Linux WireGuard can derive the same session twice when two threads consume an identical handshake response and a queued initiation resets peer state in between, allowing the late thread to copy stale crypto state back and establish a session already created by the first thread. The affected population is Linux kernels from 5.6 onward that use the in-kernel WireGuard driver and have an active peer handshake; exploitation requires winning a narrow multi-threaded timing race, which the maintainers describe as practically impossible to hit. No public exploit identified at time of analysis, EPSS is 0.21% (10th percentile), and the assessed real-world priority is low despite the 7.7 CVSS score.
Denial of service in the GraphQLPhoneNumber scalar of the graphql-scalars npm package (versions 1.24.1 through 2.0.0) lets an unauthenticated remote client stall a Node.js server process with a single request of roughly 30 characters placed in any PhoneNumber-typed argument, input-object field or variable. The scalar's regex backtracks exponentially on a run of digits followed by a failing character, and graphql-js runs parseLiteral during document validation and parseValue during variable coercion before any resolver authentication or authorization, so the work happens even on requests that would ultimately be rejected. The advisory (GHSA-x8rm-f576-gq67) includes a reproduction script with measured timings and the maintainers have released version 2.0.1 with a linear-time pattern; there is no CISA KEV listing, and the preconditions are limited to schemas that actually expose this scalar on attacker-controllable input.
Unauthenticated remote memory exhaustion in Twisted's conch telnet transport lets any peer that can reach an exposed telnet or manhole endpoint terminate the server process - and with it every service that process hosts - by opening a subnegotiation with IAC SB and then streaming bytes without ever sending the IAC SE terminator. The per-connection subnegotiation buffer has no length limit and persists across reads, so it grows for the life of the connection with several-fold memory amplification from per-byte Python object overhead; no confidentiality, integrity, or code-execution impact is involved (CVSS 7.5, CWE-400/CWE-770). Twisted releases through 26.4.0 are affected and the flaw is fixed in 26.10.0rc1; there is no KEV entry confirming active exploitation, and the advisory provides reproduction steps (IAC SB followed by unfragmented payload) rather than verified working exploit code, while the vuln.today decision label is this_week.
Unauthenticated remote memory exhaustion in Twisted's IRC server (twisted.words) lets a single TCP connection that never sends a line feed grow the per-connection buffer without limit, driving the shared twistd words process to out-of-memory and dropping every connected user. All versions up to and including 26.4.0 are affected, specifically deployments running twisted.words.service.IRCUser (the twistd words service) or any custom server built on twisted.words.protocols.irc.IRC; the buffering happens before PASS, NICK, or USER, so remote attackers need no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5). The GitHub advisory documents a measured reproduction in which a single unauthenticated connection sending 60 MB of line-feed-free data raised server resident memory from roughly 47 MB to 2966 MB; that reproduction is a diagnostic reference rather than confirmed standalone exploit code, and there is no KEV entry or other indication of active exploitation.
Heap out-of-bounds read in the iscsiuio DHCPv4 option parser, part of open-iscsi, allows an attacker on the same Layer-2 segment to send a crafted DHCP response that can crash the daemon, corrupt its network configuration, and potentially disclose limited heap data. Deployments at risk are those running iscsiuio for iSCSI offload, notably on Broadcom bnx2/cnic NICs, and using DHCP-driven iSCSI configuration; Red Hat tracks Red Hat Enterprise Linux 6 through 10. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) was provided; the issue is rated moderate priority (this_week).
Arbitrary code execution in @rog0x/mcp-git-tools 1.0.1 is reachable through the package's resolveBaseBranch function when it processes attacker-controlled input, such as a crafted base-branch name or repository handled by a victim's MCP server or agent. Per the assessed CVSS vector the flaw is network-reachable and requires no authentication (PR:N), but attack complexity is high (AC:H) and the user or agent must actively interact with the tooling (UI:R) before the condition aligns; the exact trigger inside resolveBaseBranch is not described in the available sources. No CISA KEV entry or EPSS signal was supplied, and no verified working exploit code is documented - the references include a public GitHub issue thread for the project that should be treated as a public report reference rather than confirmed exploit code. Practical risk is further narrowed by the package's very small deployment footprint, and the overall decision label is this_week rather than immediate emergency action.
