Unauthenticated privilege escalation in the Datawiza Proxy Auth Plugin for WordPress lets a remote attacker forge the user-identity and role HTTP headers the plugin consumes and thereby create and authenticate as a WordPress administrator, giving full control of the site (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The disclosed affected range is 1.1.0 up to but not including 1.1.1, and the vendor has released 1.1.1 as the fix. Practical exploitability is topology-dependent: forged headers are only honored if externally supplied copies actually reach the plugin, so a correctly configured front-end proxy that strips or overwrites these headers blocks the attack. A public PoC reference exists but is not verified as working exploit code, and EPSS is low at 0.14% (3rd percentile) despite the maximal severity score, so the vulnerability.today decision label is act_now on the basis of impact rather than observed exploitation.
Unauthenticated path traversal in Paisa before v0.7.8 lets remote attackers read arbitrary server-readable files and delete backup files by supplying '../' sequences in the file name accepted by the editor file handlers (GetFile, GetSheet) and the delete_backups handlers (DeleteBackups, DeleteSheetBackups). The flaw is rated CVSS 4.0 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L) and the vendor has released a fix in v0.7.8, so any default deployment reachable over the network is exposed until upgraded; no public exploit code was identified at time of analysis, and practical risk is bounded mainly by whether the instance is bound beyond localhost. Confidentiality impact is high because reads are limited only by the permissions of the server process account, while integrity impact is low and confined to removal of .backup.* files.
Reflected cross-site scripting in the SiYuan knowledge-management kernel (versions 2.9.0 through 3.8.6) lets a crafted /check-auth?to= link inject a javascript: URI that executes in the authenticated kernel origin once the victim logs in, after which the injected script can call same-origin kernel APIs to read or modify workspace content and settings. Exploitation requires a two-step user interaction: the victim must open the attacker-supplied link and then enter a valid access auth code on that page, so the CVSS 4.0 score is 7.6 (High) with AC:H/UI:P; the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N. The issue is a reflected flaw with no persistence, was verified end to end by the reporter on v3.8.6, and proof-of-concept details are published in the vendor GHSA advisory; it is not listed in CISA KEV, and no EPSS score was supplied with the intelligence.
Privilege escalation in the Duplicator WordPress plugin before 5.0.0 lets an administrator of a WordPress Multisite child site who is not a network administrator use the plugin's one-click upgrade routine to install and execute arbitrary PHP in the network-wide shared plugin directory. The assessed vector requires high privileges (an existing subsite administrator account) and no user interaction; the description's additional claim that the routine is exposed without authentication is unresolved in the available data. No CISA KEV entry is present, a public PoC reference exists but is not verified as working exploit code, and EPSS is low at 0.17% (percentile 7).
Unauthenticated configuration read and write in the hubcmdui web management interface of Docker-Proxy through 5.1.9 lets remote attackers call /api/config to retrieve stored WeChat webhook URLs and Telegram bot tokens and to overwrite menu item links, proxyDomain, and the monitoring webhook that receives alerts. The route lacked any authentication middleware in default deployments (CVSS 4.0 base 6.9, PR:N), so the only real prerequisite is that the hubcmdui interface is network-reachable; the credential theft is further gated by whether notification integrations were actually configured, while the config-overwrite works regardless. The vendor has published a fix (commit a173befc, stated as available), no public exploit code was identified at time of analysis, and the vuln.today priority label is 'this_month', consistent with a genuine but moderate-priority issue rather than a drop-everything emergency. Rotate any WeChat/Telegram credentials that were stored in the exposed configuration.
Unauthenticated server-side request forgery in YesWiki before 4.7.0 lets any remote visitor make the wiki server issue HTTP(S) (and, per PHP's file() wrapper support, ftp) requests to attacker-chosen hosts and ports and read the fetched response body back in the HTTP reply. The flaw lives in the wakka '[[|URL]]' raw-inclusion syntax, which is reachable without authentication through the generic page-render handler's content parameter - strip_tags() removes HTML but not wiki markup - and can also be planted stored by an editor with ACL '+' so that it fires when an anonymous visitor views the page. The vendor advisory includes a reproduction recipe (a single unauthenticated GET request observed to hit the internal host and reflect its body) confirmed against development HEAD; there is no CISA KEV listing and no independently verified public exploit package, and this is assessed as a genuine but moderate-priority issue rather than an emergency, with impact confined to confidentiality and no integrity or availability effect.
