Stack-based buffer overflow in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 affects the Device-Information CGI handler infostat.cgi, where manipulation of the CONTENT_LENGTH argument in sub_402340 can corrupt stack memory and potentially lead to code execution or denial of service. The issue is remotely reachable, and the supplied CVSS 4.0 vector (PR:N/UI:N) indicates no authentication or user interaction is required when the router's web interface is reachable, although typical SOHO deployments expose management only on the LAN unless remote/web administration has been enabled. A public PoC reference exists but is not verified as working exploit code; no CISA KEV confirmation is present, EPSS is 0.61% (49th percentile), and the vuln.today decision label is act_now.
Unauthenticated remote attackers can rewrite server environment configuration in danmu_api deployments running a version before 1.21.7 when two conditions coincide: the install still uses the shipped default TOKEN of 87654321 and the ADMIN_TOKEN environment variable is unset. In that state the system-management endpoints /api/env/set, /api/env/add and /api/env/del inherit the token-free default-TOKEN compatibility path and accept unauthenticated POST requests, letting an attacker write ADMIN_TOKEN to seize the management interface, lock out the operator, or repoint OTHER_SERVER and PROXY_URL to internal targets for SSRF and forced redeployment. The vendor addressed this in 1.21.7 by requiring ADMIN_TOKEN on those endpoints (401 when unset) and excluding them from the default-TOKEN bypass; no public exploit code was identified at time of analysis, and instances that already use a non-default TOKEN or have set ADMIN_TOKEN are not exposed.
Command injection in the device-information handler of the TOTOLINK A950RG router (firmware 4.1.2cu.5268_B20221104) allows an attacker who can influence the MAC-address value processed by getDeviceInfo to execute arbitrary shell commands on the device. The CVSS vector requires high privileges (PR:H) to reach the vulnerable code path, and the available sources do not specify how a malicious MAC value reaches /var/lib/misc/udhcpd.leases - whether via unauthenticated LAN DHCP traffic or authenticated configuration - so the precise unauthenticated reachability is not confirmed. A public PoC reference exists but is not verified as working exploit code; there is no confirmed active exploitation (no CISA KEV listing), and EPSS is 2.74% (86th percentile), which places it in the upper band of predicted exploitation likelihood and is consistent with the 'this_week' prioritisation label.
Command injection in the Cloud Upgrade component of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 allows a remote attacker with a low-privilege authenticated session to pass a crafted FileName value into an OS command through the setCloudUpgradeFW function. The assessed CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and EPSS is 1.55% (75th percentile), indicating high technical severity but not top-percentile exploitation likelihood. A public PoC reference exists; it is not verified as working exploit code, and no CISA KEV entry is present.
CRLF injection in the SNMP Handler of Oray Pugongying X5 Pro 7.6.1 lets a low-privileged authenticated user inject newline sequences through the info.community argument handled by snmp_set, potentially causing the root-running snmpd to execute commands as root. The issue is network reachable, requires authentication (CVSS 4.0 score 8.6, PR:L), and affects both the router and subsequent systems; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV active exploitation is reported. The vendor was contacted early about the disclosure and did not respond, and no vendor-released patch is identified at time of analysis.
A CRLF injection (CWE-93) in the L2TP Authentication component of the Oray Pugongying X5 Pro router running firmware 7.6.1 allows an attacker who controls the L2TP Username argument to insert carriage-return/line-feed sequences into authentication handling, which the vendor-tagged data classifies as code injection and the published reference describes as reaching root code execution. The CVSS 4.0 vector scores 8.5 (AV:N/AC:L/AT:N/PR:H/UI:N) with high confidentiality, integrity and availability impact on both the vulnerable device and subsequent systems, but exploitation requires high privileges (PR:H) - authenticated or configuration-level access to the device's L2TP setup - rather than anonymous reach. A public PoC reference exists (a Notion write-up titled for root code execution via L2TP username injection); it is not verified as working exploit code, and there is no CISA KEV listing, though the current priority decision is to remediate this week. The vendor was contacted about the disclosure and did not respond.
Hardcoded static AES key embedded in the TTLock Android app (versions before v9.8.260718) and its associated smart-lock firmware allows an attacker within Bluetooth Low Energy range to capture a pairing exchange and decrypt the per-pairing session key transported during it. With the recovered persistent session key the attacker can forge authenticated BLE commands to unlock the lock, enroll fingerprints or access codes, and carry out administrative actions without authentication or user interaction (CVSS 4.0 8.6, AV:A/AC:L/PR:N/UI:N, VC:H/VI:H). The exposure is bounded by physical proximity to the lock rather than internet reach, and a public PoC reference exists but is not verified as working exploit code; there is no CISA KEV confirmation of active exploitation.
