Linux kernel filesystem teardown can disclose content that a mount was meant to hide: when unlink(), rmdir() or rename() removes an entry that is a mountpoint in another mount namespace, the dentry remains hashed and positive between detach_mounts() and d_delete(), so a racing lookup can resolve past the mount to the underlying overmounted file or directory. A local user who can create or clone mount namespaces (open_tree(OPEN_TREE_CLONE) plus move_mount, generally permitted to unprivileged users where unprivileged user namespaces are enabled) and who races lookups against the removal obtains read access to the covered object's content. The race is timing-dependent (assessed AC:H) but the window spans a full synchronize_rcu_expedited() grace period plus the caller's inode_unlock(), so it is not narrow; a maintainer-supplied reproducer is published with the fix commit, EPSS is 0.21% (10th percentile) and the issue is not in CISA KEV at time of analysis.
Race in the Linux kernel's VFS path-resolution (refwalk) code lets a local attacker who can create and move mounts read the contents of a file that is supposed to be hidden behind an overmount, instead of receiving ENOENT or the covering file. The flaw sits in step_into()/step_into_slowpath(): a refwalk takes a reference on the hashed dentry and accepts it without revalidating, so an unlink()/rmdir()/rename() that detaches the mounts and removes the name can leave the walker looking at the underlying entry. Winning the race requires CAP_SYS_ADMIN-style mount manipulation (open_tree(OPEN_TREE_CLONE), move_mount), typically obtained through unprivileged user namespaces, plus a very narrow timing window - the supplied reproducer needed thousands of unlinks and artificial delay widening to trigger it reliably. Impact is confidentiality-only information disclosure (our assessed vector AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N), considerably narrower than the vendor's 8.8 score; a public reproducer accompanies the fix commits, EPSS is 0.21% (11th percentile), and there is no KEV listing indicating active exploitation.
Linux kernels that allow unprivileged user-namespace creation let a local low-privileged user read file content that covering (over-mounted) directories were intended to hide, by calling open_tree() with OPEN_TREE_NAMESPACE and then setns() into the resulting mount namespace. The flaw matters most on hosts running container runtimes that mask parts of /proc and /sys with mounts, or where administrators hide paths behind mounts; systems without such covering mounts, or that disable unprivileged user namespaces, are not exposed through this path. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, with EPSS at 0.20% (9th percentile); vendor fixes are available as upstream stable commits, so patching this week is appropriate.
Any authenticated control panel user in Craft CMS - regardless of privilege level - can escape the Twig sandbox through an element-search condition and use a boolean oracle to recover the site's GeneralConfig::securityKey character by character, then forge Craft's HMAC-signed parameters offline and reach unsandboxed View::renderObjectTemplate(), where Twig string-callable syntax invokes native PHP callables as the web server user. Default installations in the ranges 4.0.0 to before 4.18.9 and 5.0.0 to before 5.11.2 are affected; no non-default configuration is required and no user interaction is involved. The vendor-released fix is 4.18.9 (4.x) and 5.11.2 (5.x); exploitation is not confirmed in the wild and no EPSS or KEV signal was supplied, though the advisory documents a regression proof that invokes a harmless substr() callback rather than an OS command. The vulnerability is a genuine high-priority issue rather than a CVSS-inflated one, though the authentication prerequisite tempers it.
Authenticated, low-privileged Craft CMS control-panel users (any account holding only the `accessCp` permission) can escalate to arbitrary operating-system command execution as the PHP worker. By sending a fake Craft API response header whose `X-Craft-Plugin-Licenses` value contains embedded newlines, the user abuses a CRLF injection in the `app/process-api-response-headers` action: Craft writes the value into the `.env` file without stripping line breaks, so the attacker can inject an attacker-known `CRAFT_SECURITY_KEY`. Once that key is loaded, the attacker forges a signed login redirect carrying a Twig `system()` callback. Both the 4.x branch (4.0.0 through 4.18.8) and the 5.x branch (5.0.0 through 5.11.1) are affected; vendor fixes exist in 4.18.9 and 5.11.2, and no public exploit code was identified at time of analysis. The vulnerability requires a valid control-panel login, but no admin rights, no user interaction and no non-default configuration, so any CP user with `accessCp` qualifies.