Stored cross-site scripting in GiveWP donation forms before 4.19.0.1 lets a user who already holds a custom GiveWP role with donation-form-editing capability store script in a form template setting, and the script runs in the browser of any visitor or administrator who opens the affected form. The assessed vector is AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, so the privileged-account prerequisite and the need for victim interaction limit reach; no CISA KEV active exploitation signal is present, and a public PoC reference exists but is not verified as working exploit code.
Path traversal in the GiveWP WordPress plugin before 4.19.0.1 allows an authenticated user holding a high-privilege GiveWP custom role to read JSON-parseable files from anywhere on the server and to overwrite the plugin's stored configuration. The root cause is missing validation of a user-supplied filename before it is read from disk (CWE-22), reachable over the network with low attack complexity, but the PR:H prerequisite confines realistic abuse to insiders or to attackers who already control an account with that role. EPSS is 0.16% (5th percentile) and there is no KEV entry; a public PoC reference exists but it is not verified as working exploit code, and a vendor patch is available in 4.19.0.1.
Improper authentication in the SMS code verification flow of ruoyi-vue-pro (AuthController.java) lets remote attackers manipulate the 'mobile' and 'code' parameters to subvert login verification, yielding limited confidentiality, integrity and availability impact rather than full account takeover evidence. Versions up to and including 2026.09 are reported affected; the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) and the independent assessment both confirm the attack is network-reachable with no privileges or user interaction, though the SMS login feature must be enabled and exposed for exploitation. A public PoC reference exists; it is not verified as working exploit code, there is no CISA KEV entry, and the item is triaged as 'this_month' priority - a genuine but moderate-priority issue rather than a top-tier emergency.
Server-side request forgery in Zylon PrivateGPT 1.0.0 and 1.0.1 lets remote unauthenticated attackers manipulate the URI argument handled by the URI Artifact Loader's load_file_from_uri function, causing the server to make attacker-influenced requests. The assessed impact is limited to low confidentiality, integrity, and availability effects with unchanged scope, and exposure depends on the URI ingestion feature being reachable by untrusted users. A public PoC reference exists but is not verified as working exploit code; no CISA KEV active exploitation is indicated in the provided data, and the priority label is this_month.
SQL injection in the Contact argument handled by /opils/staff/adddealer.php in SourceCodester Performance Indicator System 1.0 allows remote attackers to inject arbitrary SQL into the application's backend queries, with limited confidentiality, integrity and availability impact. The vendor scored it 6.9 under CVSS 4.0 (E:P), and it is a textbook low-to-moderate-priority web SQL injection rather than a top-tier emergency: the affected endpoint is a single, obscure page in a niche PHP product with very low real-world deployment, and authentication requirements are not confirmed from available data - the '/staff/' path suggests an administrative area that may require valid staff credentials even though the assessed vector carries PR:N. A public PoC reference exists; it is not verified as working exploit code, and there is no CISA KEV listing indicating active exploitation.
SQL injection in the Registration component of krupalshah Employee Recruitment System (/source/registerform3.php) allows unauthenticated remote attackers to manipulate the pemail argument and influence database queries, with low confidentiality, integrity, and availability impact per the assessed CVSS:3.1 vector. The product is unsupported and distributed through rolling releases without version identifiers, so the CPE wildcard covers all deployments up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. A public PoC reference exists; it is not verified as working exploit code, and no CISA KEV confirmation of active exploitation is available; the issue is moderate-priority rather than an emergency.
Unauthenticated SQL injection in the Registration Wizard of krupalshah EmployeeRecruitmentSystem (PHP file /source/registerform2.php) lets remote attackers manipulate the university, institute, branch, degree, status, cpi, semester or experience arguments that flow into a mysql_query call, allowing them to read or alter backend data. The project is a rolling-release PHP application that the maintainer no longer supports and did not respond to the disclosure, so no fixed release is identified; the affected code is confirmed only up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe, and the CPE wildcard leaves the full affected version range undefined. A public PoC reference exists but is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV entry); exploitation is bounded by the product's rarity and by whether a deployment exposes or disables public registration.