Unauthenticated on-link DHCPv6 REPLY messages can crash connmand - which runs as root - on hosts running ConnMan through 2.0 with DHCPv6 active, giving an adjacent-network attacker a denial-of-service primitive; the assessed impact is availability-high with a limited integrity effect and no confidentiality impact. Triggering it requires the victim to accept a forged Router Advertisement with the Other-config flag set (O=1) and then a forged REPLY whose xid and CLIENTID match the in-flight exchange and that carries a DOMAIN_LIST option of at least 1025 non-zero bytes. No public exploit code was identified at time of analysis, and the issue is on-link only, not reachable across routed networks.
OpenReception appointment booking software 2.1.0 and earlier lets remote attackers brute-force a returning client's six-digit booking PIN inside a targeted tenant, because the PIN throttle record is keyed on a tenant-independent email hash and its tenant_id is fixed by whichever tenant first logged a failure, so the victim tenant's challenge check never matches the row and never returns 429. A successful guess yields the client's booking access token, exposing their end-to-end-encrypted appointment tunnel and allowing appointments to be added or cancelled as that client. No vendor patch is available at time of analysis, and the published advisory includes step-by-step reproduction detail plus measurements of roughly 79 guess round-trips per second locally; the generic 20-requests-per-2-seconds IP limiter can be sidestepped by rotating the unvalidated x-forwarded-for header.
Zephyr's OpenThread joiner autostart can cause an uncommissioned device to join an attacker-controlled Thread mesh because the build defaulted to the public Joining Device Credential 'J01NME'. Builds with CONFIG_OPENTHREAD_JOINER_AUTOSTART=y that leave CONFIG_OPENTHREAD_JOINER_PSKD unset are affected, and an attacker within 802.15.4 radio range running a commissioner with that same PSKd can complete commissioning and supply an arbitrary operational dataset. A reporter-supplied PoC reference exists but is not independently verified as working exploit code; joiner autostart is not enabled by default and no in-tree Zephyr sample uses the vulnerable combination.
Unauthenticated, network-reachable resource exhaustion in e-SIC Livre (esiclivre) v0.2.2 and earlier lets remote attackers force the CAPTCHA generator at restrito/inc/captcha.php to consume excessive memory and CPU by supplying unvalidated values for the l, a, tf and ql parameters. The CVSS 3.1 vector rates this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so the confirmed impact is availability only - no confidentiality or integrity loss. EPSS is low at 0.26% (17th percentile) and there is no CISA KEV entry, so no confirmed active exploitation; a public PoC reference exists (github.com/brynax/CVE-2026-50787) but is not verified as working exploit code, and priority is 'this_week'.
WPMobile.App (wpappninja) WordPress plugin versions through 11.86 expose an unauthenticated missing-authorization weakness that can disclose sensitive information to remote attackers. The flaw is rated CVSS 7.5 with confidentiality-only impact, and no public exploit was identified at time of analysis. Sites running the affected plugin are exposed when the vulnerable plugin functionality is reachable.
An error-path defect in the Linux kernel's dpaa2-switch driver allows an attacker on the adjacent network to push a received frame into the driver's failure branch, where the wrong cleanup helper is invoked on a receive frame descriptor. The result is memory corruption and potential kernel crash on systems running the NXP DPAA2 Ethernet switch, affecting kernel versions before the fixes in 5.15.222, 6.1.189, 6.6.158, 6.12.111 and 6.18.53 (mainline 7.2). Exposure is narrow - only NXP DPAA2/Layerscape hardware actively using this switch driver is affected - and the assessed vector is AV:A/AC:H/PR:N/UI:N with low integrity and high availability impact; EPSS is low at 0.21% (11th percentile), no CISA KEV entry and no public exploit identified at time of analysis.
In the Linux kernel bnxt_en driver, the transmit path DMA-maps only the original unpadded length of small frames while the TX buffer descriptor tells the Broadcom NetXtreme-E NIC to read the padded length, so the hardware can DMA-read past the mapped region and into an unmapped page. Affected systems are kernels with the bnxt_en driver on Broadcom NetXtreme-E hardware (for example BCM57412), Intel IOMMU/VT-d translation enabled, and traffic on VLAN or macvlan interfaces carrying sub-52-byte frames such as 42-byte untagged ARP; the overrun only faults when skb->data sits within the pad bytes of a 4 KB page boundary, a layout condition that is not reliably attacker-controlled. The result is an IOMMU DMA Read fault (DMAR 'PTE Read access is not set'), firmware aborts and TX queue timeouts rather than any confidentiality or integrity impact; the score is high (7.5, availability-only) but real-world urgency is low, EPSS is 0.21% (10th percentile), no CISA KEV entry exists, and no public exploit has been identified at time of analysis. The trigger requires the specific hardware, IOMMU, VLAN/macvlan and small-frame combination to coincide, and the issue was exposed only after commit 447cbe95ebb9 raised LL_RESERVED_SPACE from 48 to 64 bytes.