CRLF injection in the ser2net serial-handling component of Oray Pugongying X5 Pro 7.6.1 lets a network-positioned attacker with low-level privileges manipulate the regmsg argument so that an unescaped newline sequence in a serial banner overwrites an existing file on the device. The vendor-supplied CVSS 4.0 score is 8.6 (High); the independently assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H, reflecting high integrity and availability impact with lower confidentiality impact, and requiring PR:L - the attacker must already hold a low-privilege foothold/authentication on the device rather than being fully unauthenticated. No CISA KEV entry exists and no EPSS value was supplied; a public PoC reference exists, but it is not verified as working exploit code. The vendor was contacted and did not respond, so no official fix or vendor-stated mitigation is documented.
CRLF injection in the Dnsmasq-related DNS group configuration of Oray Pugongying X5 Pro 7.6.1 can let an attacker with authenticated administrative access inject newline sequences that, per the referenced PoC, are executed as a root script, with high confidentiality, integrity, and availability impact. Exploitation requires administrative access to the DNS group feature plus user interaction, so exposure depends on whether the management interface is reachable and how well admin access is protected; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV confirmation was provided. The vendor did not respond to disclosure and no official fixed version is listed, making this a conditional risk rather than a drop-everything emergency.
CRLF injection in the IPsec Policy Handler of Oray Pugongying X5 Pro 7.6.1 allows an authenticated high-privilege administrator to place unsanitized secproto values into /etc/ipsec.conf and inject additional IPsec configuration directives that execute as root. The CVSS 4.0 score is 8.5 with PR:H and no user interaction, and the independent assessment rates confidentiality, integrity and availability impact as high for both the device and downstream systems. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV entry is provided, the vendor did not respond, and no fixed version is published.
CRLF injection in the Dnsmasq configuration path of Oray Pugongying X5 Pro 7.6.1 lets a user who already holds administrative access to the router's management interface inject newline-delimited Dnsmasq directives through the DHCP lease-time (rent_time) parameter, corrupting the device's DNS/DHCP behaviour and enabling configuration tampering and potential information disclosure. Exploitation is remote over the network with no user interaction, but the CVSS vector carries PR:H - an attacker must first obtain admin credentials, which is the primary limiting factor, so this is not reachable by an unauthenticated outsider. A public PoC reference (a Notion write-up titled 'Dnsmasq Directive Injection Through DHCP Lease Time') exists but is not verified as working exploit code; the vendor was contacted and did not respond, so no fixed version is available, and the disclosure is tracked for remediation this week.
Improper Secure Boot signature verification in Yoosee GM8135S Camera 21.00.01.36 lets a local attacker who already holds high privileges get a manipulated firmware image accepted (CWE-347), undermining firmware trust and enabling tampering or persistence. The CVSS 4.0 base score is 8.4, but the attack path is local and requires existing privileged access, with no remote or unauthenticated vector described; the exact trigger is not detailed in the available sources. A public PoC reference exists; it is not verified as working exploit code, and no CISA KEV entry confirms active exploitation; the disclosure is prioritized this_week.
Unrestricted file upload in the PPPoE WAN Setting Handler of Oray Pugongying X5 Pro 7.6.1 lets an attacker who already holds administrative access to the router management interface manipulate the pppd_options argument so that plugin_init writes attacker-controlled content to /tmp/upload_files, ultimately enabling code execution on the device. Per the vendor CVSS vector the attack is network-reachable and low-complexity but requires high privileges (PR:H), which is the main limiting factor. A public PoC reference exists (a Notion write-up describing root code execution via the PPPoE plugin option) but it is not verified as working exploit code, and the vendor was contacted about the disclosure without responding, so no patch is available. This is a genuine but lower-tier priority rather than a drop-everything emergency, though it should be handled this week.
Unauthenticated remote attackers can mark or cancel arbitrary WooCommerce orders and disclose customer contact details on stores running Mintpay for WooCommerce through version 2.2.3, because the plugin processes payment callbacks without verifying their authenticity. The issue is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and tracked as CWE-284; it is not reported as actively exploited, and the available PoC reference is not verified as working exploit code. Vuln.today prioritizes remediation this month.