SQL injection in the registration endpoint (/source/registerform1.php) of krupalshah EmployeeRecruitmentSystem lets remote, unauthenticated attackers inject arbitrary SQL through the firstname, middlename, lastname, gender, birthdate, state, statespecify, city and cityspecify parameters, with low confidentiality, integrity and availability impact per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The project ships as a rolling release with no version identifiers, the maintainer was contacted and did not respond, and the codebase is no longer supported, so there is no fixed build to upgrade to. A public PoC reference exists in a GitHub issue tracker; it is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing) - the practical constraint on this CVE is footprint, not exploitability, and it is triaged for handling this month.
GiveWP WordPress plugin before 4.19.0.1 allows authenticated users holding a custom fundraising role to edit, publish, and read pages owned by other users, including administrators, because page-capability requests are checked against the wrong page. The defect is a broken authorization issue (CWE-863) in the plugin’s page-level capability handling, and exploitation requires an existing fundraising-role account on an affected site. EPSS is low at 0.13% and there is no CISA KEV entry, but a public PoC reference exists and is not verified as working exploit code; the vendor has released 4.19.0.1 as the fixed version.
Memory exhaustion in the llm-multimodal component of smg 1.7.0 through 1.10.1 allows a remote, unauthenticated attacker to exhaust server memory by supplying a JPEG whose header declares enormous dimensions (libjpeg-turbo accepts up to 65500x65500, roughly 12 GiB of RGB output). The libjpeg-turbo path in crates/multimodal/src/jpeg_turbo.rs sizes the decoded buffer with an unchecked width x height x 3 multiplication and applies no ceiling, while the pure-Rust fallback decoder was already bounded at 512 MiB, so only the turbo decode path is exposed. Impact is availability-only (medium severity; no code execution, integrity or confidentiality effect), a public PoC reference exists but is not verified as working exploit code, and vendor fixes are available in 1.11.0. This is a medium-severity denial-of-service issue, not a high-priority emergency.
Server-side request forgery in EyouCMS 1.8.0 through 1.8.3 allows remote attackers to make the server issue HTTP requests to attacker-chosen destinations through the remote_file_to_local function in application/function.php, which retrieves a remote file by URL without validating the target. Per the independent assessment the vector is network-reachable with no privileges or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), producing low confidentiality, integrity and availability impact, and the PoC reference suggests the path is reachable from the unauthenticated front end. There is no confirmed active exploitation (not in CISA KEV); a public PoC reference exists but is not verified as working exploit code. The vendor was contacted and did not respond, no fixed version is listed in the evidence, and the issue is scheduled for remediation within the current month based on the assigned priority.
SQL injection in SourceCodester Performance Indicator System 1.0 lets a remote attacker inject arbitrary SQL through the 'Contact' argument handled by /opils/staff/save_profile.php, potentially reading or altering data in the underlying database. The assessed impact is limited to Low across confidentiality, integrity and availability (CVSS 3.1 base 6.9, AV:N/AC:L/PR:N/UI:N), so exposure is partial rather than full application takeover. A public PoC reference exists in a GitHub issue; it is not verified as working exploit code, and no confirmed active exploitation is reported - the vuln.today decision label is 'this_month', indicating a genuine but non-emergency issue concentrated in a niche PHP application unlikely to be widely deployed in production.
SQL injection in SourceCodester Performance Indicator System 1.0 lets remote attackers alter SQL statements executed by /opils/staff/edit_dealer.php through the Contact parameter, potentially reading or tampering with dealer records and other data in the underlying database. The supplied scoring (CVSS 4.0 6.9, AV:N/AC:L/PR:N/UI:N, E:P) describes network-reachable exploitation without privileges or user interaction, although the 'staff' path segment suggests the page may normally sit behind a staff login, so true unauthenticated reachability in a default deployment is unconfirmed. A public PoC reference exists; it is not verified as working exploit code, and no confirmed active exploitation has been reported.
The WP Stripe Checkout WordPress plugin before 1.2.2.62 accepts Stripe webhook callbacks without verifying their signature whenever no signing secret has been configured, which the advisory describes as the plugin's default state. Because the CVSS vector is PR:N, unauthenticated remote attackers can POST a forged payment-completion notification to the webhook endpoint and cause a completed order to be created without any payment being made. Impact is limited to integrity (C:N/I:L/A:N, CVSS 5.3) and does not extend to data disclosure or denial of service; EPSS is low at 0.15% (4th percentile) and no CISA KEV listing is present, though a public PoC reference exists that is not verified as working exploit code.