Information disclosure in the Linux kernel networking stack: when skb_copy_and_csum_bits() hits unreadable skb fragments it copies only the linear portion and returns 0, leaving the rest of the caller's buffer holding whatever was already in memory - and that buffer is then transmitted (an ICMP error quoting the offending packet, or a driver TX bounce buffer reached via skb_copy_and_csum_dev()). Kernels carrying the vulnerable code, roughly the 6.12 branch up to the fixed releases 6.12.113, 6.18.57, 7.2.11 and 7.3, are affected, but the leak only becomes reachable with the specialized, non-default configuration that produces unreadable/devmem fragments. No public exploit has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and because the resulting checksum usually no longer matches the data most receivers drop the packet, so the practical exposure is limited to passive on-path observation of stale buffer contents rather than attacker-chosen memory.
Kernel crashes in the Linux NVMe-oF target (nvmet) when a PCI peer-to-peer metadata allocation fails, because the cleanup path releases the successfully allocated data SGL against a req->p2p_dev device reference that has not yet been assigned, instead of the local p2p_dev used for the successful allocation. Only systems acting as an NVMe-oF target with P2P DMA memory and namespace metadata/protection information enabled are exposed, a non-default and specialised configuration; the failure itself is a P2P memory pool exhaustion condition rather than something an attacker directly controls, which is why our assessment raises the complexity to AC:H despite the vendor's AV:N/AC:L scoring. Impact is availability-only (C:N/I:N/A:H), EPSS is a low 0.21% (10th percentile), the issue is not listed in CISA KEV, and no public exploit has been identified at time of analysis.
Memory is leaked in the Linux kernel's gve (Google Virtual Ethernet) driver when an RX completion descriptor arrives with the error bit set while AF_XDP zero-copy sockets are in use: the buf_state and its attached XSK buffer are never freed, so leaked buffers accumulate over time. Only hosts running the gve driver - which is specific to Google Cloud environments - with AF_XDP zero-copy configured on the RX path are exposed, so this is not a default configuration, and the sources do not show how an external party could deterministically force error-flagged RX descriptors. Available scoring is mixed: the published CVSS 3.1 vector claims 7.5 (AV:N/AC:L/PR:N/UI:N/A:H) while the assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, reflecting gradual resource exhaustion rather than a hard availability hit; EPSS is low at 0.21% (10th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis.
Kernel panic and denial of service can affect arm64 Linux systems using the ice driver with Intel E810/E830-class NICs under sustained transmit load, where relaxed MMIO doorbell writes may be reordered before the DQL byte-accounting update and trip a BUG_ON in dql_completed(). The assessed severity is CVSS 3.1 7.5 with AC:H, reflecting that this is a timing race requiring a specific architecture, driver, NIC and heavy Tx traffic rather than attacker-controlled input; EPSS is 0.21% (10th percentile) and no public exploit was identified at time of analysis. Fixed kernels are available (6.18.57, 7.2.11 and 7.3), and the priority label is this_week.
Remote code execution in @rog0x/mcp-docker-tools 1.0.1 is possible when the MCP server is deployed and an operator or AI agent invokes the Docker image-listing path, allowing attacker-controlled data supplied to handleImageList to reach code execution. The CVSS 3.1 score is 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), so exploitation is unauthenticated from the network but requires user interaction and non-trivial conditions. No confirmed working exploit or CISA KEV entry is present in the available data; the decision label is this_week.
Apache Vysper, the Apache MINA XMPP (Jabber) server library, performs unbounded allocation while parsing XML, so a remote sender can drive the server into an out-of-memory condition and take it down. Every released version is affected, and per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, availability-only, 7.5 high) no authentication or user interaction is required - the only prerequisite is network reachability to an exposed Vysper endpoint that parses attacker-supplied XML. Apache has retired the project and states it does not plan to release a fix, so remediation means replacing it; no public exploit code or PoC reference was identified in the supplied sources at time of analysis, and the priority decision label is still awaiting_data.
