Unauthenticated remote code execution in MLflow 3.12.0rc0 through 3.16.x lets any network caller reach the tracking server place a Python module under an allow-listed third-party scorer package and have the server import and instantiate it via the scorer invoke endpoint, executing arbitrary code in the MLflow server process. The flaw is a prefix-matching mistake in the third-party scorer allow-list combined with MLflow's own experiment, run and artifact-upload endpoints, which can be used to publish a module inside a writable scorer package directory; the shipped v3.14.0 container image, running as uid 0 with a writable site-packages tree, is fully exploitable without credentials, while basic-auth deployments require a principal able to create an experiment and run and upload artifacts (the invoke endpoint is gated only by validate_gateway_proxy, with no experiment- or scorer-level permission check). A public proof-of-concept script and a working reproduction accompany the GitHub advisory, and the vendor fixed the issue in 3.17.0.
Remote code execution in Atlantis (runatlantis/atlantis) 0.4.0 through 0.47.0 lets an authenticated contributor whose pull request is eligible for an Atlantis plan inject shell metacharacters through the PR-controlled Terraform workspace value in atlantis.yaml, executing arbitrary commands as the Atlantis service account. The flaw requires no custom workflows, no allow_custom_workflows, no apply permission and no malicious Terraform provider; fork-based contributors reach it only when --allow-fork-prs is enabled, while eligible same-repository branches need no such flag. Because injected commands inherit the Atlantis process environment, exfiltration of cloud-provider, Terraform and VCS credentials plus access to state, plan files, checkouts and the server's network identity are all in scope; exploitation is limited to authenticated contributors (PR:L), public PoCs demonstrating the workspace payload exist, no public working exploit code is confirmed, and vendor-released patch 0.47.1 resolves the issue.
A regular-expression denial of service exists in the Datadog APM client for Node.js (dd-trace-js) versions 2.0.0 through 5.131.0 and 6.0.0 through 6.20.0, where the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can backtrack excessively on attacker-controlled URL query strings. Because the pattern runs synchronously while recording HTTP URL span metadata - and is enabled by default for affected HTTP tracing integrations that capture query strings - an unauthenticated remote attacker who can reach an instrumented endpoint and supply a crafted query string can pin the CPU and stall request processing, degrading or taking down the instrumented application. Impact is confined to availability with no data exposure; no public exploit has been identified at time of analysis, and vendor fixes ship in dd-trace 5.131.1 and 6.20.1.
Symlink-following read paths in FileBrowser Quantum serve files from outside a user's assigned scope: download, preview, media/subtitle, OnlyOffice and public-share handlers resolve links with filepath.EvalSymlinks and then open the resolved target without checking that it is still inside the source root. The unauthenticated worst case, reflected in the CVSS vector (PR:N, S:C, C:H), is a holder of a public share link reading any file the server process can reach through a symlink reachable in the shared directory; an authenticated user with download access achieves the same, including cross-tenant reads where scopes overlap. Exposure requires that a qualifying symlink already exists in the served tree - common with bind-mounted host directories in Docker deployments - and affects filebrowser versions before 1.5.2-stable and 2.0.0-beta through 2.0.1-beta, which are fixed by 1.5.2-stable and 2.0.1-beta. A public proof-of-concept walkthrough accompanies the GHSA advisory and was demonstrated live against 1.3.3-stable; there is no CISA KEV entry, so active exploitation is not confirmed.
Stored cross-site scripting in the TinyMCE rich text editor's media plugin lets a low-privileged authenticated content author plant a crafted span carrying data-mce-object and data-mce-p-<event> handler attributes that the editor materialises into real video/audio/img elements and executes before sanitisation runs. Affected are TinyMCE 7.9.3 and versions 8.5.1 through 8.9.2 with the media plugin enabled; the vendor fixed it in 7.9.4 and 8.9.3 by building those elements in a non-scripting document. Exploitation needs authenticated content-injection access plus a second user processing the stored content, so this is a genuine but conditional priority rather than a top-tier emergency; no public exploit was identified at the time of analysis and there is no CISA KEV entry.