Unauthenticated visitors can read the content and settings of GiveWP donation forms that remain in draft, pending, private or scheduled status on WordPress sites running versions before 4.19.0.1. The plugin omits a status or capability check on its public front-end form-rendering route, so a form ID or slug can expose configuration that WordPress otherwise keeps non-public; impact is confined to confidentiality, with no write access or code execution. No CISA KEV entry is present and EPSS is 0.14% (3rd percentile); a public PoC reference exists but is not verified as working exploit code, and the vendor has released 4.19.0.1.
Unauthenticated order fraud in the Chikkili- Google Pay India for WooCommerce WordPress plugin through version 1.0.6 allows remote attackers to mark arbitrary WooCommerce orders as paid without any payment being made, because the plugin accepts payment notifications without verifying that they originated from the payment provider. The flaw is confined to sites that have installed and activated this plugin alongside WooCommerce and the Google Pay India payment method; impact is integrity-only (fraudulent paid status), with no confidentiality or availability effect and no code execution. No confirmed working exploit code is available - only a public reference that has not been verified as working exploit code - and EPSS is low at 0.14% (3rd percentile), consistent with a moderate business-logic issue rather than a top-priority emergency.
Snipe-IT 8.6.2 and earlier can re-admit deactivated accounts - including accounts with admin rights - through the Google SSO callback, because GoogleAuthController::handleGoogleCallback logged in whichever local user matched the incoming Google email as a username without enforcing the activated flag. The exposure is gated by deployment shape: Google SSO must be enabled, the instance must use email-as-username (or the targeted account must have an email-shaped username), the Snipe-IT account must already be deactivated, and the attacker must still hold a live, unrevoked Google Workspace identity for that address. Default installations that use the firstname.lastname username format are not affected because the username/email mismatch makes the lookup return NULL; this makes the bug primarily an offboarding-window and former-insider risk rather than anonymous external compromise, and it has been assigned an act_now priority. No public exploit code was identified at time of analysis, and the issue is fixed in Snipe-IT 8.6.3 via commit 5fea2fadc0.
An authentication bypass in Parse Server affects 8.x releases before 8.6.102 and 9.0.0 through 9.10.5-alpha.2 when an app is configured with a custom authentication adapter written as a subclass of the exported AuthAdapter class: Parse Server never invokes the subclass's validateSetUp, validateLogin, and validateUpdate methods and instead falls back to an inherited base-class default that accepts any authData. For any provider served by such an adapter, unauthenticated remote attackers can supply arbitrary authData to sign up, link an identity, log in as an existing user, or skip a custom adapter that implements an additional authentication factor, potentially gaining full account access and integrity over affected data. Apps using built-in adapters or custom adapters defined as plain objects are not affected, and no public exploit code was identified at time of analysis; the priority label from the reporting feed is act_now, reflecting that the impact is severe for the narrower population that matches the configuration prerequisite.
Missing capability checks in the WPVR WordPress plugin before 9.1.3 let authenticated users holding the Contributor role or higher drive the plugin's tour setup wizard and create or publish tour content, including arbitrary post metadata, that their role would not normally permit. Sites running WPVR from 8.5.55 up to 9.1.3 are affected, and the decisive exposure factor is whether untrusted people are granted Contributor-or-above accounts on those sites. Exploitation is not confirmed in the wild (no CISA KEV entry), EPSS is low at roughly 0.17 percent (6th percentile), and while a public PoC reference exists, it is not verified as working exploit code; impact is limited to integrity, with no stated confidentiality or availability effect.
Server-side request forgery in vLLM 0.9.2 through 0.23.x lets an API caller force a P2pNcclConnector prefill worker to open an outbound ZMQ connection to an attacker-chosen host by embedding a `___decode_addr_<host>:<port>` token in the `X-Request-Id` header, exposing the NCCL communicator unique_id and the KV-cache tensors of the targeted request and potentially stalling the worker on a blocking `ncclCommInitRank`. The flaw is conditional: it only applies to disaggregated-serving deployments started with `--kv-transfer-config` selecting the V1 `P2pNcclConnector` in the `kv_producer` role, and default vLLM installations are unaffected. The CVSS:4.0 vector indicates no privileges required (PR:N), with the caveat that a valid API key is needed when `--api-key` is configured. No public exploit was identified at time of analysis, and the vendor closed the issue in 0.24.0 by removing the affected connector.
