Unauthenticated remote attackers can mark or cancel arbitrary WooCommerce orders and disclose customer contact details on stores running Mintpay for WooCommerce through version 2.2.3, because the plugin processes payment callbacks without verifying their authenticity. The issue is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and tracked as CWE-284; it is not reported as actively exploited, and the available PoC reference is not verified as working exploit code. Vuln.today prioritizes remediation this month.
Arbitrary file deletion in SourceCodester Online Food Ordering System 1.0 lets remote attackers who can reach admin/delete.php supply a crafted image_name value to unlink(), deleting files outside the intended image directory and affecting integrity and availability without disclosing data. Authentication requirements are not confirmed: the input CVSS 4.0 vector marks PR:N, but the endpoint resides under admin/ and the authoritative assessment treats admin-only versus unauthenticated access as unverified. A public PoC reference exists but is not verified as working exploit code; EPSS is 0.47% (40th percentile), and the available intelligence does not confirm active exploitation.
Information disclosure in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 allows remote, unauthenticated attackers to read limited device data by manipulating the token argument handled by getLanguageCfg in global.so. The issue is moderate severity (CVSS 4.0 base 5.5; independent CVSS 3.1 assessment AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) and is constrained mainly by network reachability of the router management interface, which is typically LAN-side unless remote management is exposed. A public PoC reference exists; it is not verified as working exploit code, no active exploitation is confirmed in the supplied data, and EPSS is low at 0.40% (34th percentile).
SQL comment smuggling lets an attacker slip statements past the DDL blacklist enforced by iFlytek astron-agent's memory-database API in core/memory/database/api/v1/exec_ddl.py, affecting releases up to and including 1.1.2 and yielding low-level confidentiality, integrity and availability impact on the backing database rather than a full compromise. The filter in the DDL Whitelist Handler is an incomplete blacklist (CWE-184), so obfuscated statements are not rejected; a public PoC reference for the bypass exists, though it is not verified as working exploit code, and there is no CISA KEV entry or confirmed active exploitation. Authentication requirements are not confirmed from the available data, and the maintainers did not respond to the report, so no vendor-released patch or advisory has been identified at time of analysis.
A double free in the AFC service handler of libimobiledevice through 1.4.0 can be triggered when the client processes attacker-controlled data received over the AFC channel, meaning a victim must connect a libimobiledevice-based tool to a malicious or compromised iOS device, or an attacker must interpose on the usbmuxd/AFC communication path. Impact is assessed as low across confidentiality, integrity and availability, consistent with a crash or constrained memory corruption rather than reliable code execution. A public proof-of-concept reference (a write-up) exists but is not verified as working exploit code, no CISA KEV entry is present, and the vendor did not respond to the disclosure.
The Installation Handler in BillaBear up to 2025.01.03 exposes the processInstall function of src/BillaBear/Controller/InstallController.php without any authentication check, so remote unauthenticated requests can reach the installation workflow. The vendor was contacted but did not respond, and no fixed version is listed. A public PoC reference exists (a gist linked from the VulDB entry) but it is not verified as working exploit code; the priority label is 'this_month' rather than act_now, and no CISA KEV entry is recorded.
Server-side request forgery in the RhaPHP Mp Module media proxy lets unauthenticated remote attackers make the server issue requests to arbitrary URLs by manipulating the 'url' argument handled in application/mp/controller/Show.php. The flaw affects the rolling-release RhaPHP codebase up to commit 7ae639ccf8dcb627faace096d030bd4cb4cfb905; because the project does not publish numbered versions, no affected or fixed release versions are available. A public PoC reference exists but is not verified as working exploit code, and the measured impact is low across confidentiality, integrity and availability.
Unauthenticated path traversal in the documentation controller of PGYER CodeFever lets remote attackers read files outside the intended documentation root via crafted URI segments. The flaw sits in the _detail handler of application/controllers/doc.php, where the attacker-controlled uri_string is concatenated into a filesystem path without canonicalization or a directory boundary check; impact is limited to read-only information disclosure with no integrity or availability effect (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.5). CodeFever ships as a rolling release, so no fixed version numbers exist - the upstream fix is commit e4433eee96883a222403854e8ac38b3146774a07 (PR #226); a public PoC reference exists but is not verified as working exploit code, and the issue is not reported as actively exploited.
