confirmed active exploitation (no KEV entry).
Blind SQL injection in the GamiPress WordPress plugin, affecting all versions through 8.0.7, lets an authenticated user inject SQL into plugin-side queries, with the assessed impact being high loss of confidentiality and limited integrity impact while scope remains unchanged. Exploitation requires a valid authenticated session on the target WordPress site (PR:L) plus network reachability, so an attacker must first hold or obtain a site account; the minimum role and the specific vulnerable parameter or feature are not described in the available sources. No CISA KEV listing appears in the supplied data and no public exploit was identified at time of analysis, and the vulnerability is prioritized as a this-week item rather than an emergency response.
Privilege escalation and possible arbitrary code execution in HP One Agent on certain HP PC products stem from an uncontrolled search path element (CWE-427), which lets a file planted in a location the agent searches be loaded in place of a legitimate component. The flaw is local, not remote: an attacker must already hold a low-privileged account on an HP PC where HP One Agent is installed, after which no user interaction is required and confidentiality, integrity and availability impacts are all rated high (CVSS 4.0 base 8.5; vendor-assessed CVSS 3.1 7.8). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority label places it in this week's remediation queue rather than an emergency; HP has published advisory HPSBHF04150 covering software updates.
Arbitrary PHP file upload leading to code execution in baserCMS: any account in the default 'operators' group can store and execute PHP under the document root once an administrator installs the BcCustomContent plugin and leaves the pre-selected 'available to all users' radio in place during installation. Affected are baserCMS 5.0.0-beta1 through 5.3.1 and 5.4.0 through 5.4.1; BcCustomContent is not part of BcApp.defaultInstallCorePlugins, so stock installs are not exposed until an administrator adds the plugin and accepts that default. The vendor advisory publishes a full reproduction procedure (a public PoC reference; it is not verified as weaponized exploit code), there is no CISA KEV entry, and vuln.today priority places remediation in this week's work rather than an emergency response.
Local arbitrary command execution in Aider through 0.86.2 is possible when the CLI auto-loads a repository-supplied .aider.conf.yml without a trust prompt and honors attacker-controlled notifications-command or editor values. Those values are executed via subprocess with shell=True, running with the victim's privileges after a model reply or /editor invocation; no attacker authentication or elevated privileges are needed, but the victim must operate Aider inside the hostile repository. The issue is not listed as KEV in the supplied data, and no public exploit identified at time of analysis.
Local io_uring CONNECT BPF filter bypass in Linux kernel 7.2 and 7.3 lets a low-privileged process reach AF_INET6 destinations that an administrator-configured filter intended to deny. The bug is a length-threshold mismatch: at addr_len 24 (SIN6_LEN_RFC2133), io_connect_bpf_populate() leaves connect.port and connect.v6_addr zero while the kernel connects to the real destination, so filters that deny specific IPv6 ports or addresses are bypassed. The upstream commit describes a verified reproducer; no CISA KEV active-exploitation listing is provided, EPSS is low at 0.21% (11th percentile), and the assessed impact is limited confidentiality/integrity loss rather than remote compromise.
Locked mount expiry in the Linux kernel can be abused by an authenticated local user to unmount a mount that was supposed to stay locked, revealing the files and directories it was hiding. The attacker must first own an unprivileged user namespace, use MOVE_MOUNT_BENEATH to migrate the locked property onto a bottom mount, and then unmount or expire the now-unlocked ancestor so shrink_submounts() tears down the hidden bottom mount. The result is a confidentiality-only exposure of otherwise covered paths (assessed C:H/I:N/A:N); EPSS is low (0.21%, 10th percentile) and no public exploit code was identified at time of analysis, but vendor fixes are available and the issue is prioritized as this_week.