The A2U agent event-stream server shipped with PraisonAI exposes unauthenticated endpoints for any operator who starts the documented `praisonai serve a2u` CLI entrypoint without first setting the A2U_AUTH_TOKEN environment variable, and this gap persists across versions 4.5.115 through 4.6.60 despite the earlier GHSA-f292-66h9-fpmf advisory claiming the unauthenticated-stream issue was fixed in 4.5.115. Remote unauthenticated attackers (CVSS PR:N) who can reach the service - which requires binding to an external interface such as `--host 0.0.0.0`, since the default loopback bind limits exposure to the local host - can subscribe to live agent event streams and read stream metadata, agent responses, tool calls and thinking/progress events, for a confidentiality-only impact rated 7.5. A public local-only PoV script and reproduction output exist in the advisory; that PoV is a harness shim rather than verified working exploit code against a live deployment, and there is no CISA KEV listing or other confirmation of active exploitation. The decisive mitigating control is that pre-setting A2U_AUTH_TOKEN before startup enables the route-level token check and returns 401, making this a config-dependent, default-off authentication gap rather than an unconditionally reachable flaw.
PraisonAI 3.8.1 through 4.6.58 lets an attacker who can influence the arguments of the Dynamic Context Discovery artifact helper tools read arbitrary files from the host running the PraisonAI process. The artifact_head, artifact_tail, artifact_grep and artifact_chunk helpers accept a caller-supplied artifact_path and wrap it straight into an ArtifactRef without checking that the path lies under the configured artifact base directory or was actually produced by the artifact store, so an absolute path such as a project .env file, cloud credential, SSH key or source file is read back verbatim. The flaw only exists in deployments that enable setup_dynamic_context() and pass ctx.get_tools() to an Agent, and because the score assumes the agent is exposed over a network surface with unauthenticated prompts (CVSS:3.1/AV:N/AC:L/PR:N/UI:N with confidentiality-only impact), authentication gating on that surface would lower the practical risk. The issue is patched in 4.6.59; the vendor advisory contains a local-only proof-of-value script, it is not verified as working exploit code against a remote deployment, and there is no KEV listing.
Path traversal in PraisonAI's Dynamic Context module lets a caller of the exported agent tools (history_search/history_tail/history_get and terminal_tail/terminal_grep/terminal_commands) supply a run_id that is an absolute path, or an agent_id containing '../', so that the underlying HistoryStore and TerminalLogger build file paths that resolve outside the configured base directory. Versions 3.8.1 through 4.6.58 are affected; the flaw is confidentiality-only and constrained, since readable targets must carry the tool-imposed suffix (.jsonl for history tools, .log for terminal tools) and be readable by the PraisonAI process. The vendor has released 4.6.59, no CISA KEV entry or confirmed active exploitation is reported, and the advisory ships only a local proof-of-value harness that exercises the traversal against an installed package - a public PoC reference exists; it is not verified as remote working exploit code.
Stored cross-site scripting in the LiteSpeed Cache WordPress plugin before 7.9.2 allows unauthenticated users whose comments are published to inject event-handler attributes into front-end pages, which then execute JavaScript in the browser of any visitor - including a logged-in administrator - while the plugin's HTML optimization is enabled. The flaw is a two-part chain: an HTML optimization routine is not confined to stylesheet content and strips the markup that closes an attribute in the rendered page, while comment author output is left unescaped, together allowing attribute injection. Exploitation is not automatable and requires the optimization feature to be active, the attacker's comment to be published, and a victim to view the affected page; no public exploit has been identified at time of analysis, and a vendor fix exists in 7.9.2.
Stored cross-site scripting in the LiteSpeed Cache plugin for WordPress versions before 7.9.2 lets an unauthenticated commenter whose comment gets published inject HTML attributes that execute JavaScript in the browser of any visitor viewing front-end pages, including a logged-in administrator. The root cause is an HTML-rewriting routine that is not restricted to stylesheet content and strips a quote which normally terminates an attribute, which combined with unescaped comment-author output makes attribute injection possible. Exploitation is gated by the affected rewrite/optimization option being enabled and by the attacker's comment being published (comment approval or moderation blocks it); no public exploit has been identified at time of analysis and there is no CISA KEV entry, though CISA SSVC rates technical impact as total.