Origin validation bypass in the PayPal IPN handler of rAthena FluxCP through commit 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d lets remote unauthenticated attackers spoof the X-Real-IP header so crafted payment notifications appear to come from PayPal's IP ranges. The flaw is in verifyiprange() in lib/Flux/PaymentNotifyRequest.php and is reachable only where PayPal IPN processing is enabled and the application trusts the X-Real-IP header, typically behind a reverse proxy. A public PoC reference exists but is not verified as working exploit code; no CISA KEV entry is reported, and the vendor did not respond to disclosure. The assessed impact is limited to integrity and availability of IPN origin handling (CVSS 3.1: 5.5).
Unauthenticated remote manipulation of the 'hash' argument handled by app/del.php in icret EasyImage (EasyImages2.0) through version 2.8.7 permits improper privilege management, letting an attacker perform unauthorized file deletion and manipulation on a network-exposed instance without any credentials or user interaction. Confidentiality is not affected and integrity/availability impact is rated Low, so the practical outcome is destructive file-level tampering rather than data theft or code execution. A public proof-of-concept reference has been published alongside the report; it is a reference only and is not verified as working exploit code, and no confirmed active exploitation has been reported.
SQL injection in HashenUdara's edoc-doctor-appointment-system lets remote attackers manipulate the 'spec' argument of admin/add-new.php to read or alter database contents. The project is distributed as a rolling release, so no version boundary separates vulnerable from fixed builds, and the vendor did not respond to disclosure. A public PoC reference exists, but it is not verified as working exploit code; the decision label is this_month, and authentication requirements for the administrative page are not confirmed from available data.
Missing authentication on the SignalR hub of GiantappMan LiveWallPaper 2.6.8.0's local server component lets remote attackers invoke the /LiveWallpaper/UploadFile endpoint without any credentials or user interaction, giving low-level confidentiality, integrity and availability impact (CVSS 4.0 base 6.9). Pre-patch code in the same request path also lacks path normalization and file-extension filtering, so the same unauthenticated channel can be abused for file writes outside the wallpaper directory and for uploading executable files. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV entry is associated with this CVE, and the practical exposure depends on whether the LocalServer listens beyond loopback on the Windows host.
Unauthenticated remote attackers can forge payment-confirmation callbacks against WooCommerce stores running the Eurobank WooCommerce Payment Gateway plugin through 2.1.1, marking pending orders as paid and forcing arbitrary orders into a 'failed' status. The plugin authenticates those callbacks with a shared secret that ships empty by default, so a default installation provides no barrier on the 'paid' path; only an operator who has explicitly configured a non-empty confirmation secret blocks that path, while the 'failed' status path requires no secret under any configuration. Rated CVSS 5.3 (integrity-only, PR:N/UI:N) and prioritized as a this-month remediation item; there is no CISA KEV entry and no verified working exploit code, only a public PoC reference published alongside the WPScan advisory.
An unauthenticated visitor to a WordPress site running the GiveWP donation plugin before 4.19.0.1 can push a donation through below the amount floor the form is configured to enforce, by specifying a currency that the site or form does not actually accept. The plugin compares the donation amount to its minimum or fixed value as a bare number, so the mismatched currency slips past the check and the donation is recorded at a value the site owner intended to reject, affecting the integrity of donation records and accounting rather than exposing data or disrupting availability. A public PoC reference exists; it is not verified as working exploit code, and no confirmed active exploitation has been reported; the assessed CVSS is 5.3 with PR:N (unauthenticated) and no user interaction, and exploitation only matters on forms that actually configure a minimum or fixed donation amount.
The OPay Payment Gateway for WooCommerce plugin through version 2.5.5 accepts forged payment notifications because the secret used to validate notification signatures is empty by default, so unauthenticated remote attackers can submit a crafted callback and flip arbitrary WooCommerce orders to paid, cancelled or failed. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only impact) and requires only that the signing secret remains at its default unset state and that the notification endpoint is reachable. There is no CISA KEV entry and no verified working exploit code; a public PoC reference exists; it is not verified as working exploit code, and priority is assessed as this-month remediation rather than emergency.