Unauthenticated SQL injection in YesWiki's public Bazar entries search API allows a remote attacker to place a backtick-containing field name into a backtick-quoted SQL alias and execute arbitrary SELECT subqueries, reading data such as user password hashes and using SLEEP() to exhaust database threads. The package advisory lists vulnerable ranges >=4.6.7, <4.7.0 and >=5.0.0-alpha1, <5.0.0-alpha4, fixed in 4.7.0 and 5.0.0-alpha4; the published description also names 4.6.0 before 4.7.0, while source analysis confirms the documented end-to-end chain from 4.6.7. Published CVSS is 8.8 (independent CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H); a public PoC reference exists but is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation.
Unauthenticated SQL injection in YesWiki 4.5.0 through 4.6.7 lets an attacker break out of the double-quoted time literal that PageManager::save() builds from the reserved date_maj_fiche field, turning a single Bazar entry-creation INSERT into a read oracle against wiki_users and exposing password hashes. On a default installation (Bazar module ACL '*', use_captcha false, bazarIgnoreAcls true) the sink is reachable without credentials via POST action=saisir_fiche, while a registered account can reach the same sink through POST /?api/entries/{formId}. The vendor's GitHub advisory (GHSA-wjf7-hrf3-9gcx) publishes a proof-of-concept request; active exploitation in the wild is not confirmed in the available data, no EPSS or KEV signal is present, the vuln.today priority is this_week, and the issue is fixed in 4.7.0.
Missing authorization in Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 allows unauthenticated REST API clients on MongoDB deployments to delete the internal _SCHEMA collection, stripping class field definitions, class-level permissions and protected fields so affected data becomes readable and modifiable by any client. PostgreSQL deployments are explicitly not affected and object ACLs continue to apply; no public exploit has been identified at time of analysis. The vendor and independent assessment rate this high severity (CVSS 8.8, assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) and a near-term priority for MongoDB-backed installations with reachable REST endpoints; vendor patches are available for both affected release branches.
Path traversal in rclone's `serve webdav` front-end, in every build up to and including 1.75.1, lets remote unauthenticated attackers write outside the directory rclone was told to serve: a single `MKCOL /..` request plants a VFS node whose backend path is literally `..`, after which PUT, MOVE, COPY, MKCOL and DELETE all resolve above the served root - creating, overwriting, moving out and (by known name, after a client PUT) deleting other tenants' files. Impact is integrity-only: reads and enumeration above the root still fail with 404 because the read path filters entries through the existing `RemoteEscapesRoot`/`RemoveEscaping` predicate while the write path never asks it. Vendor-released patch: 1.75.2; the GitHub advisory carries detailed public reproduction steps (a public PoC reference exists, not verified as working exploit code), there is no CISA KEV confirmation of active exploitation in the supplied data, and the vuln.today priority label is `this_week`.
Cross-organization authorization bypass in Dokploy through 0.30.10 lets an authenticated owner or admin of one organization control another tenant's applications by supplying a foreign applicationId to procedures such as saveEnvironment, updateTraefikConfig, deploy, and stop. Successful exploitation can overwrite environment variables and build secrets, repoint application sources, and disrupt other tenants' workloads. The flaw requires a multi-tenant Dokploy deployment and org-level owner or admin credentials; no public exploit has been identified at time of analysis, and a vendor fix is available via the referenced upstream commit.
Memory exhaustion in vLLM 0.18.0 through 0.30.x lets a client crash or OOM-kill the serving frontend by setting media_io_kwargs.video.num_frames to -1 (or an arbitrarily large positive value) alongside a large inline video/jpeg payload, so the API decodes and stacks every frame. Only deployments serving a video-capable multimodal model and honoring per-request media_io_kwargs are exposed; text-only instances are not affected, and versions before 0.18.0 lack runtime media_io_kwargs support. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VA:H) rates this a high-availability-impact, confidentiality- and integrity-neutral flaw, and no public exploit code has been identified at time of analysis, though the trigger is a simple documented parameter override.