The AES-CBC-with-HMAC JWE path in Eclipse KeyPont gose (published as github.com/ThalesGroup/gose v0.9.0 through v0.13.0-rc1) provides no ciphertext integrity at all: HmacShaCryptor.Hash returned the MAC of the empty message for every input, so the authentication tag is constant per key and independent of the message. An unauthenticated remote attacker who has observed a single legitimately produced JWE under the target key can replay that tag onto arbitrary attacker-chosen header, IV and ciphertext and pass verification, enabling bit-flipping manipulation of the recovered plaintext and padding-oracle-style attacks; confidentiality alone is not broken. Only the CBC-HMAC direct encryption/decryption blocks are affected, AEAD/GCM modes do not use this cryptor, and the evaluator rates it AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N with no public exploit identified at time of analysis.
Unauthenticated memory exhaustion in Twisted's twisted.words.xish.domish XML element stream allows a remote peer to keep a container element open and stream child elements indefinitely, growing an in-memory element tree until the server process is killed. Every Twisted release up to and including 26.4.0 is affected, with the practical exposure limited to deployments that parse attacker-supplied XML streams through this parser - in practice XMPP servers and components built on Twisted, where the stream is parsed during negotiation before any credentials are accepted. The vendor fixed the issue in 26.10.0rc1 (PR #12751) by enforcing byte-size and element-count caps per stanza; there is no CISA KEV entry, and a public PoC reference in the advisory describes the stream-flooding steps but is not verified as working exploit code.
OS command injection chained with cross-site request forgery in ASUS router firmware allows an attacker to execute arbitrary commands with root privileges on the device by luring an administrator who is already logged in to the web management interface into visiting a phishing page. Rated CVSS 4.0 8.6 (high) and tracked as CWE-78, the flaw requires no credentials of the attacker's own (PR:N) but depends on user interaction (UI:A) with a valid authenticated administrator session on the victim side, which is the primary limiting precondition. It was reported to the CNA by ASUS, and no public exploit code or confirmed active exploitation was identified at time of analysis; the specific affected models, firmware versions and vulnerable endpoint are not enumerated in the available sources, which instead point to the vendor's security advisory for fixed firmware.
Authorization bypass in Apache Vysper's XEP-0077 In-Band Registration implementation allows any authenticated user to compromise other accounts on the XMPP server. All versions are affected, the project is retired and unsupported, and the vendor does not plan to release a fix; no public exploit was identified at time of analysis. The vendor's stated remediation is migration to an alternative XMPP server.
SQL injection in baserCMS 5.0.0 through 5.3.1 and 5.4.0 through 5.4.1 allows a user who can log into the admin panel to execute arbitrary SQL against the application database - including reading password hashes from the users table - by embedding SQL fragments in query parameters such as contain, conditions, fields, finder and order that the list and detail actions pass straight into the ORM. The earlier 5.3.1 and 5.4.1 fixes addressed only public pages and the public API, and setting USE_CORE_ADMIN_API to false does not block the authenticated browser path to the Admin and Api/Admin endpoints. Scoring is 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with CWE-89; exposure is gated by the admin-panel authentication requirement (PR:L), and no public exploit identified at time of analysis.
A heap use-after-free in OpenWrt's odhcpd DHCPv6 IA handler allows an unauthenticated client on the same local link or an adjacent IPv6 network to crash or corrupt the router's DHCPv6/RA daemon. The flaw lives in the per-message `first` lease pointer used to reuse a Reconfigure authentication key across multiple IA options: a REQUEST that binds one IA, then fails the on-link check on a later IA with the same IAID, frees the lease that `first` still references, and a subsequent IA copies 16 bytes from that freed chunk into a new lease's key. The validated impact is adjacent-network denial of service plus Reconfigure/ForceRenew key confusion (deterministically an all-zero key under the traced reclaim pattern); arbitrary code execution is not proven for this UAF alone, and a public maintainer reproduction bundle demonstrates the crash under ASan. It is not confirmed actively exploited (no CISA KEV listing), but it carries a 'this_week' priority and affects essentially every OpenWrt release from 18.06 through the 25.12 package pin.
Arbitrary file write outside the sandbox is possible through the FileChooser.SaveFiles portal method in xdg-desktop-portal before version 1.22.1: a malicious sandboxed application (for example a Flatpak app) can pass the optional 'files' filenames containing path-traversal components, which the frontend does not validate and which common backends append to the user-selected directory without checking. The result is the ability to create files at attacker-chosen paths on the host, bounded to files that do not already exist (existing files cannot be overwritten) and to locations the invoking user can write to, and it depends on the user engaging the save dialog. The vendor rates this 8.8 under CVSS 4.0, while the assessed CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N, which tempers real-world urgency; no public exploit code has been identified and the issue is not in CISA KEV, with a vendor patch released in 1.22.1.