Unauthenticated payment-forgery in the WordPress plugin Online Payments with iK Pay Gateway before 3.0.4 allows remote attackers to submit a crafted gateway callback that the plugin accepts without verifying its authenticity, marking arbitrary orders as paid without any money changing hands, or flipping arbitrary unprocessed orders to a failed state. The flaw is reachable on a default installation (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, CWE-287), so no credentials or user interaction are needed; the only prerequisite is that the target site processes orders through the iK Pay callback flow. There is no CISA KEV entry and no confirmed working exploit code - only a public PoC reference via the WPScan advisory - and the practical damage depends on whether the store auto-fulfills orders on a 'paid' status.
Unauthenticated attackers can forge CCAvenue payment-confirmation requests against WooCommerce stores running the CCAvenue Payment Gateway plugin through version 3.1, marking an existing or newly created order as paid without payment. The access-control weakness (CWE-284) stems from missing verification that the request originates from the provider and from a verification key derived from a value that is empty on a default install; CVSS 3.1 scores it 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only), and default installations with the callback active are exposed while stores with a populated non-empty key are not. No CISA KEV entry is present, and a public exploit reference exists but is not verified as working exploit code.
LDAP filter injection in the res_config_ldap realtime driver of Asterisk (before 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk before 20.7-cert11 and 22.8-cert3) allows remote unauthenticated attackers to place LDAP filter metacharacters into the SIP username field, which the module splices into backend LDAP filters without RFC 4515 escaping, letting them issue arbitrary directory queries and disclose information. Exposure is limited to deployments where res_config_ldap is both loaded and configured against an LDAP server - a non-default configuration per the vendor advisory - and impact is confidentiality-only, with no modification or denial of service described. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is roughly 2% (80th percentile), consistent with the configuration precondition rather than a broadly weaponizable flaw.
Reachable assertion in llama.cpp (through 0.7.0) lets unauthenticated remote callers abort the inference process by driving the non-default Mirostat sampler into non-finite or zero-sum token probabilities, producing a denial of service that is confined to availability. Only deployments that expose an inference endpoint such as llama-server to untrusted clients - and that permit those clients to select Mirostat v1/v2 and influence sampling parameters or inputs that make probabilities non-finite - are affected; there is no code execution, data disclosure or integrity impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and the issue carries a moderate this_month priority rather than urgent handling. The flaw was reported upstream through pull request #29992, which adds the missing guards; a tagged release containing that fix is not independently confirmed.
Unauthenticated PHP file inclusion in WWBN AVideo (confirmed affected: release tags v29.3.0 and v29.4.0 plus master snapshot 8a32cc70a4758c74c54cdc80c592f11514debcb2) lets a crafted Accept-Language header steer the locale loader outside the locale/ directory by smuggling overlapping traversal ('....//') past a single-pass str_replace('../','') filter, causing include_once to execute PHP files that already exist elsewhere in the web root. The inclusion primitive needs no account, privilege or victim interaction when browser-based automatic language detection or browser-language fallback is active, but the resulting impact is bounded by which readable PHP files already exist at a reachable path - arbitrary attacker code execution would require a separate, undemonstrated ability to upload a PHP file, and the advisory did not show secret disclosure, arbitrary file reading or quantified availability loss. No public exploit code was identified at time of analysis, EPSS is 0.51% (43rd percentile) and the issue is not in CISA KEV, so the decision label is this_month rather than act_now.
Unauthenticated code injection in DedeCMS 5.7.118 lets a remote attacker manipulate the 'aid' argument of the advertisement-rendering endpoint plus/ad_js.php, which is processed through the _RunMagicQuotes function in common.inc.php, to inject code into the application (CWE-94). The CVSS 4.0 and independent assessments agree on network reachability with no privileges and no user interaction (AV:N/AC:L/AT:N/PR:N/UI:N), while impact sub-scores are Low, indicating a partial rather than full compromise is the likely ceiling. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and the vuln.today decision label places it in this_month - routine triage rather than emergency response, with exposure limited to installations where plus/ad_js.php is reachable over the network.