Stored cross-site scripting in the Otter Blocks WordPress plugin before 3.2.8 allows unauthenticated attackers to plant markup that executes in the browser of any visitor - including a logged-in administrator - who views an affected page. The flaw sits in the block-rendering rewrite of dynamic-content tokens, where an improperly bounded pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. Exploitation requires that affected pages actually use the dynamic-content tokens and that a victim loads the page; no public exploit has been identified at time of analysis, and the CISA SSVC assessment records exploitation as none.
Unauthenticated arbitrary file read affects the Music Store - WordPress eCommerce plugin in all versions up to and including 1.4.7, where the download handler in ms-download.php passes the 'f' parameter into a file path without proper traversal protection, exposing wp-config.php, credential files and any other content readable by the web server process. The only gating requirement is a valid purchase_id token, which per the reported description any visitor can obtain through a single low-cost purchase or a shared download link, so no WordPress account or elevated privilege is needed. There is no CISA KEV listing and no confirmed public exploit code at time of analysis, but the flaw is remotely reachable at low complexity with high confidentiality impact (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and the plugin's fixed release 1.4.8 is already published.
Command injection in @justice8096/sagemath-mcp-server 1.0.1 allows remote attackers to execute arbitrary code because the escapeShellString and sanitizeCode routines fail to adequately neutralize attacker-supplied input before it reaches shell execution. Only version 1.0.1 is identified as affected, and exploitation requires the package to be deployed and to process malicious input that a user or agent must route into the sanitization path (UI:R), with a payload specifically crafted to bypass both functions (AC:H). No CISA KEV entry or confirmed working exploit code was reported; a public issue reference exists, and the product's very small install base limits realistic exposure.
Account takeover in OpenReception's appointment booking software before 2.2.1: whoever holds a pending invite token can replay it during its thirty-minute validity window and receive a fresh passkey-registration bootstrap credential, letting them enrol their own passkey on the invited account and, for staff or tenant-admin invites, reach the tenant context tied to that account. The endpoint is reachable without authentication over the network and rated CVSS 7.4, although the attacker must first obtain the emailed token and act before the legitimate invitee completes passkey setup. No confirmed active exploitation (CISA KEV) is reported; the vendor advisory publishes reproduction steps as a public PoC reference, and the issue is fixed in version 2.2.1.
Linux kernel IPv4 handling of ICMP Fragmentation-Needed and Redirect messages that quote a UDP packet creates a FIB nexthop exception (FNHE) only after the quoted packet is matched to an existing socket, so an unauthenticated remote attacker operating off-path can use the presence or absence of that cache entry as a side channel to discover the ephemeral port of a connected UDP socket. The leak is probabilistic and requires repeated guesses and observation rather than a single deterministic request, and the assessed impact is confidentiality-only: the attacker learns a port number, which is primarily useful as a precursor to off-path injection rather than for direct host compromise. The issue is fixed in Linux 7.2.11 and 7.3 (stable commits be4fd05398f2b5e42029be70ee875fc749b8ce3a and 4c3499f79f8c7e8561266bcc220a18538cec0458); EPSS is 0.21% (11th percentile), there is no KEV listing, and no public exploit was identified at time of analysis.
Local use-after-free in the Linux kernel EDAC/altera driver (Altera Arria 10 SoC FPGA error-detection support) lets a local user potentially corrupt memory or crash the kernel when the driver's probe or port-B setup path fails. Only systems built with CONFIG_EDAC_ALTERA and running on Altera/Intel SoC FPGA hardware are affected, and the flaw requires the setup error path to be taken while a managed single- or double-bit ECC IRQ fires in the narrow window after the dci structure is freed but before the managed IRQs are unregistered - a hard-to-hit timing condition. CVSS is rated 7.4 High, but EPSS is only 0.21% (10th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, and vendor fixes are available in Linux 6.18.56, 7.2.10 and 7.3.
Electron before 42.11.16, 43.8.1, 44.9.1 and 45.0.0-beta.6 fails to enforce the blocklist for a set of compromised eMudhra intermediate certificates, so a TLS chain terminating in one of those intermediates is still accepted by Chromium networking and by Node.js tls, https and fetch. An attacker who already holds a leaf certificate issued under one of those intermediates and who can intercept the victim app's network traffic can impersonate a TLS server to that app, breaking both confidentiality and integrity of the connection; the CVSS vector scores this 7.4 with AC:H, unauthenticated (PR:N) and no user interaction, reflecting that the MITM position is the binding constraint. Apps that make no network connections are not affected, and the vendor states there are no app-side workarounds - only an update to a patched Electron release closes the gap. No public exploit code has been identified at time of analysis, and the issue is not in CISA KEV, so the practical risk is a conditional interception scenario rather than a broadly exploited one.