Cross-site scripting in the CKEditor 5 engine package allows crafted editor content - specifically incoming `style` attribute values - to reach a prototype-pollution path in the bundled `es-toolkit` library and result in unauthorized JavaScript execution in the browser. Affected are CKEditor 5 releases from 45.0.0 up to but excluding 47.7.4 on the LTS branch, and from 48.0.0 up to but excluding 48.5.1 on the current branch; per the CVSS vector (AV:N/AC:L/PR:L/UI:N) the actor needs a low-privilege foothold, i.e. the ability to feed content into the editor, rather than a fully anonymous request, and no user interaction beyond the editor processing that content. Vendor patches are available in 47.7.4 and 48.5.1, and no public exploit was identified at time of analysis; this is a patch-now-grade priority within its deployment scope rather than a drop-everything emergency.
Arbitrary file read in MLflow 3.10.0 through 3.16.1 allows remote attackers to store a server-local path as a prompt model version's artifact location and then retrieve files through the /api/2.0/mlflow/model-versions/get-artifact endpoint. Default mlflow server deployments are unauthenticated (CVSS PR:N), while basic-auth deployments are exposed to any authenticated user whose RBAC permits creating registered models. A public PoC reference exists but is not verified as working exploit code, and the vendor fix is available in 3.17.0; assessed priority is this_week.
Remote memory corruption and denial of service in EPICS Base 7.0.10 and prior can be triggered by a remote, unauthenticated integer overflow in network request processing, which causes an undersized allocation before attacker-supplied data is handled; remote code execution is described by the vendor as potential rather than confirmed. Exploitation requires network reachability to a listening EPICS Base service on the affected request path, and EPICS is often deployed on segmented control or experiment networks, which limits exposure but does not protect reachable services. No public exploit was identified at time of analysis, and the vuln.today decision label is act_now.
Resource-confusion in the Model Context Protocol Python SDK (pip package mcp) causes server-side bearer authentication to accept a token that was issued for a different service. The flaw affects HTTP servers built on the SDK that configure auth=AuthSettings(...) with a token_verifier, and it only bites when the same authorization server issues tokens for multiple resources and the deployment's TokenVerifier does not itself check the token's aud audience; in that setup an attacker who already holds a valid bearer token for another service can present it to the wrong MCP server and exercise the access it carries (CVSS 6.8, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, CWE-863). Affected builds are mcp 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1; single-resource deployments, verifiers that already validate aud, and correctly configured patched versions are not exposed. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; exploitation requires a pre-existing token plus a specific multi-resource authorization-server topology.
High-severity integer overflow in EPICS Base 7.0.10 and earlier can be reached over the network without authentication or user interaction when a crafted EPICS protocol message carries a length value that is not properly validated. The resulting out-of-bounds memory write can destabilize or crash the affected process, producing denial of service; no public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Out-of-bounds read in EPICS Base 7.0.10 and earlier lets a remote, unauthenticated attacker who can deliver a crafted message to an EPICS network service (Channel Access or PV Access) make the process read past the end of an allocated buffer, primarily crashing the service and potentially exposing adjacent memory. Affected deployments are typically control-system middleware on segmented or air-gapped facility networks, so real-world reachability depends on whether the protocol port is exposed to the attacker; default builds of all versions up to and including 7.0.10 are in scope. No public exploit was identified at time of analysis, and the vendor/coordinator advisory is ICSA-26-300-01; priority is this_week rather than emergency response.
Out-of-bounds read in EPICS Base 7.0.10 and prior allows unauthenticated remote attackers to crash or degrade an affected IOC/server and potentially disclose adjacent memory contents by sending a crafted network message with insufficiently validated element or length values. The issue is rated high availability impact with limited confidentiality exposure, and no public exploit was identified at time of analysis. Exploitation depends on reaching an EPICS Base service across the network, which in typical deployments sits on segmented control or OT networks.
