Authentication bypass in the asVereinbase WordPress plugin before 1.1.8 allows unauthenticated remote attackers to log in as any user, including an administrator, because the plugin accepts an empty stored password or second-factor value as a match. Affected are WordPress sites running the plugin at versions below 1.1.8; the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, and no special configuration or user interaction is required. A public PoC reference exists but is not verified as working exploit code, and the EPSS score is low at 0.19% (8th percentile) even though the vuln.today decision label is act_now, so the severity and priority signals are split and should be read together.
Unauthenticated PHP object injection in the Prime Mover - Backup and Migration plugin for WordPress (all versions up to and including 2.2.1) allows an attacker to plant a base64-encoded serialized object in wp_comments.comment_content through the stock wp-comments-post.php endpoint, with no authentication and no user interaction required. The payload is only deserialized when an administrator later runs a Prime Mover export or restore, at which point recursiveUnserializeReplace() passes the attacker-controlled value to unserialize() without an allowed_classes restriction; the plugin additionally ships its own gadget chain inside the bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no third-party plugin or theme is needed. The two-stage nature means the storage half is always reachable on a site with comments enabled while the trigger half depends on an administrator using the migration features; impact on successful trigger is full confidentiality, integrity and availability loss. Priority is act_now per the current decision signals; no public exploit code has been identified at time of analysis.
Improper token-purpose validation in Postiz (gitroomhq/postiz-app) through v2.25.2 allows any authenticated user holding a low-privileged account to obtain a validly signed token containing claims of their choosing, which the application then accepts interchangeably as a session, an organization invitation carrying a chosen role, a password reset, or an enterprise provisioning token. The primary path is the browser-extension channel credential-refresh route, which signs attacker-supplied data taken from the request itself with the shared token-signing secret and stores the signed result where the requesting user can read it back; a second, narrower team-invitation creation route signs extra request-body fields in the same way. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, but the vendor rates the issue critical (CVSS 9.9, scope changed) and the priority label is act_now, with upgrading to v2.25.3 stated as the only complete fix.
PHP object injection in the Paytium WordPress plugin (versions up to and including 5.0.5) allows remote, unauthenticated attackers to deserialize untrusted data per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), which can lead to full loss of confidentiality, integrity and availability. The flaw is rated 9.8 and flagged act_now by vuln.today, but no CISA KEV entry, no confirmed public exploit code and no EPSS figure were provided. Real-world impact depends on whether an exploitable POP gadget chain exists in the running code and whether the vulnerable code path is reachable - object injection alone does not guarantee code execution.
PHP object injection in Tribulant Newsletters, the WordPress plugin newsletters-lite, through version 4.18.1 allows remote, unauthenticated attackers to reach an unserialize() call with crafted serialized data; the CVSS 3.1 vector rates confidentiality, integrity and availability impact as high. The practical outcome depends on a usable POP gadget chain in the plugin, WordPress core or another installed component, and the specific vulnerable endpoint, parameter and gadget chain are not described in the supplied intelligence, which rests on a single Patchstack report. No public exploit code is referenced in the available data, and active exploitation is not confirmed.
Postiz instances older than v2.25.3 that store media on local disk let a registered user have the publishing worker read an arbitrary file from the server and send it as an attachment to a Discord server the user controls; because self-registration is open by default, the attacker effectively needs no pre-existing account, only network reach to the instance. The flaw is an unconfined path traversal (CWE-22) in the media readers: a media value that is not an HTTP(S) address is treated as a file on the worker's disk and opened without confirming it lies inside UPLOAD_DIRECTORY, and two further routes reach the same reads, one acting as a file-existence oracle that can also exhaust backend memory. Confidentiality impact is high, integrity is not affected, availability impact is at most limited, the vendor fix is v2.25.3, the issue is prioritised act_now, and no public exploit code was identified at time of analysis.
OS command injection in Unitree Go2's chat_go voice-chat component (gpt_thread.py set_volume) through firmware 1.1.11.4 lets unauthenticated remote attackers execute shell commands by supplying a crafted Value argument, with a user-interaction precondition. The vendor has released firmware 1.1.11.5 to resolve the issue, and the supplied priority is act_now. No CISA KEV listing is included in the supplied data and no public exploit identified at time of analysis; exposure depends on whether chat_go is reachable from untrusted networks.
CPython's ssl module validates TLS certificate chains that anchor to known-compromised eMudhra CA certificates, so anyone holding that CA's key material can impersonate arbitrary TLS servers to unpatched Python clients. Every Python application that relies on the default verification path (ssl.create_default_context() or an SSLContext without its own OCSP/CRL checking) is affected, which is CPython's default behaviour; the fix adds a hard-coded denylist of distrusted certificates enforced regardless of SSLContext policy. Exploitation is targeted rather than opportunistic, requiring the compromised CA key plus a man-in-the-middle or server-impersonation position against the victim's connection; no public exploit identified at time of analysis, and the vendor-tracked priority label is act_now.
Blind SQL injection in the WBW Product Filter WordPress plugin (woo-product-filter) through 3.4.6 lets remote attackers submit crafted requests that infer database contents through boolean or time-based responses. The supplied vector and independent assessment indicate network exploitation with no privileges or user interaction, while the independent assessment records high confidentiality impact, low integrity impact, and no availability impact; the exact injectable parameter or filter request is not described. The vuln.today priority label is act_now, and no public exploit was identified at time of analysis.
SQL injection in the Tribulant Newsletters WordPress plugin (newsletters-lite) through version 4.18.1 allows unauthenticated remote attackers to read data from the affected site's database, with the independent assessment scoring confidentiality impact high and integrity and availability impact none. The specific vulnerable parameter, endpoint, or feature is not described in the available sources, which consist of a single Patchstack advisory, and no public exploit has been identified at time of analysis. The act_now priority label reflects elevated concern, although the assessment notes the signals mostly align toward elevated priority but rest on a single source.
An integer overflow in open62541's UA_DataType_fromStructureDescription() allows a malicious or compromised OPC UA server to corrupt client heap memory when the client fetches custom DataType definitions, resulting in a crash or potential code execution. The flaw affects open62541 1.5.0 through 1.5.6: oversized structure definitions wrap the 16-bit memSize bitfield (and the 8-bit membersSize field), so the size computed during type construction no longer matches the true member layout used later by decodeBinaryStructure(). Exploitation is not passive - the client must connect to an untrusted server and actively invoke UA_Client_getRemoteDataTypes(), which is why CVSS 4.0 records AT:P and the assessed CVSS 3.1 vector uses AC:H despite unauthenticated remote reachability (PR:N); no public exploit was identified at time of analysis, but vuln.today assigns an act_now priority and the vendor has released 1.5.7.
Remote unauthenticated compromise of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition is possible through the JSSE component when attacker-influenced data reaches the affected APIs. The listed affected builds include Java SE 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, and 27.0.1.0.2, plus GraalVM for JDK 17.0.21.0.2/21.0.13.0.2 and GraalVM Enterprise Edition 21.3.20.0.2. Per the assessed CVSS vector AV:N/AC:L/PR:N/UI:N, exploitation is remote, unauthenticated, and requires no user interaction on the API path, with high confidentiality and integrity impact and no availability impact; no CISA KEV entry, public exploit code, or EPSS score was supplied, and the vuln.today decision label is act_now.