Kruize Autotune's unauthenticated REST API returns configured monitoring-datasource credentials-basic-auth passwords, bearer tokens, API keys, and OAuth2 client secrets-in cleartext through GET /datasources and the datasource-metadata endpoint. The flaw affects Autotune deployments where at least one monitoring datasource has authentication secrets configured; no specific version range is stated in the provided data. Attackers who can reach the service from an adjacent network can harvest those credentials and reuse them against the backing monitoring stack; no public exploit was identified at time of analysis, and the CVSS score is 7.4 with an adjacent attack vector.
OpenID Connect login in Goobi viewer 25.01 through 26.04 validates the JWT audience outside the cryptographic verifier, so an ID token minted for a different relying party on the same identity provider can be replayed to the viewer's authentication endpoint and log the attacker in as that token's subject. Only deployments that have opted into OpenID authentication and share an IdP/issuer with at least one other relying party are exposed; array-valued aud claims fail closed and single-RP setups are described by the vendor as not practically exploitable, and the viewer's per-login nonce/state binding narrows the window further. There is no KEV entry and no public exploit identified at time of analysis, but a fixed release (26.05) and the upstream commit are both public. EPSS was not supplied in the input.
Goobi Viewer deployments that leave webapi.authorization.token unset accept an empty ?token= value on every @AuthorizationBinding-protected REST endpoint, allowing an unauthenticated caller to invoke protected API methods. The official install guide generates a UUID token, so only installations that skipped that bootstrap step - typically test, staging, CI, or container images - are exposed; on those, an attacker can delete Solr records, read operational statistics and cache data, and, where the client-applications feature is used, read client secrets and grant a client access to restricted content. The issue is fixed in version 26.05, and no public exploit was identified at the time of analysis.
An out-of-bounds read in the Linux kernel's PFCP receive path lets a remote, unauthenticated sender make pfcp_session_recv() read past the validated packet data by sending a PFCP packet with the S flag set that is too short to hold the 8-byte SEID, or whose session header sits in a fragment rather than the linear area. Bytes read out of bounds are stored in the tunnel metadata that the flower classifier later matches on, giving limited confidentiality and integrity impact (vendor CVSS 7.3; assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Exposure is gated by deployment: the pfcp module must be loaded and the host must act as a PFCP tunnel endpoint, so default kernels are not reachable; EPSS is 0.21% (10th percentile) and no public exploit code was identified at the time of analysis, though the vendor classifies the fix as a this-week priority.
Arbitrary code execution in Nitro PDF Pro for macOS 14.7 lets an attacker who can deliver a crafted PDF file run code in the context of the user who opens it. The assessed vector is local (AV:L) with mandatory user interaction (UI:R), so there is no zero-click or network-remote path - exploitation depends on social-engineering the victim into opening a malicious document, and the precise parsing mechanism that yields code injection is not described in the available sources. Exploitation has not been confirmed as active (not in CISA KEV), a public gist reference exists but is not verified as working exploit code, and EPSS is low at 0.21% (10th percentile), which together with the vuln.today 'this_week' decision label points to a moderate, non-urgent priority rather than a top-tier emergency.
Parsing a crafted PDF with pypdf prior to 6.21.2 can drive the library into repeated cross-reference recovery cycles, consuming CPU and time in the parsing process until the workload stalls. This is a follow-up to GHSA-55h5-xmcq-c37v: the earlier fix cached recovery state, but the parser still reloaded the entire PDF stream on each recovery attempt, so repeated malformed cross-reference stream entries still produced long runtimes. Anyone whose application, service, or automated pipeline ingests untrusted PDFs with an affected version remains exposed - including environments that already applied the prior advisory's fix - and exposure ends only with 6.21.2, since no public exploit code has been identified at time of analysis and the impact is limited to availability, with no disclosure, modification, or code execution path.