Client-side server-side request forgery and denial of service in the official Model Context Protocol Python SDK: when a connected MCP server declares a tool outputSchema containing an $id or an out-of-document $ref/$dynamicRef (http://, https:// or file://), the SDK's ClientSession, ClientSessionGroup and 2.x Client classes resolve that reference with jsonschema's default resolver, so the client fetches the URL or reads the local file from its own network and filesystem position and blocks the asyncio event loop for every session in the process while doing so. Applications using the SDK purely as a server are not affected; the vulnerable code runs only when a client invokes tools on a server the operator does not fully control. Versions 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1 are affected and are fixed in 1.30.0 and 2.2.0 respectively; no public exploit has been identified at time of analysis, the fetched content is never returned to the malicious server (blind SSRF), and the CVSS 6.5 score reflects availability impact (A:H) rather than confidentiality.
Unbounded baggage processing in the optional OpenTelemetry Python Jaeger propagator (opentelemetry-propagator-jaeger before 1.45.0) lets a remote sender force unnecessary CPU work and short-lived heap allocations by supplying a carrier with numerous or oversized uberctx-* entries, degrading availability of the receiving service. According to the CVSS vector, no authentication is required (PR:N), but exploitation depends on specific deployment conditions (AT:P): the separately installed Jaeger propagator must be explicitly enabled - it is not part of the default OpenTelemetry Python configuration - and the service must accept untrusted inbound propagation headers. Practical impact is modest because common Python servers cap request headers before they reach the propagator (Gunicorn defaults to 100 header fields and 8,190 bytes per field; Uvicorn/h11 buffers incomplete events at 16,384 bytes), with materially higher exposure for non-HTTP transports, custom TextMapGetter implementations, or deployments that have raised or disabled server and gateway limits. No public exploit code has been identified at time of analysis, and the vendor has released a fix in 1.45.0.
OS command injection in Hitachi HiRDB Server (Version 10 builds from 10-00 before 10-12-01, and Version 9 / Version 9 Additional Function / Version 9(32) / Version 9(32) Additional Function builds from 09-00 through the various 09-66-xx releases) could let an attacker run arbitrary operating-system commands under the database server's privileges; Hitachi's own CVSS 3.1 vector scores this 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), i.e. remote and unauthenticated with no user interaction, although the specific injectable interface or trigger is not described in the available sources. Signals are mixed: severity and vendor priority are high (vuln.today decision label act_now, EPSS 1.77% at the 78th percentile, indicating above-average but not top-tier predicted exploitation likelihood), yet no public exploit code has been identified at time of analysis and the issue is not in CISA KEV. Affected organizations are those running the listed Hitachi HiRDB enterprise RDBMS builds where the vulnerable interface is network-reachable; Hitachi has released fixes in its advisory hitachi-sec-2026-146.
SQL injection in Adobe Campaign Classic, affecting all builds up to and including 7.4.4 build 9402, lets network-reachable attackers execute arbitrary SQL and - per Adobe - achieve arbitrary code execution in the context of the current user, with a CVSS 3.1 score of 10.0 under a changed-scope vector. No public exploit code or confirmed active exploitation was identified at time of analysis, but the vendor vector (AV:N/AC:L/PR:N/UI:N) requires no user interaction and the issue carries an act_now priority. One open question for defenders: although the vector is PR:N, Adobe's reference to the 'victim's account or session' leaves unconfirmed whether an authenticated session is a practical prerequisite, which materially changes exposure for internet-facing versus internal deployments.
The missing-authentication flaw in NVIDIA NeMo Agent Toolkit 1.0 through 1.8.0 leaves a critical toolkit function without a credential check, giving unauthenticated network attackers a path whose rated consequences include code execution, privilege escalation, data tampering, denial of service, and information disclosure. CVSS is 10.0 with AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, and the vuln.today priority label is act_now. No public exploit identified at time of analysis, and no CISA KEV entry appears in the supplied data; network reachability of the toolkit interface is the main practical exposure constraint, and upgrading past 1.8.0 is the vendor-directed remediation.