PraisonAI versions 4.6.10 through 4.6.58 allow shell command injection through its compute-bridged file tools: when a LocalManagedAgent or SandboxedAgent is instantiated with a compute provider attached, the bridge rewrites read_file, list_files and write_file into shell command strings built from raw path arguments, so a crafted path can break out of the quoting and run arbitrary commands on the host (compute="local") or inside the container (Docker). Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation needs an authenticated low-privileged actor who can influence a file-tool path argument - for example via prompt injection, a chat endpoint or an automation webhook - and importantly does not require the operator to have granted the critical-marked execute_command tool, so least-privilege tool configurations do not prevent it. The vendor advisory ships a local proof-of-concept reproducer that confirms shell execution through a crafted path; no evidence of active exploitation is provided in the available data, and deployments without an attached compute provider or without the bridged file tools enabled are not affected.
PraisonAI's kernel-enforced SandlockSandbox silently degrades to ordinary subprocess execution when the optional sandlock module imports but reports that Linux Landlock is unavailable, so code that was supposed to be confined can read files outside the configured allowed paths and open network connections even when the native policy was created with network=False. The affected path is code executed through SandboxConfig.native() with SandlockSandbox in the pip package praisonai from 4.5.110 up to (but not including) 4.6.61; the read_file/write_file/list_files helpers still apply safe_sandbox_path checks and are not the exposed surface. CVSS 3.1 scores this 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) because the sandbox escape crosses a security scope with high confidentiality and integrity impact, while the attacker is positioned as a local, low-privileged party able to supply code to the sandbox rather than an unauthenticated network attacker. A public proof-of-concept script ships with the advisory (demonstrated against v4.6.58) that shows both boundary crossings; no confirmed active exploitation (CISA KEV) or public working exploit code is indicated, and the vendor released 4.6.61 as the fix.
Cross-site scripting in the PraisonAI HTTPApproval dashboard lets an attacker-controlled tool argument run same-origin JavaScript that silently approves a pending dangerous tool call before the human reviewer clicks Approve or Deny, defeating the human-in-the-loop safety boundary. Only deployments using the non-console `http` approval backend (praisonai.bots.HTTPApproval) in versions 4.5.2 through 4.6.58 are exposed (4.5.0 and 4.5.1 do not ship this backend); the CVSS vector (PR:N/UI:R) means no dashboard authentication is needed, but an approver must open the pending request's approval URL for the payload to fire. The issue is fixed in 4.6.59; a public PoC reference exists (a local proof-of-value script in the GitHub advisory that stops at the approval decision and does not run the command), and it is not verified as working exploit code against deployed instances, with no KEV listing or confirmed active exploitation at time of analysis.
PraisonAI's Discord approval backend (praisonai.bots.DiscordApproval, versions 4.5.2 through 4.6.58) treats any later non-bot message in the configured Discord channel as the approval decision for a pending dangerous tool call, so an authenticated low-privileged Discord user who can post in that channel can reply 'yes' to a pending shell command, file write/delete or deployment request without being the intended approver - the message need not be a reply, thread message, button interaction or token-bound response. Exploitation requires a specific deployment posture: DiscordApproval used as the human gate for high-risk tools, a request already pending with its prompt posted, and attacker write access to that channel; realized impact is bounded by whichever tools the agent exposes behind approval. Vendor-released patch: upgrade pip package praisonai to 4.6.59 or later; no public exploit against live deployments is identified - the accompanying proof-of-concept is a local, mock-based harness that is not verified as working exploit code against real Discord channels.
Improper shortcode handling in the Advanced Custom Fields: Extended and ACF Extended PRO WordPress plugins (versions 0.9.2.4 through 0.9.2.7) allows unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a front-end form whose stored configuration lacks the setting that disables shortcode processing in the confirmation message. Exploitation is conditional on the site publishing such a form, an attacker-uncontrolled precondition reflected by the high attack complexity; where that condition holds, no credentials or user interaction beyond a normal submission are needed. The impact is bounded to shortcodes registered on the target site rather than true arbitrary code execution, and the vendor has released a fix in 0.9.2.8; only a public PoC reference exists and it is not verified as working exploit code, with no confirmed active exploitation (CISA KEV) and this month's priority label.