Information exposure in the a2a-go SDK for the A2A protocol (versions up to and including 2.4.0) causes push notification configuration data to be written into an error message returned by factory.CreateExecutor in a2asrv/agentexec.go. The leak only occurs when saving the push configuration fails, at which point the pre-patch code interpolated the entire params.Config.PushConfig structure into the returned error, exposing callback/webhook details to the remote caller; the assessed impact is confidentiality-only (C:L) with no integrity or availability effect, reachable remotely with no authentication or user interaction required per the CVSS vector. No public exploit code or PoC is identified in the supplied sources and the issue is not in CISA KEV; the vendor fix is a2a-go v2.5.0 (PR #393, commit f4d5882).
An out-of-bounds read in nDPI's SoftEther dissector (dissect_softether_host_fqdn() in softether.c, all versions through 6.0) lets remote, unauthenticated attackers crash or destabilize a DPI engine that is inspecting traffic. The flaw is only reachable once nDPI has already classified a flow as SoftEther: the attacker then sends a crafted short or truncated SoftEther UDP datagram so that the consumed byte count passed to strncmp exceeds the real payload length, and the comparison runs past the end of the packet buffer. Impact is limited to availability of the monitoring process (no confidentiality or integrity effect), and the precondition of an existing classified SoftEther flow constrains opportunistic abuse; EPSS is low at 0.43% (37th percentile), there is no KEV listing, and no working exploit code appears in the available data, although a public technical write-up of the bug exists.
Connection-capacity exhaustion in the MICE (Miracast over Infrastructure Connection Establishment) service on WolfVision Cynap collaboration devices lets an unauthenticated remote attacker with network reachability to that service occupy its available connection slots, so legitimate users cannot establish MICE-based Miracast sessions while the condition persists. Exposure is bounded: MICE is disabled in the default configuration and must be explicitly enabled by the customer, and Miracast P2P is unaffected and remains available independently of MICE on most devices, although a complete Miracast disruption can occur on some units when WLAN is configured for Infrastructure mode. EPSS is 0.31% (23rd percentile), no public exploit has been identified at time of analysis, and vendor patches are available for the version branches that list fixed releases.
Parsing deeply nested JSON through go-jose versions prior to 4.1.5 can exhaust Go's stack limit and crash the process, giving remote attackers a denial-of-service primitive against any service that feeds untrusted JWT, JWE, JWS, or raw JSON into the library. The CVSS 4.0 vector rates it AV:N/AC:L/PR:N/UI:N with availability-only impact (score 6.9), while our independent CVSS 3.1 assessment scores it 6.7-level severity as A:L - the practical exposure is limited to applications that actually expose a go-jose parsing path to external input. EPSS is low at 0.29% (22nd percentile) and no public exploit has been identified at time of analysis; the vulnerable v4 branch is fixed in 4.1.5, but the v3 branch (<= 3.0.5) remains unpatched.
Unauthenticated access to the Bull Board queue dashboard in OpenPanel self-hosted deployments before 3.0.0 exposes queue administration on the worker HTTP port: anyone who can reach that port can load the dashboard, list every BullMQ queue (with readOnlyMode:false and allowRetries:true), read queue data, Prometheus metrics and Redis/PostgreSQL/ClickHouse health, and call mutating Bull Board endpoints such as add, retry and clean. Exposure is deployment-dependent - the default docker-compose.template.yml does not publish the worker port, but the shipped Coolify template assigns SERVICE_FQDN_OPBULLBOARD to the worker and thereby publishes the UI on a public hostname, and the reporter's test instance bound the port on all interfaces. The vendor advisory includes PoC requests demonstrating HTTP 200 on GET / and GET /api/queues with no 401, but a crafted privileged job add was not demonstrated; EPSS is 0.27% (19th percentile) and there is no CISA KEV entry, and the vendor fixed the issue in 3.0.0.