Cross-origin redirect handling in the Model Context Protocol Python SDK (published on PyPI as `mcp`) leaks caller-supplied custom credential headers, and on 307/308 responses the request body, to any host a trusted MCP endpoint redirects to. Affected are HTTP client paths using `streamable_http_client`, `streamablehttp_client`, `sse_client`, `ClientSessionGroup` with HTTP server parameters, the OAuth client providers, or the internal `create_mcp_http_client` helper in versions 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1, where redirect following was enabled by default or by a caller-supplied client with `follow_redirects=True`. Impact is conditional: a lone `Authorization` bearer header is dropped by the HTTP library on cross-origin hops, the body is only re-sent on 307/308, MCP servers and stdio clients are unaffected, and a malicious MCP server gains nothing because it already receives the requests directly, so exploitation depends on an attacker influencing where a trusted endpoint redirects (stale redirect to a lapsed domain, misrouted proxy rule, attacker-influenced redirect logic). No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor-released fix is available in 1.30.0 (1.x) and 2.2.0 (2.x).
Authentication bypass in Hitachi HiRDB Server (CWE-290, spoofing) lets a remote attacker who can reach the database service impersonate a trusted party and slip past authentication, with maximum impact on confidentiality, integrity and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). All five listed build lines are affected: Server Version 10 (10-00 before 10-12-01), Version 9 and Version 9(32) plus their 'with Additional Function' variants across the 09-00/09-02 to 09-66 branches. Exploitation is unauthenticated and needs no user interaction, so real-world risk is governed mainly by whether the HiRDB listener is reachable from untrusted networks; EPSS is low at 0.64% (51st percentile) and no public exploit has been identified at time of analysis, but the vendor has published a fix and the case is triaged act_now, so exposure should be checked rather than assumed benign.
Authentication bypass in Hitachi JP1/Automatic Job Management System 3 - Manager (versions 10-00 up to but not including 13-50-31) lets remote attackers reach the management service without credentials and, per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N), potentially take full control of confidentiality, integrity and availability. The flaw is rated 9.8 and flagged act_now by vuln.today, while EPSS is modest at 0.64% (51st percentile) and it is not in CISA KEV; no public exploit code has been confirmed. Exposure is greatest where the JP1/AJS3 Manager service is reachable from untrusted networks, since it is normally an internal management server.
Unauthenticated network attackers can invoke a critical HiRDB Server function without an authentication check, exposing affected Hitachi HiRDB Version 10 and Version 9-family deployments to high confidentiality, integrity, and availability impact (CVSS 9.8). The flaw is CWE-306 and is reachable over the network with no privileges or user interaction; Hitachi reports a vendor patch and the vuln.today decision is act_now, while EPSS is 0.61% (49th percentile). No CISA KEV status is provided, and no public exploit identified at time of analysis; Version 10 is fixed in 10-12-01, while the supplied data does not name fixed builds for the Version 9, Version 9(32), or 'with Additional Function' branches.
Stack-based buffer overflow in Hitachi HiRDB Server can corrupt memory and, per the supplied CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8), is scored as remotely reachable by an unauthenticated attacker with no user interaction, yielding high confidentiality, integrity and availability impact. Affected builds are HiRDB Server Version 10 (10-00 before 10-12-01), Version 9 (09-00 through 09-66-22), Version 9 with Additional Function (09-00 through 09-66/V), Version 9(32) (09-02 through 09-66-22) and Version 9(32) with Additional Function (09-00 through 09-66-/V); EPSS is low at 0.52% (44th percentile) and no public exploit has been identified at time of analysis, although the vuln.today decision label is act_now and Hitachi has published an advisory with a vendor patch available.
Heap-based buffer overflow in Hitachi HiRDB Server affects Version 10 builds from 10-00 before 10-12-01 and multiple Version 9 branches (09-00 through 09-66-22, and the Additional Function and 9(32) variants through 09-66/V), allowing a remote, unauthenticated attacker who can reach the database service to corrupt heap memory with high impact on confidentiality, integrity and availability (CVSS 9.8). No public exploit code was identified at time of analysis and EPSS is low at 0.52% (44th percentile), so the exploitability signal is weak even though severity is critical. The priority label is act_now, driven by the maximum-severity network-reachable overflow rather than by observed exploitation, and Hitachi has released updated builds.