Local privilege escalation in DJI CrystalSky ZS600C firmware 0.3.9.7 through 0.6.6.9 allows an unprivileged process already running on the Android device to write a crafted line to logcat that the root-privileged hardware_monitor helper passes to a shell eval, resulting in arbitrary command execution as root. The attack is strictly local: the attacker must first obtain a foothold on the device, so this is an escalation primitive rather than a remote entry point. No public exploit was identified at time of analysis, and the published CVSS 4.0 score of 8.6 reflects high confidentiality, integrity, and availability impact once the local prerequisite is met.
Disproportionate CPU consumption in Qt's QXmlStreamReader lets remote attackers render an application unresponsive by supplying a crafted XML document for parsing. Any application built on Qt (qtbase/QtCore) that feeds attacker-influenced XML into QXmlStreamReader is affected, with no confidentiality or integrity impact and no code execution - only availability of the parsing process. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (not in CISA KEV); vendor fixes exist as upstream qtbase commits, though a released patched Qt version is not independently confirmed, and the priority label places remediation in the current week.
Zimbra Collaboration Suite copies attacker-controlled URL parameters into servlet request attributes, letting a crafted /h/* link override the authentication token, target account, target item and dispatch state consumed by the Classic Web Client. On ZCS 10.1.16 this attribute override can be chained with CVE-2026-10632 so an attacker who holds their own valid Zimbra token can cause JavaScript to execute in a signed-in victim's browser session when that victim opens the link; the vector reflects network reachability, low privileges and required user interaction, with scope change and high confidentiality/integrity impact. ZCS 10.1.17 changes the document renderer and breaks the XSS chain, but the underlying attribute-override primitive is retained. No public exploit code or confirmed active exploitation was identified at time of analysis, and the priority signal places it in the this-week remediation band rather than an emergency one.
Reflected cross-site scripting in the Classic Web Client of Zimbra Collaboration Suite 10.1.16 lets an attacker who holds an ordinary Zimbra account run JavaScript in another signed-in user's Zimbra browser session when that user opens a crafted URL, allowing mailbox data to be read and authenticated actions to be performed as the victim. The injection point is the packages parameter of the /h/rest document editor, and practical exploitation depends on chaining CVE-2026-50053 so the attacker can supply their own authentication token and document identifiers in the URL. No public exploit identified at time of analysis, and the issue is assessed as a credible, moderately urgent item rather than a mass-exploitation emergency; ZCS 10.1.17 contains the fix.
Password-reset link poisoning in Part-DB Server (through 2.13.2) lets an unauthenticated remote attacker who can reach the public /pw_reset/request endpoint obtain a valid reset token for any known account, including the seeded admin, by submitting a forgot-password request with a spoofed HTTP Host header; the victim is emailed a genuine, valid token inside a link pointing at an attacker-controlled hostname, which the attacker then replays against the real instance to set a new password and take over the account. Exploitation is limited to installations that have email-based password reset enabled (ALLOW_EMAIL_PW_RESET=1) and leave TRUSTED_HOSTS empty, which the shipped configuration does by default, and the token only reaches the attacker if the victim opens the legitimate-looking email or an inbound URL scanner pre-fetches the link. The vendor advisory includes a detailed end-to-end reproduction; there is no CISA KEV listing and no confirmed active exploitation at time of analysis, and the vendor released a fix in 2.13.3.
Server-side request forgery in onPhase Forms 11.0.14 lets an unauthenticated remote attacker make the form server fetch an attacker-chosen URL from a publicly accessible, unauthenticated form, exposing sensitive data held in an internal Apache Solr instance. The flaw is rated 8.7 by the CNA and assessed by our team as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, meaning unauthenticated remote confidentiality impact with no integrity or availability effect. No public exploit code or confirmed active exploitation was identified at time of analysis; exploitation depends on the deployment actually publishing an unauthenticated URL-handling form to the internet and on a reachable internal Solr target.
Missing authorization in Zimbra Collaboration Suite 10.1.16 and 10.1.20 allows an authenticated delegated administrator holding no explicit administrative grants to overwrite the global Zimlet configuration through ConfigureZimletRequest. The injected configuration can add an attacker-controlled domain to the proxy allowlist of the default class of service, so a signed-in user in that class who opens a crafted /service/proxy URL is served attacker-controlled HTML from Zimbra's own origin, letting the resulting JavaScript read mailbox data and act as the victim. The admin-side escalation is remote and low-complexity but requires a delegated-admin account with admin SOAP service access (PR:L), and the browser compromise requires the victim to open the crafted URL (UI:R); no public exploit code has been identified at time of analysis, no KEV entry is present, and the vuln.today priority label is this_week rather than emergency.