A parser differential in the Rust `zip` crate (zip2) through 9.0.4 lets a crafted archive present different filenames to different readers: the random-access `ZipArchive` API trusts the Central Directory File Header while the unstable streaming `ZipStreamReader` extracts using the unverified Local File Header name, writing to an attacker-chosen path without reconciling the two. Applications that scan uploads with a Central-Directory-first tool and then extract with the streaming reader can be tricked into overwriting files on disk, giving integrity and availability impact and potentially code execution if the overwritten file is later executed. The advisory includes a public proof-of-concept integration test with claimed verified execution output, but there is no CISA KEV listing and no confirmed report of exploitation in the wild; exploitation is conditional on the consuming application actually using the unstable streaming API in a decoupled scan-then-extract pipeline.
Cross-namespace authorization bypass in HashiCorp consul-k8s 0.42.0 and later can let an attacker with an existing low-privilege authenticated foothold obtain elevated Consul privileges through component ACL binding rules; deployments not using those rules or running releases before 0.42.0 are outside the stated affected scope. The flaw is fixed in consul-k8s 2.1.0 and 1.8.18, and no public exploit was identified at time of analysis, but the 9.9 CVSS score and act_now priority support prompt remediation.
vLLM before 0.32.0 lets untrusted image bytes pick their own Pillow decoder: ImageMediaIO calls Image.open(BytesIO(data)) without an allowlist and the declared MIME label does not constrain format selection, so an EPS payload submitted as image/png is dispatched to the host's Ghostscript. On hosts whose Ghostscript is affected by CVE-2024-29510 this chains to command execution with the vLLM process's privileges, and on environments running Pillow 12.0.0 through 12.2.0 the same boundary reaches CVE-2026-59203, where a malformed EPS parks media-loading workers until the pool is exhausted. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1 High), reflecting that reachability still depends on an image-capable endpoint, the deployment's API-key and network policy, and a vulnerable host dependency; the reported reproduction covered the loader-level command execution, while the HTTP request path was only source-traced. No public exploit code was identified at time of analysis, and CISA KEV does not list this CVE.
Unauthenticated webhook forgery in the Padok Burrito Terraform Automation Collaboration Software Kubernetes operator through 0.12.0 lets anyone who can reach burrito-server's /api/webhook endpoint create or delete TerraformPullRequest custom resources with attacker-chosen Branch, Base and ID fields, provided the tracked repository's credential omits webhookSecret or sets it to an empty value. The forged event drives a real terraform plan of the attacker-selected branch under the operator's own stored git and cloud credentials, and code analysis indicates the resulting diff can be posted onto a genuine pull request's comment thread, exposing and misattributing another branch's infrastructure changes; auto-apply is hardcoded off for these temporary layers so the flaw alone cannot force a terraform apply. The CVSS vector is unauthenticated (PR:N) and the priority call is act_now; no CISA KEV entry appears in the supplied data, and the GitHub advisory publishes a proof-of-concept test it reports as passing against envtest.
Remote code execution can result in Mautic 7 (7.0.0 through 7.2.1) when campaign-import archives carry asset files that are copied into the public media directory without filename or type validation. An authenticated user holding campaign-import create permission, without administrator rights, can upload server-side scripts through the UI or the /api/campaigns/import endpoint, but code execution depends on the web server honoring per-directory configuration and executing scripts from media/, as the official Apache Docker image does. The vendor fixed the issue in 7.2.2, and no public exploit is identified at time of analysis; CISA KEV status is not indicated.
SQL injection in Esri ArcGIS Server 12.1 and earlier on Windows and Linux allows remote attackers to invoke database-specific functions that should not be permitted, with high confidentiality, integrity, and availability impact. In default deployments the attacker must hold privileges to access the targeted service; fully anonymous exploitation is possible only when a service is explicitly configured in the non-default 'public' access mode, so realistic exposure is lower than the input 9.8 base score suggests. The vendor has released patches for 12.1, 12.0, 11.5, 11.3, and 11.1, and no public exploit is identified in the supplied data.