A heap-based buffer overflow (CWE-122) in Hitachi JP1/Automatic Job Management System 3 - Manager and 3 - Agent, covering versions from 11-00 up to but not including 13-50-31, is rated 9.8 with a network vector (AV:N/AC:L/PR:N/UI:N) - meaning successful exploitation could give remote, unauthenticated attackers full compromise of confidentiality, integrity and availability of the job-management service. Hitachi has released fixed builds at 13-50-31, but the available sources do not describe the specific feature, protocol or input that triggers the overflow, so no particular enabling configuration can be named. No public exploit code is confirmed, EPSS is low (0.52%, 44th percentile), and there is no KEV listing, yet the vuln.today decision label is act_now given the severity and the fact that this is an unauthenticated network-reachable memory-corruption flaw in infrastructure software.
Stack-based buffer overflow (CWE-121) in Hitachi JP1/Automatic Job Management System 3 - Manager, - Agent, and - Agent Minimal Edition lets remote attackers crash or potentially execute code in the context of the JP1/AJS3 service, with a vendor-assigned CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N). Affected builds are Manager and Agent from 10-00/11-00 up to, but not including, 13-50-31, plus Agent Minimal Edition from 11-50 before 13-50-31; Hitachi has released 13-50-31 as the fix for all three branches. Severity signals and exploitation signals diverge: EPSS is only 0.52% (44th percentile) and no public exploit or KEV listing was identified at time of analysis, yet the vulnerability is remotely reachable with no authentication or user interaction, so vuln.today priority is act_now - the practical exposure limiter being that JP1/AJS3 components normally sit on segmented internal operations networks rather than the internet.
Heap-based buffer overflow in Hitachi JP1/Base versions 11-00 through before 12-50-54 can be triggered by remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and, per the vendor's severity rating of 9.8, may lead to full loss of confidentiality, integrity and availability of the affected service. Hitachi has released a fix in 12-50-54 and later, so exposure is limited to installations that have not yet been updated and that are reachable over the network. No public exploit code has been identified at time of analysis, and the EPSS score is modest at 0.52% (44th percentile), although the vendor's own advisory and the vuln.today decision signal both point to remediation as an immediate priority.
OS command injection in Adobe Campaign Classic (through 7.4.4 build 9402) lets a low-privileged, authenticated network attacker execute arbitrary code in the context of the current user without user interaction. The flaw is rated CVSS 9.9 (CWE-78) with scope changed, and vuln.today assigns it an act_now priority. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Arbitrary code execution in Adobe Campaign Classic (versions 0 through 7.4.4 build 9402) stems from incorrect authorization that lets a low-privileged, authenticated attacker run code in the context of the current user, with no user interaction required. The CVSS 9.9 score reflects a scope change (S:C), meaning the impact crosses a security boundary beyond the vulnerable component, and the only real prerequisite is a valid low-privilege account on a network-reachable ACC instance. No public exploit has been identified at time of analysis, but the issue carries an act_now priority, so exposure should be treated as urgent wherever ACC is reachable by untrusted networks or widely provisioned with low-privilege users.
SQL injection in Adobe Campaign Classic through 7.4.4 build 9402 lets an authenticated low-privileged attacker execute arbitrary code in the context of the current user; the CVSS 3.1 score is 9.9 with scope change and no user interaction required. The flaw is CWE-89 and is reachable over the network by an account with low privileges. No public exploit identified at time of analysis; the vuln.today priority is act_now.
Arbitrary code execution in Adobe Campaign Classic (ACC) up to 7.4.4 build 9402 allows an authenticated low-privileged attacker to run code in the context of the current user over the network without user interaction, with scope change. The act_now priority label and CVSS 9.9 reflect the high impact, but the CVSS vector requires a valid low-privilege account (PR:L) and the exact code-injection sink is not described in available sources. No public exploit code is identified at time of analysis, and no KEV designation or EPSS score is included in the supplied data.