SAML assertion replay in Snipe-IT 8.4.1 and earlier lets an attacker who has already captured one valid SAML assertion submit it concurrently to /saml/acs and walk away with multiple simultaneous authenticated sessions for the same victim, so a later IdP-side revocation only kills one of them. The flaw is a time-of-check/time-of-use defect in the SP-side nonce deduplication: the nonce column is not UNIQUE and the count-then-insert check straddles Auth::login() without a transaction, letting two parallel POSTs both observe zero rows and both mint a session. Exploitation is conditional rather than universal - SAML SSO must be enabled and correctly configured, the attacker must first obtain a genuine assertion via a man-in-the-middle position, a hostile browser extension, or a log/Referer leak, and must land both requests inside a sub-second window; no public exploit code has been identified at time of analysis and there is no KEV listing, so this is a credible but prerequisite-heavy risk best handled in the current weekly patch cycle.
Memory exhaustion in vLLM's Nemotron-VL processor path allows unauthenticated remote callers to OOM-kill the inference worker and deny service to co-tenants. The Nemotron-VL processor modules set Pillow's Image.MAX_IMAGE_PIXELS to None at import time, permanently disabling the process-global decompression-bomb guard for every image decode in that process, so a pathological image submitted to /v1/chat/completions expands into unbounded memory. Exposure is limited to deployments that serve a Nemotron-VL model or otherwise import the affected processor modules, and the vendor fix ships in vLLM 0.25.0 via PR #47010; no public exploit code has been identified at time of analysis, and scoring is availability-only (CVSS 4.0 base 8.7, PR:N/UI:N).
An object-level authorization bypass in phpMyFAQ before 4.1.10 allows unauthenticated visitors to rewrite or, under one optional administrator setting, permanently delete any visitor-submitted open question by sending an arbitrary openQuestionID to POST /api/faq/create. The only gate in front of the endpoint is the guest-submission feature switch, which defaults to enabled; the graphical CAPTCHA the attacker must solve is an anti-automation measure, not an authorization control, and it is the main practical limit on mass abuse. In the shipped default configuration the impact is integrity-only (CVSS 4.0 8.7, CVSS 3.1 7.5): category and answer link are overwritten and a forged 'answered' entry is written to faqquestion_history; if records.enableDeleteQuestion is turned on, the same request deletes the question outright with no soft-delete and no revision trail, matching the advisory's 9.1 Critical variant. No KEV listing or confirmed active exploitation is reported, and no standalone public exploit code has been identified at time of analysis, although the advisory itself publishes a step-by-step reproduction; this should be scheduled in the current weekly patch cycle.
Cross-tenant denial of service in vLLM 0.8.5 through 0.31.0 lets one API client crash the shared EngineCore process and drop every co-tenant request on that engine. The crash occurs when a request carrying prompt_logprobs (or echo with logprobs) is issued against a prefix that a KV connector reports as already computed, leaving positions in an uninitialized int32 tensor that the tokenizer then fails to decode, raising OverflowError. Reachability is conditional: the engine must be running the V1 engine with an active KVConnectorBase_V1 subclass returning num_new > 0 (LMCacheConnectorV1, NixlConnector, SharedStorageConnector, P2pNcclConnector, OffloadingConnector, MultiConnector), so plain vLLM without a KV transfer config is not exposed; no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor advisory provides a patch.
Remote denial of service in vLLM 0.22.0 up to but not including 0.24.0 allows remote attackers (CVSS PR:N) to crash EngineCore by sending a single Generate or GenerateStream request to the Rust gRPC frontend with output_logprobs enabled and more than 128 output_candidates.token_ids. The Rust converter copies those IDs into SamplingParams.logprob_token_ids without the Python-side 128-ID cap, vocabulary check, or logprobs-count consistency check, so the V1 GPU logprob sampler raises a fatal exception after execution begins. Only deployments exposing the Rust gRPC path on the vulnerable V1 sampler are affected; no public exploit identified at time of analysis, and the vuln.today priority is this_week.
An unauthenticated remote attacker who can reach the Rust gRPC Generate/GenerateStream frontend of vLLM 0.22.0 through 0.23.x can send a single small request that sets output_candidates.top_n or prompt_candidates.top_n above the server's configured max_logprobs cap - or to a value such as 2,147,483,648 that wraps negative when the protobuf uint32 is cast to i32 - and the unchecked count is forwarded into the V1 sampler's torch.topk call, terminating EngineCore and taking the inference service down for that request. The flaw is a missing validation and checked-conversion step in the Rust gRPC converter, which does not replicate the max_logprobs and negative-count guards that the Python SamplingParams validator already enforces; deployments that only expose the Python or OpenAI-compatible API are not reachable through this vector. Impact is availability only - no code execution, data access or model compromise is claimed - and no public exploit code or active exploitation has been identified at time of analysis; a fixed release (0.24.0) is available.