Unauthenticated payment reuse in the Craft Commerce Mollie plugin (versions 2.1.1 through 4.4.2) allows anyone holding a single valid paid Mollie payment ID from the merchant's account to pair it with an arbitrary Craft Commerce transaction hash, causing that target transaction to be marked paid for its full amount and releasing goods or services without payment. No authentication or user interaction is required; the one concrete prerequisite is obtaining a genuinely paid payment ID belonging to the same merchant account, for example via a low-value legitimate purchase. The plugin is fixed in 4.4.3, and no public exploit has been identified at time of analysis.
Improper authentication in ASUS router firmware lets an unauthenticated attacker on an adjacent network-such as an associated Wi-Fi client or a device on the same LAN segment-send an HTTP request, forge an access ticket, and perform administrator operations. The affected router models and firmware versions are not specified in the available data, which uses a wildcard CPE for ASUS routers, and no public exploit has been identified at time of analysis. The issue is rated 8.7 and is prioritized this week.
XML external entity injection in Kitodo.Production 3.8.x and 3.9.x through 3.9.1 lets any authenticated user who can reach the 'Create process' file-upload dialog read server-side files and trigger outbound server requests by uploading a crafted EAD/XML document. The uploaded bytes are parsed by XMLUtils.parseXMLString, getNumberOfEADElements and checkIfXmlIsWellFormed, which build JAXP parser factories with default settings so DOCTYPE declarations and external entity resolution remain enabled (CWE-611); the upstream advisory documents a reproduction with a local-file canary, an out-of-band callback and a hardened-sibling negative control, though no confirmed weaponized exploit and no CISA KEV listing exist. A vendor patch ships in 3.9.2, and because the path requires only a low-privileged authenticated import user rather than anonymous access or admin rights, our assessment lands at CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L - a genuine but conditional priority rather than a mass-exploitation emergency, scheduled for this week.
Unauthenticated visitors to WordPress sites running the GTM Server Side plugin (stape.io, also published as Stape Conversion Tracking) versions 2.0.0 through 2.1.46 can cause another customer's complete WooCommerce order record - transaction ID, items, value, shipping and, when the plugin's 'User Data' option is enabled, name, email and billing address - to be rendered into the page's JavaScript dataLayer simply by setting the gtm_server_side_order_id cookie to an enumerable, sequential order ID and loading any page of the site. The root cause is that the guard restricting purchase-event output to the WooCommerce order-received endpoint was commented out, so the wp_footer hook trusts an integrity-free client-side value; version 2.1.47 moved the order ID into WC()->session and closed the direct cookie manipulation path, but full remediation only arrived in 2.1.48, which adds a once-per-order sent flag to stop full-page caching plugins replaying a legitimate purchase event to later anonymous visitors. CVSS 4.0 scores this 8.7 (AV:N/AC:L/PR:N/UI:N/VC:H) and the practical prerequisite is WooCommerce plus the 'Ecommerce' dataLayer feature being enabled; a public proof-of-concept reproduction procedure is documented in the GitHub advisory, though it is not verified as working exploit code, and no confirmed active exploitation (CISA KEV) is indicated. Priority is set to this_week rather than emergency because exploitation depends on that configuration prerequisite and yields read-only disclosure.
An out-of-bounds stack read in OpenWrt's odhcpd DHCPv6 server lets an unauthenticated client on the same IPv6 link disclose server stack memory, roughly four bytes per request, by placing a zero-length or otherwise truncated IA_NA/IA_PD option at the very end of the daemon's 8192-byte receive buffer; the disclosed bytes are reflected back to the sender as the IAID in odhcpd's DHCPv6 reply. Every inspected OpenWrt stable release from 17.01.0 through the 25.12.x series pins a vulnerable odhcpd commit, and the impact is confidentiality-only (assessed CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). A validated proof-of-concept reproducer, published alongside the upstream advisory, leaks the saved stack canary on ARM, but there is no CISA KEV listing and each probe returns only about four bytes, so defeating canary and ASLR protections requires many requests.
Path traversal in the Vvveb CMS backup controller lets an administrator-supplied 'file' GET parameter be concatenated onto the backup directory path without sanitization in the nextRestore() and nextBackup() actions, allowing arbitrary server-side file reads (and SQL execution of the read content) and arbitrary-path writes of database dump data with a forced .sql suffix. All installations of Vvveb 1.0.8.6 and prior are affected by default; exploitation requires a valid authenticated administrator session (CVSS PR:H), so this is an access-gated issue rather than a drive-by threat. A public PoC reference exists in the GitHub advisory (curl requests against nextRestore); it is not verified as working exploit code, and no active exploitation has been confirmed (not in CISA KEV). Vendor-released fix: commit aa29cb0, shipped in version 1.0.8.7.