Unauthenticated remote attackers who can reach the Supermicro X12SPI BMC's IPMI interface may be able to bypass integrity and encryption enforcement and execute arbitrary commands against an active IPMI session. The flaw is rated CVSS 9.8 (CWE-306), but exposure is limited by the need for network reachability to the BMC management interface and an existing active session. The vuln.today decision label is act_now, while EPSS is 0.40% (34th percentile) and no CISA KEV entry or public exploit was identified in the provided data.
Authentication bypass in the Qode Membership plugin for WordPress, in all versions up to and including 2.0.6.2, lets unauthenticated attackers log in as any existing account, including Administrator accounts, by posting a known or enumerated WordPress login username to the qode_membership_check_facebook_user AJAX action. A typographic error in the Facebook OAuth guard (testing $check_social_useqoder instead of $check_social_user) makes empty() always evaluate true, so the Graph API token-verification branch is dead code and wp_set_auth_cookie() is reached with no credential or token validation. Exploitation requires a valid qode_validate_facebook_login nonce, which is rendered on any public front-end page containing the [qode_user_login] or [qode_user_register] shortcode and is therefore obtainable without authentication; no public exploit code was identified at time of analysis, EPSS is 0.37% (30th percentile), yet the vuln.today decision label is act_now given automatable exploitation and total technical impact.
Memory corruption in Google Chrome's FileSystem component before 156.0.8078.73 can let a remote, unauthenticated attacker potentially execute arbitrary code outside the browser sandbox when a victim opens or is navigated to a crafted HTML page. Exploitation requires that user interaction and an unpatched desktop build; the vendor has released 156.0.8078.73 as the fix, and the issue is rated Critical (CVSS 9.6) and prioritized act_now. EPSS is 0.24% (15th percentile); no public exploit code or KEV confirmation is present in the available data.
Memory corruption in the Turbolev component of Google Chrome before 156.0.8078.73 lets a remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. The flaw is scored 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H): no authentication or privileges are required, user interaction is the only prerequisite, and the scope change reflects code execution escaping the Chrome sandbox. No public exploit code has been identified at time of analysis and EPSS is low at 0.24% (15th percentile), but the sandbox-escape impact and severity place this in the act-now remediation queue.
Memory corruption in the Skia graphics component of Google Chrome before 156.0.8078.73 can let a remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page, making this a sandbox-escape-class remote code execution issue (CVSS 9.6, scope changed, C/I/A all High). No authentication is required, but exploitation is gated on user interaction - the victim must visit or be served the malicious page - and only unpatched builds are exposed, since 156.0.8078.73 and later are fixed by the vendor. Exploitation status is currently quiet: there is no CISA KEV listing and no public exploit identified at time of analysis, while EPSS sits at 0.22% (13th percentile), yet the vuln.today decision label is act_now, driven by the severity and sandbox-escape potential rather than observed activity.
Improper input validation in the Core component of Google Chrome on Android allows a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. All Android Chrome builds prior to 156.0.8078.73 are affected; the scope-change metric (S:C) plus the description's 'outside the sandbox' phrasing mark this as a sandbox-escape-class defect, which carries the highest consequences of any browser bug class. Exploitation requires the user to open the crafted page (UI:R) and no credentials or non-default settings are needed (PR:N); no public exploit code has been identified at time of analysis, and EPSS is low at 0.22% (13th percentile), but the vuln.today priority decision is act_now. Vendor-released patch: 156.0.8078.73.
Arbitrary code execution outside the browser sandbox is the potential impact of memory corruption in Google Chrome's Paint component when a victim opens a crafted HTML page, affecting versions prior to 156.0.8078.73. The signal set is mixed: CVSS is 9.6 and the priority label is act_now, but EPSS is only 0.22% and no public exploit was identified at time of analysis. Google has released a fixed build.