Remote command injection in Vertiv Avocent ACS8000's root-privileged wsserver terminal-bridge daemon allows unauthenticated network attackers to execute shell commands by supplying crafted WebSocket fields that reach system() and popen() without quoting, escaping, or character-set validation. The public-key session path performs no appliance-session check, consistent with the CVSS PR:N vector, so the vulnerable command-construction path can be reached without an appliance authentication gate. No public exploit was identified at time of analysis; no CISA KEV entry or EPSS score is present in the supplied intelligence, and the vuln.today decision label is act_now.
Authentication bypass in Fortinet FortiSandbox and FortiSandbox PaaS allows remote attackers to execute unauthorized code or commands through crafted HTTP requests. The flaw (CWE-288, alternate path or channel bypass) carries a 9.8 CVSS score with a PR:N/UI:N vector, meaning no credentials or user interaction are needed against the exposed HTTP interface; affected releases are FortiSandbox 5.0.0-5.0.6, 4.4.0-4.4.9 and 4.2 (all versions), plus FortiSandbox PaaS 5.0.0-5.0.6, 4.4 (all) and 4.2 (all). No public exploit code or CISA KEV entry is present in the supplied data, but the vendor-reported severity and the act_now priority label make this a genuine high-priority issue; internet-exposed management interfaces carry the greatest exposure.
Directory traversal in NexoPOS 6.2.4 through the api/update endpoint carries a CVSS 9.8 severity score, with network reachability of that endpoint as the only confirmed prerequisite; authentication requirements are not confirmed from the available data, and the read-versus-write impact is not established. A public PoC reference exists but is not verified as working exploit code, and no CISA KEV entry confirms active exploitation.
Arbitrary file deletion in SourceCodester Online Food Ordering System 1.0 lets remote attackers who can reach admin/delete.php supply a crafted image_name value to unlink(), deleting files outside the intended image directory and affecting integrity and availability without disclosing data. Authentication requirements are not confirmed: the input CVSS 4.0 vector marks PR:N, but the endpoint resides under admin/ and the authoritative assessment treats admin-only versus unauthenticated access as unverified. A public PoC reference exists but is not verified as working exploit code; EPSS is 0.47% (40th percentile), and the available intelligence does not confirm active exploitation.
Information disclosure in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 allows remote, unauthenticated attackers to read limited device data by manipulating the token argument handled by getLanguageCfg in global.so. The issue is moderate severity (CVSS 4.0 base 5.5; independent CVSS 3.1 assessment AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) and is constrained mainly by network reachability of the router management interface, which is typically LAN-side unless remote management is exposed. A public PoC reference exists; it is not verified as working exploit code, no active exploitation is confirmed in the supplied data, and EPSS is low at 0.40% (34th percentile).
SQL comment smuggling lets an attacker slip statements past the DDL blacklist enforced by iFlytek astron-agent's memory-database API in core/memory/database/api/v1/exec_ddl.py, affecting releases up to and including 1.1.2 and yielding low-level confidentiality, integrity and availability impact on the backing database rather than a full compromise. The filter in the DDL Whitelist Handler is an incomplete blacklist (CWE-184), so obfuscated statements are not rejected; a public PoC reference for the bypass exists, though it is not verified as working exploit code, and there is no CISA KEV entry or confirmed active exploitation. Authentication requirements are not confirmed from the available data, and the maintainers did not respond to the report, so no vendor-released patch or advisory has been identified at time of analysis.
A double free in the AFC service handler of libimobiledevice through 1.4.0 can be triggered when the client processes attacker-controlled data received over the AFC channel, meaning a victim must connect a libimobiledevice-based tool to a malicious or compromised iOS device, or an attacker must interpose on the usbmuxd/AFC communication path. Impact is assessed as low across confidentiality, integrity and availability, consistent with a crash or constrained memory corruption rather than reliable code execution. A public proof-of-concept reference (a write-up) exists but is not verified as working exploit code, no CISA KEV entry is present, and the vendor did not respond to the disclosure.
The Installation Handler in BillaBear up to 2025.01.03 exposes the processInstall function of src/BillaBear/Controller/InstallController.php without any authentication check, so remote unauthenticated requests can reach the installation workflow. The vendor was contacted but did not respond, and no fixed version is listed. A public PoC reference exists (a gist linked from the VulDB entry) but it is not verified as working exploit code; the priority label is 'this_month' rather than act_now, and no CISA KEV entry is recorded.