Denial of service in pypdf before 6.21.2: a crafted PDF whose standard cross-reference table declares a larger entry count than the file can physically contain drives the parser into excessive iteration and long runtimes simply when the document is opened. The CVSS vector shows no privileges required (PR:N) but a victim interaction of opening or processing the file (UI:P), so the realistic exposure is services that ingest untrusted PDFs such as upload portals, mail/attachment scanners and OCR or document pipelines. Impact is availability-only (no confidentiality or integrity effect), the vendor fix is version 6.21.2, and no public exploit code was identified at the time of analysis.
Denial of service in pypdf before 6.21.2 lets a crafted PDF stall parsing by referencing the same non-existent indirect object many times, forcing repeated full-file recovery loads and long runtimes. The flaw is remotely reachable without authentication (CVSS:4.0 AV:N/PR:N, assessed CVSS:3.1 AV:N/AC:L/PR:N), but it only fires when a vulnerable pypdf instance actually loads the attacker-supplied file, so exploitation requires a user or automated pipeline to open or process the malicious PDF (UI:P). Impact is limited to availability - CPU and time exhaustion in the parsing process - with no confidentiality or integrity effect; this is a moderate-severity, this-week-priority issue, and no public exploit code was identified at time of analysis.
PHP object injection in baserCMS 5.0.0 through 5.3.1 and 5.4.0 through 5.4.1 allows an attacker with widget-write capability to store a raw serialized string in the widget-area column, which is then deserialized with unserialize() and no allowed_classes restriction on every widget-area render, including unauthenticated public page requests. The vendor advisory documents two gadget chains on the default dependency set - composer/composer ProcessExecutor::startJob() and logiscape/mcp-sdk-php StdioTransport::connect() - both reaching proc_open() to run shell commands as the web-server user, persistently on each request until the database row is repaired. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2 High) reflects the privileged write precondition: initial planting requires an administrator or an attacker who already obtained widget-write access through a separate flaw such as chained XSS, so unauthenticated page access is a trigger after storage, not a means of planting. Vendor-released patches exist in 5.3.2 and 5.4.2; the advisory publishes PoC object-graph payloads for both chains, reportedly executed on a test instance, and no confirmed in-the-wild exploitation is reported in the supplied data.
In baserCMS, an authenticated administrator with the optional BcThemeFile plugin installed can write PHP files outside the theme directory - including into webroot - and execute them over HTTP, because the Admin API validates a raw 'fullpath' value and the write sink then applies rawurldecode() to it. The flaw affects the 5.2.x branch before 5.3.2 and the 5.4.x branch before 5.4.2, and is the third bypass of the protections added for CVE-2026-30940 by routing percent-encoded traversal through validation. Exploitation is not a mass-internet scenario: the CVSS vector is PR:H, and three conditions must all hold - the non-default BcThemeFile plugin installed, a session in the administrator group, and a same-origin Origin header - while the Admin web form itself is not exploitable this way because FormProtection blocks tampering with fullpath. The advisory includes a working reproduction request; no confirmed active exploitation (not in CISA KEV) and vendor fixes are released.
Server-side request forgery in the PraisonAI Async Jobs API lets an attacker who can submit jobs with a chosen webhook_url steer the server's completion callback into loopback, private-network, or cloud-metadata endpoints, bypassing the webhook guard that current releases do ship. The check is a time-of-check/time-of-use gap: the URL is validated with urlparse() and socket.gethostbyname() at request parsing and again when the Job object is built, but _send_webhook() hands the original hostname to httpx.AsyncClient.post() with no send-time revalidation or IP pinning, so a low-TTL attacker-controlled name can resolve public during validation and internal during delivery. Affected releases are pip packages praisonai from 4.5.126 through 4.6.58; the advisory publishes a local-only PoC that confirms the bypass in-process, but it is not verified as working exploit code against a live deployment, and there is no KEV or active-exploitation signal - consistent with the this_week priority label and an assessed AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N vector where blind SSRF impact depends heavily on what internal services the host can reach and whether they accept POST.
Account takeover in the User Profile Builder WordPress plugin before 4.0.5: an Administrator of a Multisite subsite can use the front-end Edit Profile form to select an account other than their own, change that account's email address - including a Network Super Admin's - and then complete the password-reset flow to seize it. The plugin fails to verify that the acting user is authorized to edit the specific account selected (CWE-269, improper privilege management), rated 7.2 High with PR:H because the attacker must already hold subsite Administrator rights, and requiring WordPress Multisite with the front-end profile editor in use; single-site installations are not affected. SSVC records exploitation as none and no public exploit code or active exploitation is identified at time of analysis, though technical impact is total once the prerequisites are met.