Unauthenticated remote attackers can crash vLLM 0.20.0 through 0.29.x by submitting inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint, which yields a negative text span in Qwen2.5-VL position construction and terminates the engine, denying service to subsequent requests. Exploitation is availability-only and rated high complexity: the attacker must first obtain and replay a valid multimodal item, then tamper with the serialized mm_placeholders, kwargs_data or mm_hashes fields, and the target must expose the scale-out multimodal generate endpoint. No public exploit code was identified at time of analysis; the validation fix ships in vLLM 0.30.0.
A single crafted request to the Rust gRPC Generate or GenerateStream service in vLLM 0.22.0 through 0.23.x can abort EngineCore and leave the inference server unhealthy, producing a remote denial of service against availability only. Because the gRPC handlers forward attacker-supplied pre-tokenized prompt IDs to the engine without checking them against tokenizer or model vocabulary bounds, an out-of-vocabulary value such as 9000000 reaches the embedding lookup and terminates the process; no confidentiality or integrity impact is assessed. The vendor shipped a fix in 0.24.0, and no public exploit code has been identified at time of analysis - the main gating factor is whether the gRPC endpoint is network-reachable, since the advisory notes that deployments restricting it to already-authorized clients require that access and would score lower (PR:L, 6.5).
Server-side request forgery in rclone's read-only RC file server (--rc-serve) lets unauthenticated users who can reach an exposed RC listener redirect http and netstorage backend requests to attacker-chosen hosts by supplying a root that begins with a double slash on an existing named remote. Successful requests return the target's response body to the requester, leak the named HTTP remote's configured custom headers to the selected host, and - for netstorage remotes - yield valid, time-bound request signatures for attacker-chosen stat and download paths. Exploitation requires a non-default deployment (--rc-serve enabled, listener reachable, no RC HTTP authentication, a known http or netstorage remote name), which is why the supplied assessment scores it CVSS:3.1 5.9 with AC:H despite the 8.2 CVSS 4.0 vector; there is no CISA KEV entry, and the advisory publishes loopback mock reproduction scripts that demonstrate synthetic-credential impact only, so no confirmed exploitation in the wild is indicated.
rotki before 1.44.2 derives the encryption key for its premium cloud backup/sync feature as a single unsalted SHA-256 hash of the user password, so anyone who obtains an uploaded backup blob can run offline, GPU-parallel password guessing against it and decrypt the database it holds - exchange API keys, secrets, wallet addresses and transaction history. The attack is unauthenticated and requires no user interaction once the blob is in hand, and only users of the premium sync/backup feature are affected. There is no KEV entry and no public exploit identified at time of analysis, though the CVSS 4.0 score of 8.2 signals high confidentiality impact; the vendor addressed the issue in rotki 1.44.2.
LDAP credential exposure in Snipe-IT 8.6.2 and earlier lets an on-path attacker capture service-account and end-user passwords in cleartext. Ldap::connectToLdap() called ldap_start_tls() and discarded the boolean result, so when TLS negotiation fails or a man-in-the-middle answers the StartTLS extended request with a 'Protocol error', the subsequent ldap_bind() sends credentials unencrypted while users see a normal, silent login. Only deployments with LDAP authentication enabled and TLS configured (ldap_enabled=1, ldap_tls=1) plus an attacker-reachable network path to the LDAP server are exposed; no public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV, though the vendor advisory publishes the exact code path and trigger.
The WPVR WordPress plugin (9.0.0 to <9.0.3) fails to perform object-level authorization when reading and updating virtual tours, so an account with contributor-level privileges or higher can read and modify tours belonging to other users. Our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (low severity) rather than the published 3.8 vector, because exploitation only needs an ordinary contributor account rather than high privileges; the limiting factor remains the authenticated low-privilege account requirement, with impact confined to the confidentiality and integrity of tour content. No exploitation is confirmed (not in CISA KEV), EPSS is 0.13% (3rd percentile), a public PoC reference exists but is not verified as working exploit code, and the priority signal is monitor.