Sandbox escape in Google Chrome on Windows lets a remote, unauthenticated attacker execute arbitrary code outside the browser's sandbox when a victim is induced to open a crafted HTML page; the flaw is rated 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) because the successful attack crosses a security boundary and yields high confidentiality, integrity and availability impact beyond the renderer. It is an improper input validation defect (CWE-20) in the Views component, affecting Chrome builds on Windows prior to 156.0.8078.73. EPSS is low at 0.22% (13th percentile) and no public exploit has been identified at time of analysis, but the internal priority signal is act_now, and a vendor patch is already available, so the update should be applied on an expedited basis rather than waiting for exploitation evidence.
Google Chrome on Android prior to 156.0.8078.73 is affected by a sandbox escape in the browser's UI layer, tracked as CVE-2026-118309, where insufficient validation of crafted input lets a remote attacker potentially execute arbitrary code outside the browser sandbox. The CVSS 3.1 vector scores 9.6 (AV:N/AC:L/PR:N/UI:R/S:C with C/I/A:H), but exploitation is gated on the victim loading a crafted HTML page; no authentication or special configuration is required. No public exploit code or confirmed active exploitation was identified at time of analysis, EPSS sits at 0.22% (13th percentile), and a vendor-released patch is available in Chrome 156.0.8078.73 - Google rates the underlying flaw High severity.
Use-after-free in Google Chrome's SVG handling lets a remote attacker who gets a victim to open a crafted HTML page run arbitrary code outside the browser sandbox, affecting Chrome builds prior to 156.0.8078.73. Exploitation needs no authentication or privileges (CVSS PR:N) and no special configuration, since it involves default SVG rendering; the only gate is the required user interaction of loading the page (UI:R), while the changed scope plus high confidentiality, integrity and availability impact give CVSS 9.6 / Chromium severity High. Google has published a fixed build in the stable channel and the priority assessment is act_now; EPSS is modest at 0.22% (13th percentile), the CVE is not in CISA KEV, and no public exploit has been identified at time of analysis.
Improper input validation in Google Chrome's command handling component can let a remote attacker potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page, affecting desktop Chrome builds prior to 156.0.8078.73. Exploitation is not confirmed as active (no CISA KEV listing) and no public exploit code has been identified at time of analysis, while EPSS is low at 0.21% (11th percentile) and Chromium rates the flaw High; per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) no authentication is required but the victim must interact with attacker-controlled content, and the resulting impact crosses a security boundary (S:C). Despite the modest EPSS figure, the vendor patch is available and the exposure combines a sandbox-escape-class impact with trivial remote delivery, so this warrants prompt remediation.
Out-of-bounds write in Google Chrome builds prior to 156.0.8078.73 can allow code execution outside the browser sandbox when a victim opens a crafted HTML page. Exploitation is remote and does not require authentication, but it does require user interaction; successful attacks can affect confidentiality, integrity, and availability with a scope change beyond the browser process. No public exploit was identified at time of analysis, and EPSS is low at 0.21% (11th percentile), yet the supplied priority decision is act_now and a vendor patch is available.
Code execution that escapes the browser sandbox is possible in Google Chrome releases prior to 156.0.8078.73, where improper input validation in the Compositing component lets a remote attacker deliver a crafted HTML page that, once rendered, can run arbitrary code outside the sandbox at the severity scored by the vendor (Chromium security severity: High). Exploitation is not covert: the CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C with high confidentiality, integrity and availability impact, so no credentials are needed but the victim must load attacker-controlled content, typically through phishing, malvertising or a compromised site. Both KEV status and public exploit code are absent for this CVE (EPSS 0.21%, 11th percentile), yet the vuln.today decision label is act_now and the scope-change plus sandbox-escape outcome makes prompt patching the appropriate response; a vendor patch exists in 156.0.8078.73.
Sandbox-escaping remote code execution in Google Chrome's V8 JavaScript engine allows an attacker who gets a victim to load a crafted HTML page to run arbitrary code outside the browser sandbox, at host privilege level rather than merely in-page. All Chrome builds prior to 156.0.8078.73 on the stable channel are affected, and no authentication is required, though exploitation depends on the victim navigating to or rendering the attacker-controlled page (UI:R), so delivery hinges on phishing, malvertising, or a compromised or attacker-hosted site rather than autonomous network propagation. Google rates the Chromium severity High and the CVSS v3.1 vector scores 9.6 with a scope change; at the time of analysis EPSS is low at 0.21% (11th percentile) and there is no CISA KEV listing, and no public exploit identified at time of analysis, although the vuln.today decision label is act_now given the sandbox-escape impact and the availability of a vendor fix.