Stored cross-site scripting in CleanTalk Anti-Spam for WordPress (all versions through 6.89.1) lets an unauthenticated visitor submit a crafted 'user_email' value during registration and have arbitrary script execute in an administrator's browser when the plugin's user-spam scan is run and the Non-checkable users or Spam users tab is opened. Exploitation is gated by two conditions: site user registration must be open, and an administrator must perform that scan/view step, so the issue is not reachable on default configurations lacking those. No public exploit has been identified at time of analysis; the vendor rates it 7.2 (High) with scope change, and our assessed vector agrees on AV:N/AC:L/PR:N/S:C/C:L/I:L/A:N but uses UI:R rather than UI:N because the administrator's scan/view action is required.
Reflected cross-site scripting in the Hogash KALLYAS WordPress theme through version 4.25.0 allows remote attackers to execute script in a victim’s browser when the victim follows a crafted URL. The attacker does not need authentication but must induce user interaction, and the payload is reflected per request rather than persisted server-side; the vulnerable parameter is not identified in the available sources. No public exploit identified at time of analysis, and the supplied priority label places this in the this_week queue.
Use-after-free in the Linux kernel Bluetooth SCO receive path can let an unauthenticated Bluetooth-adjacent attacker corrupt or disclose kernel memory while an SCO/eSCO audio link is active. The flaw is a race between sco_recv_scodata() reading hcon->sco_data and sco_conn_free() clearing that pointer without hdev->lock, so reliable exploitation is timing-dependent and requires user interaction to establish the SCO session. Vendor patches are listed for Linux 6.18.57, 7.2.11, and 7.3, EPSS is 0.21% (10th percentile), and no public exploit has been identified at time of analysis.
ARP/neighbor-table poisoning in the iscsiuio userspace daemon shipped with open-iscsi lets an unauthenticated attacker on the same Layer 2 segment redirect network traffic by sending a single minimal IPv6 Neighbor Advertisement. Affected deployments are those where iscsiuio is actually running for iSCSI hardware offload (typically with supported Broadcom NICs); a default server without iSCSI offload configured is not exposed. The same handler also reads link-layer address options at a fixed offset without confirming the packet carries them, an out-of-bounds read that can leak memory or crash the daemon; no public exploit has been identified at time of analysis.
CGM CLININET exposes its /DocManagment endpoint without an authentication check, allowing unauthenticated attackers on an adjacent network to list and download patient documents. The issue affects CLININET releases before 2026.MS3, is rated 7.1 High with confidentiality-only impact, and has no public exploit identified at time of analysis. Because the attack vector is adjacent rather than internet-facing, near-term risk is concentrated in hospital internal networks and already-compromised segments; CERT-PL places remediation in the this-week priority tier.
Command injection in virtualenv's bash activator lets an attacker-supplied --prompt value be stored unescaped in PS1 and executed as the user who activates the environment. Affected are versions 21.14.9 through 21.14.12 (per EUVD, 21.14.9 to < 21.14.13); the regression was introduced by the 21.14.9 rewrite of the prompt block and is fixed in 21.14.13. Triggering it requires activation in bash while promptvars is disabled and POSIX mode is off (a documented performance tweak found in some ~/.bashrc files and prompt wrappers), followed by re-enabling prompt expansion with shopt -s promptvars, set -o posix, or an interactive child bash that inherits the exported PS1; default-option activation is inert, and the advisory documents a reproducible proof-of-concept. No CISA KEV listing or other confirmation of active exploitation was provided, and the priority label for this issue is 'this_week'.
Missing authorization in the BlueSpiceUserManager extension of BlueSpice (5.0.0 through 5.1.10 and 5.2.0 through 5.2.6) lets any authenticated user, with no special privileges, block or unblock arbitrary accounts including administrators through the /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete REST endpoints. Successful abuse can lock every administrator out of the wiki (denial of service) or silently lift blocks that administrators imposed, altering the integrity of account state. Exploitation requires a valid registered account plus network reach to the REST API, and the extension must be installed and enabled; where self-registration is open the barrier is negligible, otherwise the realistic attacker set is insiders. No public exploit code was identified at time of analysis.