Server-side request forgery in the RhaPHP Mp Module media proxy lets unauthenticated remote attackers make the server issue requests to arbitrary URLs by manipulating the 'url' argument handled in application/mp/controller/Show.php. The flaw affects the rolling-release RhaPHP codebase up to commit 7ae639ccf8dcb627faace096d030bd4cb4cfb905; because the project does not publish numbered versions, no affected or fixed release versions are available. A public PoC reference exists but is not verified as working exploit code, and the measured impact is low across confidentiality, integrity and availability.
Unauthenticated path traversal in the documentation controller of PGYER CodeFever lets remote attackers read files outside the intended documentation root via crafted URI segments. The flaw sits in the _detail handler of application/controllers/doc.php, where the attacker-controlled uri_string is concatenated into a filesystem path without canonicalization or a directory boundary check; impact is limited to read-only information disclosure with no integrity or availability effect (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.5). CodeFever ships as a rolling release, so no fixed version numbers exist - the upstream fix is commit e4433eee96883a222403854e8ac38b3146774a07 (PR #226); a public PoC reference exists but is not verified as working exploit code, and the issue is not reported as actively exploited.
Origin validation bypass in the PayPal IPN handler of rAthena FluxCP through commit 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d lets remote unauthenticated attackers spoof the X-Real-IP header so crafted payment notifications appear to come from PayPal's IP ranges. The flaw is in verifyiprange() in lib/Flux/PaymentNotifyRequest.php and is reachable only where PayPal IPN processing is enabled and the application trusts the X-Real-IP header, typically behind a reverse proxy. A public PoC reference exists but is not verified as working exploit code; no CISA KEV entry is reported, and the vendor did not respond to disclosure. The assessed impact is limited to integrity and availability of IPN origin handling (CVSS 3.1: 5.5).
Unauthenticated remote manipulation of the 'hash' argument handled by app/del.php in icret EasyImage (EasyImages2.0) through version 2.8.7 permits improper privilege management, letting an attacker perform unauthorized file deletion and manipulation on a network-exposed instance without any credentials or user interaction. Confidentiality is not affected and integrity/availability impact is rated Low, so the practical outcome is destructive file-level tampering rather than data theft or code execution. A public proof-of-concept reference has been published alongside the report; it is a reference only and is not verified as working exploit code, and no confirmed active exploitation has been reported.
SQL injection in HashenUdara's edoc-doctor-appointment-system lets remote attackers manipulate the 'spec' argument of admin/add-new.php to read or alter database contents. The project is distributed as a rolling release, so no version boundary separates vulnerable from fixed builds, and the vendor did not respond to disclosure. A public PoC reference exists, but it is not verified as working exploit code; the decision label is this_month, and authentication requirements for the administrative page are not confirmed from available data.
Missing authentication on the SignalR hub of GiantappMan LiveWallPaper 2.6.8.0's local server component lets remote attackers invoke the /LiveWallpaper/UploadFile endpoint without any credentials or user interaction, giving low-level confidentiality, integrity and availability impact (CVSS 4.0 base 6.9). Pre-patch code in the same request path also lacks path normalization and file-extension filtering, so the same unauthenticated channel can be abused for file writes outside the wallpaper directory and for uploading executable files. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV entry is associated with this CVE, and the practical exposure depends on whether the LocalServer listens beyond loopback on the Windows host.
Authentication bypass in Kener 3.0.0 through 4.1.9 lets unauthenticated remote attackers who know an administrator's email address forge a kener-user JWT session cookie and reach /manage/api with full administrative privileges, and also forge password-reset tokens, because the application silently falls back to the hardcoded string 'DUMMY_SECRET' when KENER_SECRET_KEY is empty or unset. The flaw is conditional rather than universal: the assessed vector is AC:H/AT:P precisely because any instance configured with a strong, unique KENER_SECRET_KEY rejects the forged token, so only default or misconfigured deployments are exploitable - but those deployments are fully compromised with no credentials and no user interaction. No public exploit code is confirmed at time of analysis and there is no KEV listing; EPSS is 0.62% (50th percentile), which understates the risk for unhardened instances, and the vendor priority label is act_now.
Unauthenticated remote code execution affects OpenHands Software Agent SDK releases before 1.52.0 when the DockerWorkspace or Apptainer workspace launchers are used in their default configuration: the sandbox agent server binds to 0.0.0.0 with an empty session_api_keys list, so authentication is effectively disabled. A remote attacker who can reach the published container port (CVSS 4.0 base 9.3, assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact) can issue unauthenticated HTTP and WebSocket requests to run arbitrary shell commands as root inside the sandbox, read the mounted workspace, and pull plaintext secrets from the secrets store. Vendor patch v1.52.0 is available and the priority decision is act_now; no public exploit code was identified in the supplied data, though VulnCheck reported the issue.