Decrypting untrusted JWE ciphertext in Go JOSE (go-jose) with CBC-HMAC content encryption can pass an empty buffer into CBC-HMAC unpadding, causing a panic and denial of service. Applications using ParseEncrypted, ParseEncryptedJSON, or ParseEncryptedCompact with A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 on attacker-controlled ciphertext are affected; the v4 line is fixed in 4.1.5, while the advisory lists v3 through 3.0.5 as not yet patched. No public exploit was identified at time of analysis; EPSS is 0.26% (18th percentile), and vuln.today labels the priority this_month.
Unauthenticated information exposure in WOLFVISON Cynap collaboration and presentation devices allows anyone who can reach the web interface to retrieve resources that should only be reachable locally on the device, including screen-saver content and web-interface assets. The flaw stems from a broken access-control check for remote requests and affects Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro before 1.78a, Cynap Videobar before 1.72e, and Cynap Pure (Next Gen) and Cynap Bridge before 2.00d, with the Cynap/Cynap Core/Cynap Pure SDM line listed as affected without a fixed version in the available sources. Per the vendor the exposed resources carry no credentials and no administrative capability, EPSS is low at 0.26% (17th percentile), and no public exploit or active exploitation is indicated, so priority is rated this_month rather than urgent.
Blind SQL injection in the YesWiki despam action (tools/security/actions/despam.php) allows an authenticated administrator to read arbitrary data from the wiki database, including rows from yeswiki_users such as password hashes, affecting every release before 4.7.0. The 'from' POST parameter is passed through mysqli_real_escape_string() but then lands in an unquoted INTERVAL operand, so escaping is inapplicable and attacker-supplied parentheses, keywords and comment markers are interpreted as SQL. Exploitation requires a YesWiki administrator account (despam.php is gated on UserIsAdmin() at line 23); a public proof-of-concept script is published in the vendor's GitHub security advisory and was verified against the doryphore-dev branch, with the result-row count and SLEEP() timing both serving as blind oracles. EPSS is low at 0.25% (16th percentile) and there is no KEV entry; the vuln.today decision label is 'this_month', reflecting a genuine but privilege-gated confidentiality issue rather than an emergency.
Unauthenticated cross-tenant disclosure in OpenPanel before 3.0.0 allows any remote attacker to read other tenants' project annotations - release notes, deploy markers and internal event notes - by calling the public reference.getChartReferences tRPC procedure with a guessed slug-based projectId. The handler never reads the session and performs no project-access or share-token check, so it returns title, description and date rows for any project whose ID the attacker can guess; impact is confidentiality-only (CVSS 6.9, assessed as CVSS:3.1 C:L with no integrity or availability effect). EPSS is 0.25% (16th percentile) and there is no CISA KEV listing, but the vendor advisory documents a public proof-of-concept request and the issue is fixed in 3.0.0.
Unauthenticated review forgery in QloApps 1.6.0 through 1.7.0 allows remote attackers to post fake ratings and reviews attributed to other customers by reusing the publicly exposed review_ajax_token and enumerating sequential id_order values against the qlohotelreview module's AddReview AJAX action. The impact is limited to integrity - forged review content and ratings attached to arbitrary orders - with no read of order data and no effect on availability, consistent with an assessed CVSS:3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. No public exploit has been identified at time of analysis and EPSS is low at 0.25% (16th percentile), although the attack is automatable and SSVC records no observed exploitation; the vendor has published an upstream fix.
Memory-exhaustion denial of service in the erlang-jose JOSE/JWE library for Erlang and Elixir (versions 1.0.0 through 1.11.12) lets a remote, unauthenticated attacker inflate a few-kilobyte JWE token into hundreds of megabytes or gigabytes on the decrypting node and crash the BEAM. When a token carries the optional zip: "DEF" header, jose_jwe_zip:uncompress/2 feeds the entire attacker-controlled plaintext to zlib:inflate/2 with no output-size or inflation-ratio bound, and this happens automatically inside jose_jwe:block_decrypt/2 (JOSE.JWE.block_decrypt/2) before the recipient can inspect or reject the payload; with RSA-OAEP or ECDH-ES key management the attacker only needs the recipient's public key and no secret material. Exposure is limited to applications that actually decrypt JWEs received from untrusted senders and do not reject compressed headers first; EPSS is 0.25% (16th percentile), no confirmed active exploitation (CISA KEV) is recorded, and a proof-of-concept script with supporting logs is published in the upstream advisory GHSA-wfpv-qxp8-x5gm.