Code injection in the ConvExpr function of CGM CLININET allows a high-privileged, authenticated user to execute arbitrary Perl code with root privileges on the hospital system by way of crafted RTF document content. The CVSS 4.0 vector (AV:A/PR:H/UI:A, score 8.6) shows the flaw is only reachable from the adjacent network by an account that already holds elevated rights, and it requires the content to actually be processed, so remote unauthenticated exploitation is not possible and the practical threat is a trusted insider or an attacker who has already captured privileged credentials on the hospital network. Affected releases are confirmed through 2026.MS3, the vendor has not published an upper bound, and no public exploit code has been identified at time of analysis.
Missing authorization in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows a local application with no Android permissions to invoke binder transaction 1018 on android.dji.server and execute arbitrary OS commands as root through the root-privileged assistant daemon. The attack is local only and requires the ability to run code on the physical device; no public exploit has been identified at time of analysis. The reported CVSS 4.0 base score is 8.6 (High), and the independent CVSS 3.1 assessment is AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Uni-CLI before 0.225.2 leaves the legacy stateless JSON-RPC-over-HTTP MCP transport listening on loopback without validating browser Origin headers, so a malicious page loaded in a browser on the same host can send a CORS simple POST (for example with Content-Type text/plain) to the local /mcp endpoint and reach the JSON-RPC dispatcher, driving tools/call requests against the user's local server. The flaw is unauthenticated (PR:N in the assessed vector) but requires user interaction - the victim must open the attacker's page - and only applies when the user has explicitly started the non-default legacy HTTP MCP transport; the stdio default and the Streamable HTTP transport, which already enforced the boundary, are not affected. Patched in 0.225.2; no public exploit code has been identified at time of analysis, and the issue is confined to the browser-to-localhost boundary rather than changing Uni-CLI's local-code-execution trust model.
Stored cross-site scripting in Phoca Gallery 4.5.0 through 6.1.5 allows an attacker who can create or edit gallery content to inject HTML attributes that execute in a victim's browser when the affected gallery page is viewed. The vendor/EUVD CVSS 4.0 base score is 8.6, while our independent CVSS 3.1 assessment uses PR:L/UI:R and rates impact as low confidentiality/integrity with scope change. No public exploit identified at time of analysis, and vuln.today assigns a this_week decision label.
Unauthenticated remote agent invocation in PraisonAI LinearBot 4.6.56 through 4.6.58: because LINEAR_WEBHOOK_SECRET is treated as optional and defaults to an empty string, the aiohttp webhook listener bound to 0.0.0.0 skips Linear-Signature HMAC verification entirely, so any network caller who can reach the endpoint can POST a forged 'Linear-Event: AgentSession' request that is parsed, backgrounded, and dispatched into BotSessionManager.chat(), causing the bot to run the configured agent and post comments back to Linear under the bot token. Exploitation requires the operator to have started LinearBot with a Linear token but without a webhook secret, and the listener to be reachable; deployments that do set the secret reject missing and invalid signatures with 401 before dispatch. A public proof-of-vulnerability harness exists that exercises the handler offline and monkey-patches the outbound comment path; it is not verified as working exploit code against deployed instances, and there is no confirmed active exploitation (no KEV entry).
Blind SQL injection in the GamiPress WordPress plugin, affecting all versions through 8.0.7, lets an authenticated user inject SQL into plugin-side queries, with the assessed impact being high loss of confidentiality and limited integrity impact while scope remains unchanged. Exploitation requires a valid authenticated session on the target WordPress site (PR:L) plus network reachability, so an attacker must first hold or obtain a site account; the minimum role and the specific vulnerable parameter or feature are not described in the available sources. No CISA KEV listing appears in the supplied data and no public exploit was identified at time of analysis, and the vulnerability is prioritized as a this-week item rather than an emergency response.
Privilege escalation and possible arbitrary code execution in HP One Agent on certain HP PC products stem from an uncontrolled search path element (CWE-427), which lets a file planted in a location the agent searches be loaded in place of a legitimate component. The flaw is local, not remote: an attacker must already hold a low-privileged account on an HP PC where HP One Agent is installed, after which no user interaction is required and confidentiality, integrity and availability impacts are all rated high (CVSS 4.0 base 8.5; vendor-assessed CVSS 3.1 7.8). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority label places it in this week's remediation queue rather than an emergency; HP has published advisory HPSBHF04150 covering software updates.