Local privilege escalation in boneIO black_debian_images builds prior to 1.6.0 lets anyone who controls the boneio service account become root, because that account carries a full passwordless sudo rule and membership in the docker group - either one is sufficient for full root compromise. The flaw is strictly local and requires authenticated access (CVSS:4.0 AV:L/PR:L), so an attacker must already have code execution as the boneio user through some other weakness before this becomes useful. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the vendor-assigned severity of 9.3 and a vuln.today priority of act_now reflect that fielded devices remain exposed until the 1.6.0 upgrade is installed and its migrations run.
Unauthenticated path traversal combined with missing authorization in the cloud-storage source of Google MCP Toolbox for Databases (googleapis/mcp-toolbox) 1.2.0 through 1.4.0 lets a remote caller use crafted tool invocation parameters to copy arbitrary files from the host into attacker-chosen Google Cloud Storage buckets and to overwrite arbitrary local files. Every severity signal points the same way: the CVSS 4.0 base score is 9.3 with AV:N/AC:L/AT:N/PR:N/UI:N and high vulnerable-system confidentiality, integrity and availability impact, and the vuln.today decision label is act_now, so this should be prioritized immediately. No public exploit code and no CISA KEV entry were identified at time of analysis; no EPSS score was supplied. Realistic exposure is bounded by whether the toolbox endpoint is network-reachable by untrusted callers and by the GCS permissions granted to the host service account.
Unauthenticated OS command injection in the WolfProt interface of WolfVision Cynap collaboration devices allows a remote attacker who can reach the service to run arbitrary operating-system commands at the privilege level of the Cynap application service. The flaw is rated 9.3 (CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity and availability impact) and maps to CWE-78; the vulnerable surface spans the Cynap, Cynap Core, Cynap Core Pro, Cynap Pro, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro, Cynap Pure Next Gen, Cynap Pure SDM, Cynap Receiver, Cynap Bridge and Cynap Videobar firmware lines. Per the supplied intelligence the decision is act_now; no public exploit code and no confirmed active exploitation were reported in the available data. The practical exposure gate is network reachability of the WolfProt service, so devices reachable from management or meeting-room networks carry the most risk.
Unauthenticated account takeover in MacCMS v10 before 2026.1000.4054 lets any remote attacker reset the password of any registered member, because the password-recovery verification routine never binds the submitted code to the account it was issued for. An attacker requests a recovery code through user/findpass_msg delivered to their own mailbox or phone, then submits that code to user/findpass_reset together with the victim's registered email address or phone number, and the reset succeeds. No authentication, privileges, or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, vendor score 9.3); the only prerequisites are that the member system and its code-delivery channel are enabled and that the attacker knows the victim's registered identifier. Our assessment rates this a genuine high-priority issue rather than an inflated score, and the vendor has released a patch; no public exploit code was identified at time of analysis.
Improper authentication and authorization controls in the CreditNirvana Collections Platform (CollectionWorkz) login service let an unauthenticated remote attacker manipulate authentication requests and reach platform APIs without a valid session - enumerating users and establishing sessions as arbitrary accounts, including administrators, with the ability to read and modify sensitive data at that user's privilege level. The flaw is scored 9.3 under CVSS 4.0 (AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact but no availability impact), and CERT-In has issued an advisory; the vuln.today priority is act_now. No public exploit code and no CISA KEV entry were identified in the available data, and the specific affected version range is not stated.
Unauthenticated remote attackers can forge payment-confirmation callbacks against WooCommerce stores running the Eurobank WooCommerce Payment Gateway plugin through 2.1.1, marking pending orders as paid and forcing arbitrary orders into a 'failed' status. The plugin authenticates those callbacks with a shared secret that ships empty by default, so a default installation provides no barrier on the 'paid' path; only an operator who has explicitly configured a non-empty confirmation secret blocks that path, while the 'failed' status path requires no secret under any configuration. Rated CVSS 5.3 (integrity-only, PR:N/UI:N) and prioritized as a this-month remediation item; there is no CISA KEV entry and no verified working exploit code, only a public PoC reference published alongside the WPScan advisory.