Pleasanter's LDAP authentication path can grant access when a request supplies a valid Login ID but no password, letting an attacker who knows an existing account identifier operate with that account's privileges. The issue affects Pleasanter deployments configured to use LDAP authentication; the CVSS 4.0 base score is 6.9 (CWE-304) with low confidentiality and integrity impact and no availability impact. No public exploit was identified at time of analysis, and the vendor and JVN advisories should be consulted for fixed-release and configuration details.
CPU-exhaustion denial of service in the erlang-jose library (versions 1.7.7 through 1.11.12) lets remote attackers who can get an application to parse an untrusted JWK pin BEAM schedulers by submitting a private RSA key that carries only d, e and n and omits every CRT parameter. Parsing such a key drives an internal prime-recovery loop that performs a modular exponentiation over the attacker-supplied modulus on every iteration; when the modulus is itself prime the search can never succeed and burns work until a one-second watchdog kills the worker, so roughly 211 bytes of input costs about one CPU-second. The advisory ships a public proof-of-concept script that was verified end-to-end to reach that watchdog, no credentials or valid RSA key are required, and sustained denial of service needs a flood of concurrent requests because the watchdog bounds each individual parse; EPSS is low (0.24%, 14th percentile) and there is no CISA KEV entry, consistent with a moderate, availability-only issue rather than a top-tier emergency.
Unauthenticated information disclosure in YesWiki 4.6.0 through 4.6.7 (and the 5.0.0 alpha pre-releases) lets anyone append the showreq parameter to a public Bazar listing request and receive the server-assembled SQL query, exposing table names with the configured prefix, JSON storage paths, ACL filter logic and database collation. The affected Bazar API routes are public by default, so default installations exposing an entry-listing endpoint or a {{bazarliste}} page are exploitable with no authentication, role, debug flag or user interaction; the echoed SQL is returned in the JSON body under a rawOutput key. This is reconnaissance-grade confidentiality loss only (no data, integrity or availability impact demonstrated), a public PoC walkthrough exists with source-level verification, EPSS is low at 0.23% (14th percentile), there is no KEV listing and no confirmed active exploitation, and the vuln.today decision is this_month with the vendor fix published in 4.7.0.
QloApps through 1.7.0 exposes guest order data to anyone who can guess a cart identifier: OrderConfirmationController::init() builds its guest-tracking redirect from the attacker-supplied id_cart without confirming that the requester holds the order's secure_key, so sequential id_cart values can be enumerated to harvest guest order references, email addresses and booking details, and to convert a guest into an account with an attacker-chosen password. Only guest-created carts are affected - registered-customer orders follow the history flow and are not exposed - and the impact is bounded to low confidentiality and low integrity loss rather than code execution or data destruction. Remote unauthenticated exploitation of default installations is possible with no user interaction; EPSS is low (0.23%, 13th percentile), no public exploit code has been identified at time of analysis, and the weakness is not listed in CISA KEV, so this fits scheduled remediation rather than emergency response.
Unauthenticated template-selection bypass in YesWiki before 4.7.0 lets remote attackers append a crafted `template` GET parameter to any page that uses the `{{bazarliste}}` action, forcing Bazar entries to render through an arbitrary template inside the `@bazar` Twig namespace. The parameter reaches Twig after only `htmlspecialchars()`, with no `basename()` or `hasTemplate()` check, so an attacker can swap layouts for every visitor who follows the crafted link, producing page defacement and user confusion. Impact stays within display manipulation: Twig's `validateName()` blocks namespace escape and filesystem reads, the effect is non-persistent, and no data modification or confidentiality loss was demonstrated. Risk signals are modest - EPSS 0.21% (11th percentile), SSVC exploitation 'none', not in CISA KEV, and a public proof-of-concept demonstration accompanies the advisory; no active exploitation is confirmed.