Arbitrary PHP file upload leading to code execution in baserCMS: any account in the default 'operators' group can store and execute PHP under the document root once an administrator installs the BcCustomContent plugin and leaves the pre-selected 'available to all users' radio in place during installation. Affected are baserCMS 5.0.0-beta1 through 5.3.1 and 5.4.0 through 5.4.1; BcCustomContent is not part of BcApp.defaultInstallCorePlugins, so stock installs are not exposed until an administrator adds the plugin and accepts that default. The vendor advisory publishes a full reproduction procedure (a public PoC reference; it is not verified as weaponized exploit code), there is no CISA KEV entry, and vuln.today priority places remediation in this week's work rather than an emergency response.
Local arbitrary command execution in Aider through 0.86.2 is possible when the CLI auto-loads a repository-supplied .aider.conf.yml without a trust prompt and honors attacker-controlled notifications-command or editor values. Those values are executed via subprocess with shell=True, running with the victim's privileges after a model reply or /editor invocation; no attacker authentication or elevated privileges are needed, but the victim must operate Aider inside the hostile repository. The issue is not listed as KEV in the supplied data, and no public exploit identified at time of analysis.
Local io_uring CONNECT BPF filter bypass in Linux kernel 7.2 and 7.3 lets a low-privileged process reach AF_INET6 destinations that an administrator-configured filter intended to deny. The bug is a length-threshold mismatch: at addr_len 24 (SIN6_LEN_RFC2133), io_connect_bpf_populate() leaves connect.port and connect.v6_addr zero while the kernel connects to the real destination, so filters that deny specific IPv6 ports or addresses are bypassed. The upstream commit describes a verified reproducer; no CISA KEV active-exploitation listing is provided, EPSS is low at 0.21% (11th percentile), and the assessed impact is limited confidentiality/integrity loss rather than remote compromise.
Locked mount expiry in the Linux kernel can be abused by an authenticated local user to unmount a mount that was supposed to stay locked, revealing the files and directories it was hiding. The attacker must first own an unprivileged user namespace, use MOVE_MOUNT_BENEATH to migrate the locked property onto a bottom mount, and then unmount or expire the now-unlocked ancestor so shrink_submounts() tears down the hidden bottom mount. The result is a confidentiality-only exposure of otherwise covered paths (assessed C:H/I:N/A:N); EPSS is low (0.21%, 10th percentile) and no public exploit code was identified at time of analysis, but vendor fixes are available and the issue is prioritized as this_week.
Arbitrary file write through path traversal in pghoard 2.7.1 and earlier allows an authenticated attacker with write access to the backup object store to place files outside the PostgreSQL data directory when a database administrator runs a restore. The attacker poisons a delta backup manifest with traversal sequences, and pghoard_restore get-basebackup then writes the payload to attacker-chosen host paths, which can lead to code execution or system compromise under the restore account. The issue is rated CVSS 8.4 and requires both the storage-write prerequisite and a legitimate restore action; only versions up to 2.7.1 are affected, 2.7.2 contains the fix, and no public exploit was identified at time of analysis.
Host-header injection in OpenReception's confirmation-email path lets unauthenticated remote attackers redirect a pending invitee's one-time confirmation token to an attacker-controlled host and then claim that account before the legitimate invitee ever onboards. The unauthenticated POST /api/auth/resend-confirmation rotates a pending invitee's token and builds the emailed link from the request Host with no allowlist, so a single request carrying a spoofed Host and the victim's email address produces a genuine onboarding email whose only link points at the attacker. Because the account is claimed first and bound to an attacker-registered WebAuthn passkey, the attacker gains a full session in the invited role (staff or tenant admin), with read and potentially modify access to client and appointment data; a public proof-of-concept package is attached to the advisory and reported to demonstrate the flow end-to-end against the official image, though it is not independently verified as working exploit code. Exploitation requires the victim to click the poisoned link (UI:R) and depends on the front proxy forwarding an arbitrary Host, which the stock Caddy catch-all does.
Reflected cross-site scripting in phpBB's registration module allows an unauthenticated remote attacker to execute script in a victim's browser session when the victim opens an attacker-crafted link. The flaw is CWE-79 and requires user interaction; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so the direct impact is limited to confidentiality and integrity within the changed scope rather than server compromise. No public exploit identified at time of analysis.