An unauthenticated visitor to a WordPress site running the GiveWP donation plugin before 4.19.0.1 can push a donation through below the amount floor the form is configured to enforce, by specifying a currency that the site or form does not actually accept. The plugin compares the donation amount to its minimum or fixed value as a bare number, so the mismatched currency slips past the check and the donation is recorded at a value the site owner intended to reject, affecting the integrity of donation records and accounting rather than exposing data or disrupting availability. A public PoC reference exists; it is not verified as working exploit code, and no confirmed active exploitation has been reported; the assessed CVSS is 5.3 with PR:N (unauthenticated) and no user interaction, and exploitation only matters on forms that actually configure a minimum or fixed donation amount.
The OPay Payment Gateway for WooCommerce plugin through version 2.5.5 accepts forged payment notifications because the secret used to validate notification signatures is empty by default, so unauthenticated remote attackers can submit a crafted callback and flip arbitrary WooCommerce orders to paid, cancelled or failed. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only impact) and requires only that the signing secret remains at its default unset state and that the notification endpoint is reachable. There is no CISA KEV entry and no verified working exploit code; a public PoC reference exists; it is not verified as working exploit code, and priority is assessed as this-month remediation rather than emergency.
Unauthenticated payment-forgery in the WordPress plugin Online Payments with iK Pay Gateway before 3.0.4 allows remote attackers to submit a crafted gateway callback that the plugin accepts without verifying its authenticity, marking arbitrary orders as paid without any money changing hands, or flipping arbitrary unprocessed orders to a failed state. The flaw is reachable on a default installation (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, CWE-287), so no credentials or user interaction are needed; the only prerequisite is that the target site processes orders through the iK Pay callback flow. There is no CISA KEV entry and no confirmed working exploit code - only a public PoC reference via the WPScan advisory - and the practical damage depends on whether the store auto-fulfills orders on a 'paid' status.
Unauthenticated attackers can forge CCAvenue payment-confirmation requests against WooCommerce stores running the CCAvenue Payment Gateway plugin through version 3.1, marking an existing or newly created order as paid without payment. The access-control weakness (CWE-284) stems from missing verification that the request originates from the provider and from a verification key derived from a value that is empty on a default install; CVSS 3.1 scores it 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only), and default installations with the callback active are exposed while stores with a populated non-empty key are not. No CISA KEV entry is present, and a public exploit reference exists but is not verified as working exploit code.
Root-level SSH access to WolfVision vSolution Matrix appliances can be obtained by anyone holding the private key that matches the product's shared cryptographic trust configuration, allowing authentication as root on affected devices. Only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled are in scope, so the exposed population is a non-default subset rather than every deployment; the CVSS 4.0 vector (9.2) marks PR:N and UI:N, meaning no legitimate credentials or victim interaction are required once the key is in hand, while AT:P reflects that the key must first be acquired. No public exploit code or confirmed active exploitation appears in the supplied intelligence, but the vuln.today decision label is act_now and the shared nature of the trust material means one recovered key can potentially be replayed against multiple affected master stations.
Improper certificate validation in the Erlang HTTP client hackney (1.24.0 through 4.8.x) lets an on-path attacker impersonate a server that an application has pinned to a private certificate authority. Because hackney adds its own {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration and OTP honours that callback over a caller-supplied cacerts/cacertfile trust store, a chain ending in any certifi-bundled public root can be accepted as the trust anchor; the attacker still needs a man-in-the-middle position and a publicly trusted certificate for the exact pinned hostname that satisfies the hostname check, so only non-default private-CA pinning deployments are exposed. No public exploit identified at time of analysis and no CISA KEV entry, though the issue is triaged as act_now and fixed in hackney 4.9.0.
Command injection in the apmib_set handler of firewall.so on TOTOLINK A950RG routers running firmware 4.1.2cu.5268_B20221104 lets a remote attacker who holds low-privilege credentials execute arbitrary commands on the device, with high impact on confidentiality, integrity and availability. The vulnerable configuration routine is reachable over the network but requires at least low-privilege authentication (PR:L) plus reachability of the management interface, which is typically LAN-side unless remote administration is enabled; no user interaction is involved and attack complexity is low. A public exploit disclosure reference (a GitHub gist) is cited in the advisory and the vendor has not published a fixed firmware build in the available data, while EPSS sits at 1.88% (79th percentile) and priority is rated this_week rather than emergency.
A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An unprivileged attacker may be able to execute arbitrary code as root.