Unauthenticated bot-event disclosure in OpenPanel (all versions before 3.0.0) lets anyone POST to the event.bots tRPC procedure with only a projectId and receive bot-event rows - name, type, path and created_at - from projects whose overview share is private or password-protected. The procedure's anonymous branch only checks that a shareOverview row exists and never reads the share's public flag or password, so a share that was created and later toggled off (the share router has no delete path, so the row persists) still leaks, and the exposed path field can reveal internal routes. Impact is confidentiality-only against projects that have such a share row; EPSS is low at 0.21% (11th percentile), SSVC records exploitation as none, a public PoC request is documented in the advisory but is not verified as working exploit code, and the vendor has released a fix in 3.0.0.
Out-of-bounds heap write in Furnace's FamiTracker FTM importer can crash the application and may allow limited memory corruption when a user opens a crafted module with two or more subsongs. Furnace through 0.6.8.3 is affected; exploitation is local-file only and requires user interaction, with the trigger in the GROOVES-block handling in DivEngine::loadFTM(). This is a low-priority issue under the supplied decision signals, with EPSS 0.14%, no CISA KEV entry, and no public exploit identified at time of analysis.
Heap out-of-bounds read in libphdi (all versions through the 20260902 snapshot) lets a crafted Parallels disk image descriptor crash any application that parses it, or expose a limited amount of adjacent heap memory. The bug sits in libphdi_data_files_get_extent_data_file_path and its wide-character twin: the extent data file name length is computed from the directory prefix length rather than the remaining basename length, so a long directory prefix paired with a short basename yields an over-long size and later reads walk past the heap allocation. The vector is local with a passive user-interaction step (the victim must open or process the malicious image), unauthenticated per the PR:N vector, with no write primitive and no code execution; EPSS is 0.13% (2nd percentile), the issue is not in CISA KEV, and no public exploit was identified at time of analysis though a public technical write-up has been published and an upstream fix commit exists.
Heap out-of-bounds read in libpff (libyal) versions 0 through 20260926 allows a crafted PST, OST or PAB mail-store file to cause the parsing application to copy adjacent heap memory into table record entry values or to crash. The flaw sits in libpff_table_read_values_array, where a 7c-type column definition's values_array_size is used without being checked against the bytes remaining in the values-array buffer. The attack is local and requires the victim to open or otherwise process a malicious file (AV:L, UI:R, PR:N), so impact is bounded to limited heap information disclosure plus availability loss from a crash; EPSS is 0.13% (2nd percentile), there is no CISA KEV listing, and a public technical write-up/PoC reference exists but is not verified as working exploit code.
Heap out-of-bounds read in libpff through 20260926 can expose adjacent heap memory or crash applications such as pffexport and pypff when they parse a crafted PST, OST, or PAB file. The off-by-one bounds check in libpff_table_read_6c_record_entries is reached only when a user or automated pipeline opens the malicious file (local vector, passive user interaction, no authentication), and impact is limited to low confidentiality loss and high availability disruption. No public exploit identified at time of analysis; EPSS is 0.13% (2nd percentile) and the issue is rated moderate rather than emergency priority, with an upstream fix commit available.
Improper authorization in DeepSeek Harness 0.2.0-rc.0 through 0.2.0-rc.2 allows unauthenticated remote attackers to perform unauthorized actions through the Browser Auth component, with low impact to confidentiality, integrity and availability (CVSS 4.0 score 6.9). The flaw resides in packages/client/connection/src/browser-auth.ts and is confined to these pre-release builds; the vendor did not respond to the disclosure and no fixed version is listed. No public exploit code has been identified at time of analysis, and the priority is this_month rather than emergency.
netty-tcnative through 2.0.83.Final passes the raw SNI server_name from the ClientHello into JNI's NewStringUTF(), which decodes modified UTF-8 rather than standard UTF-8. A remote, unauthenticated client can therefore place the overlong two-byte sequence 0xC0 0x80 in the SNI extension and have it materialize as an embedded U+0000 character inside the Java hostname string handed to SniHostNameMatcher and returned by SSL.getSniHostname(), letting the attacker influence SNI-based certificate selection, access-control decisions and logging. The assessed severity is CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N); the library-level corruption is unconditional, but real-world impact is gated on the integrating application actually relying on that hostname for a trust decision or re-encoding it downstream. The advisory documents a deterministic researcher reproduction against an unmodified build; no public exploit code is referenced, and there is no KEV or EPSS signal in the provided data.