Predictable FileTransfer tokens in XDG Desktop Portal let a malicious sandboxed application redirect drag-and-drop and copy-paste data intended for other applications to itself. Through version 1.22.0, tokens used by the FileTransfer.RetrieveFiles portal method were generated with g_random_int or g_uuid_string_random, both backed by GLib's GRand Mersenne Twister PRNG, so collecting enough tokens lets an attacker recover the generator state and predict the next token that would normally authorize an out-of-band resource transfer. The assessed vector is local with high attack complexity and low privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N): the attacker needs a hostile or compromised sandboxed app already running on the desktop, plus a victim drag-and-drop or copy-paste for data to be redirected. The vendor released a patch in 1.22.1; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is prioritized as this_week rather than an emergency.
Slack app_mention events in the PraisonAI bot (PyPI package praisonai, versions 3.11.0 through 4.6.58) skip the allowed_users, allowed_channels and unknown_user_policy checks that the normal message handler enforces, so any Slack workspace member who can mention the bot in a channel where the app is installed can drive the configured agent even when the identical event content is dropped by the message path. The root cause is missing authorization (CWE-862, also tracked as CWE-863) in src/praisonai/praisonai/bots/slack.py, and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L (8.3, High) - network reachable, low complexity, and authenticated, since the attacker must already hold Slack workspace membership and be able to mention the bot. A public PoC reference exists in the form of a local-only harness that mocks Slack Bolt and the Slack SDK in-process and does not connect to Slack; it is not verified as working exploit code against a live deployment, and there is no confirmed active exploitation (no CISA KEV listing). Remediation is prioritized as this week rather than an emergency.
Out-of-bounds write in the Snap7 S7 communications library through 1.4.3 lets a malicious active partner crash or corrupt the process of any application acting as a passive BSend/BRecv partner - typically a SCADA front end, HMI gateway or data collector listening on TCP/102. The library stores the BSend total length declared by the peer (up to 65535) rather than the number of bytes actually reassembled, and BRecv as well as the asynchronous CheckAsBRecvCompletion path hand that length straight to memcpy without any knowledge of the caller's buffer capacity, so even correctly written applications overflow. Vendor patch data indicates a fix is available via PR #41 (no tagged release version is stated in the provided data), an AddressSanitizer PoC was produced by the reporter but withheld rather than published, and no public exploit code or CISA KEV entry was identified at time of analysis; exploitation requires reaching TCP/102 from (or successfully spoofing) the configured peer address, which is the constraint behind the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N with high integrity and availability impact and no confidentiality impact.
reCAPTCHA verification bypass in the Profile Builder WordPress plugin 4.0.0 through 4.0.4 lets authenticated users post comments through submission paths that do not enforce the administrator-configured anti-spam check. The issue is low-severity and limited-impact, only affecting sites where reCAPTCHA is enabled for the WordPress comment form; a public PoC reference exists, but it is not verified as working exploit code. The vendor has released a fixed version, 4.0.5.
WireGuard in Zephyr (subsys/net/lib/wireguard) accepts an unauthenticated transport-data datagram and copies its source address into peer->endpoint, letting any host that can reach the listener's UDP port 51820 off-path redirect all subsequent handshake initiations, keepalives and encrypted tunnel traffic to an address of the attacker's choosing. Affected builds are Zephyr 4.4.0 through 4.4.2 with CONFIG_WIREGUARD enabled, which is marked experimental and off by default, and the defect fires only while the targeted peer has no valid handshake and no current keypair - the state at boot and after a session expires. The result is persistent tunnel denial (assessed A:H) and limited confidentiality loss (C:L) through traffic-metadata observation or selective dropping if the attacker relays redirected initiations; the Noise/AEAD cryptography prevents decryption or forgery, so keys are not compromised. The advisory's original report includes a 16-byte datagram recipe as a proof of concept; it is not verified as working exploit code, no public exploit is confirmed in use, and KEV status is not indicated - exploitation requires only UDP reachability to the listener, with no credentials or user interaction.
CGM CLININET stores user passwords as unsalted MD5 hashes, so once a credential store is obtained the passwords can be recovered quickly offline rather than remaining protected by a slow, per-user-salted hash. All versions tracked by the supplied CPE for the product are in scope; the vendor fixed the issue in releases 2026.MS1 and 2026.MS3. The flaw is passive and only weakens credential protection after the hashes are already exposed - it does not itself grant access - but the resulting disclosure of user passwords is rated high severity (CVSS 4.0 base 8.2). No public exploit code has been identified, there is no CISA KEV listing, and priority guidance places remediation in the current week rather than as an emergency.