Signature verification bypass in rclone stable selfupdate (versions 1.55.0 through 1.75.1) lets an attacker who controls the authenticated release-distribution responses prepend an unsigned SHA-256 checksum for a malicious archive ahead of the genuine PGP-clearsigned SHA256SUMS block, causing selfupdate to accept and extract an attacker-controlled rclone executable. Exploitation requires origin, CDN, or TLS-termination compromise or trusted-certificate interception plus a user running stable `rclone selfupdate` without `--check`; the beta channel is unaffected and ordinary unauthenticated interception is insufficient. The issue is rated High (CVSS 4.0 7.7; independent CVSS 3.1 7.5), fixed in 1.75.2, is not listed in CISA KEV in the supplied data, and has a public PoC reference that demonstrates the bypass and archive extraction but does not complete installation.
Cross-site request forgery in the pCloud backend of Rclone 1.52.0 through 1.75.1 lets a malicious web page silently rebind a victim's pCloud remote to an attacker-controlled OAuth token and API host, so subsequent `rclone sync` transfers upload files to the attacker and return attacker-chosen content. The flaw is reachable only while the victim is actively running the interactive authorization flow (`rclone config` or `rclone authorize pcloud`), which leaves the localhost callback listener on the fixed port 127.0.0.1:53682 open; a single stateless cross-site GET to that port during the window is accepted because the pCloud backend is the only one in the tree that sets `StateBlankOK: true`, disabling the OAuth `state` check. No KEV entry and no confirmed active exploitation were reported, but a full local proof-of-concept reproduction is published in the upstream advisory, and Rclone 1.75.2 is the fixed release.
SiYuan 3.6.0 through 3.8.6 accepts and persists the networkServeTLS administrator setting but never enforces it, so the kernel port continues answering plain HTTP with full API access in cleartext while also serving HTTPS on the same port. An operator who enables the toggle believes kernel traffic is encrypted, yet a network-adjacent attacker can sniff the login flow - including the access auth code - and the session cookie, which is issued without the Secure attribute while HTTPS responses omit HSTS, allowing session hijack against the kernel API. Exploitation requires a network-adjacent sniffing position and the operator having enabled the setting, which is why the flaw is rated for adjacency and high complexity rather than internet-wide exposure; a public PoC reference exists describing the verification steps, and it is not confirmed as working exploit code. A vendor fix is available in v3.8.7.
Stored cross-site scripting in the Contact Form by Supsystic WordPress plugin before 1.8.0 lets users with access to the form editor save a form name containing script that executes when another user views that form. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N, base 3.5) requires a high-privileged authenticated account and victim interaction, so this is not remote-unauthenticated exploitation. The meaningful boundary crossing is limited to WordPress multisite, where administrators lack the unfiltered_html capability; a public PoC reference exists but is not verified as working exploit code, EPSS is 0.15% (4th percentile), the issue is not in CISA KEV, and the vendor has released a fix in 1.8.0.
Missing authorization in YesWiki's ActivityPub outbox sync handler (ActivityPubService::syncActorPosts) lets an operator of a malicious federated ActivityPub server use a poisoned outbox to delete, overwrite, or forge wiki entries mirrored from other actors, with the administrator acting as a confused deputy. All releases from 4.6.2 through 4.6.7 are affected - 4.6.7 closed the equivalent holes in the inbox path via the GHSA-rm6r-grfg-4v78 fix but left the sync path unguarded - and the prerelease 5.0.0-alpha1 carries the same unguarded handler; version 4.7.0 contains the fix. Exploitation is conditional rather than ambient: ActivityPub must be enabled on at least one Bazar form, the instance must already hold a mirrored entry from a third-party actor, and an administrator must trigger the GET-based sync action (or be lured into it, since the action carries no CSRF token), while the attacker needs no privileges on the target instance. A proof-of-concept is documented in the upstream advisory, but it is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis.
Cross-site request forgery in YesWiki's {{despam}} administrative action lets an unauthenticated attacker delete arbitrary wiki pages or restore arbitrary past revisions through a logged-in administrator's session. The flaw affects YesWiki releases before 4.7.0 and is exploitable in the default configuration, where any visitor may create pages (default_write_acl='*'), raw HTML in the "".."" construct is emitted without HTMLPurifier, and the default Content-Security-Policy carries only frame-ancestors. The decisive prerequisite is user interaction: an administrator must view the attacker-planted trap page (RecentChanges is a realistic lure), so no authentication is needed to plant the payload and no browser vulnerability is required; a public proof-of-concept request sequence is documented in the GitHub security advisory, and no confirmed active exploitation (CISA KEV) was identified at time of analysis.