Clickjacking in the boneIO Black web control panel lets a remote attacker frame the interface on a malicious page and trick a user into clicking overlaid controls that switch relays, open gates, or move blinds, producing unauthorized physical state changes. All versions below 1.6.0 are affected per the vendor CPE, and the vendor-released patch is version 1.6.0. Exploitation requires the victim to visit the attacker's page and click a disguised control (UI:A) while the panel is network-reachable; because CVE-2026-77053 leaves authentication disabled by default, any host on the same internal network can be positioned as that victim. This is a genuine but moderate-priority issue, not an emergency: no public exploit code has been identified at time of analysis and there is no KEV listing, with CERT-PL reporting and the vendor documentation as the available sources.
Cleartext credential exposure in boneIO Black before 1.6.0 allows retrieval of MQTT broker and web panel passwords from the GET /api/config endpoint. The assessed vectors carry PR:L, so an authenticated session is normally required, but the reported default configuration tied to CVE-2026-77053 disables authentication, letting an attacker on the same local network obtain the passwords without logging in. Version 1.6.0 fixes the storage and API exposure issues; no public exploit code was identified at time of analysis.
Server-side request forgery in the Erlang hackney HTTP client (versions 4.0.1 up to but not including 4.9.0) lets an attacker steer outbound requests to loopback or private addresses that the calling application believes its SSRF allowlist has already rejected. Two host spellings slip past the check - a percent-encoded bracketed IPv6 literal such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D (decoding to [::ffff:127.0.0.1]) and an IP literal with a trailing dot such as 127.0.0.1. - because the caller's validation parses them differently from hackney's connect path; the same applies to a redirect Location target when redirects are followed. Exploitation is conditional on a consuming application that builds its allowlist with uri_string:parse/1 and inet_parse_address/1 and then passes an attacker-influenced URL to a vulnerable hackney release, so attack complexity is high and the CNA scores the issue 6.9 (Medium) under CVSS 4.0; no public exploit has been identified at time of analysis.
Comment impersonation in MacCMS v10 through 2026.1000.4056 allows unauthenticated visitors to attribute anonymous comments to any registered member by submitting a crafted user_id parameter, so the comment renders with that member's avatar and identity. The impact is integrity-only: it does not provide account takeover, data disclosure, or code execution, and it matters mainly where anonymous commenting is enabled and displayed commenter identity is treated as trustworthy. No public exploit was identified at time of analysis.
Authenticated users holding theme management rights on Webasyst Framework through 4.4.0 can read arbitrary files from the server by uploading a crafted theme archive containing symlinks, because waArchiveTar::writeItem() recreates those links without validating their targets and the linked file is then retrievable through the public theme path. Successful abuse exposes secrets such as wa-config/db.php or system files like /etc/passwd. The flaw is gated behind a high-privilege administrative capability (CVSS 3.1 PR:H, 6.9; CWE-59), so realistic attackers are malicious insiders or intruders who already control a privileged account; no public exploit code was identified at time of analysis, and this is tracked as a this-month priority rather than an emergency.
Improper access controls in the Android FileProvider component of HeyCyan App 1.0.103 allow an attacker to reach files the provider is supposed to protect, with low-rated confidentiality and integrity impact and no availability effect. The vendor was contacted about the disclosure and did not respond, and no vendor-released patch has been identified; the CVE is not listed in CISA KEV and no EPSS score was supplied, though a public PoC reference (a GitHub repository linked from the VulDB entry) exists and is not verified as working exploit code. Note that the app's own CVSS 4.0 vector claims a network attack vector (AV:N), while the independent assessment rates this as a local (AV:L) issue: the realistic path is a malicious application co-resident on the same Android device interacting with the misconfigured provider, so exposure is limited to users of this specific build who install other apps alongside it.