Arbitrary code execution in Adobe Connect Desktop App and Android Mobile App lets unauthenticated remote attackers run code in the context of the current user, provided they persuade a victim to visit a maliciously crafted URL or interact with a compromised web page. Affected builds are Windows ≤2026.8.51, Mac Apple Silicon ≤2026.08.45, Mac Intel ≤2026.01.39, and Android ≤4.4. The CVSS 3.1 score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), and the vuln.today decision label is act_now; the supplied intelligence does not include CISA KEV status, and no public exploit identified at time of analysis.
Cross-site request forgery in the Tribulant Newsletters WordPress plugin (newsletters-lite) through version 4.18.2 allows an attacker with no account of their own to induce a logged-in privileged WordPress user to carry out unintended administrative actions on the plugin. The attacker must get that victim to load attacker-controlled content while an authenticated session is active, and the affected request lacks adequate anti-CSRF nonce validation; the exact endpoint and forced action are not described in the available sources. The CNA-scored CVSS of 9.6 reflects a scope change and high confidentiality, integrity and availability impact, while the independent assessment treats it as scope-unchanged with limited confidentiality and integrity impact, so the practical risk should be read as contingent on a privileged user being successfully social-engineered rather than as an unauthenticated takeover. No public exploit code is identified at time of analysis and the CVE is not listed in CISA KEV, although the vulnerability carries an act_now priority label.
Remote code execution and denial-of-service against WatchGuard Fireware OS 12.12 (before 12.12.4) and 2026.2 (before 2026.4) hinges on a stack-based buffer overflow in the WireGuard configuration parser, which is reachable when a tampered FireCloud Gateway configuration payload arrives from WatchGuard Cloud. The decisive constraint is the prerequisite network position: the attacker must already sit in a man-in-the-middle position with TLS-decrypted visibility of the Firebox-to-WatchGuard Cloud session (reflected as AT:P in the CVSS 4.0 vector and AC:H in the assessed CVSS 3.1 vector), so casual remote attackers are excluded even though no credentials or user interaction are required. No public exploit code has been identified at time of analysis, but the vuln.today decision label is act_now, so patching should be treated as urgent.
SQL injection in oretnom23 php-travel-agency-system (commit 4e28b8f84d72420373dd15c3ae32900beb7e0635) lets remote attackers manipulate the 'Search' argument handled by traceapplication.php to inject arbitrary SQL. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 5.5 (medium) with limited confidentiality, integrity and availability impact, and requires no authentication, user interaction or non-default configuration per that vector. A public PoC reference exists in the form of a GitHub issue report; it is not verified as working exploit code, and the project has not responded or released a fix.
Missing authorization in the admin interface of code-projects Simple Content Management System 1.0 lets remote attackers reach the /web/admin/welcome.php endpoint and manipulate the 'addnews' argument without passing any access-control check. Per the supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) the request needs no authentication and no user interaction, although impact is limited to low confidentiality, integrity and availability effects (base score 5.5). A public PoC reference exists on GitHub; it is not verified as working exploit code, there is no CISA KEV listing, and EPSS is only 0.39% (33rd percentile), consistent with a this_month priority driven mainly by the niche, hobby-grade footprint of the product.
Unrestricted file upload in oretnom23's PHP Travel Agency System lets an attacker who can reach the administrative employee-creation endpoint (admin/employee_insert.php) submit an arbitrary file through the 'employee photo' field, with no validation of type or content described. The project's CPE is a wildcard with no version bounds, and EUVD maps the issue to three specific commits (2592d60, 4e28b8f, b58513f), so all builds of the open-source codebase should be assumed affected. Remote exploitation is possible, but the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, 5.5 vendor score) treats the attacker as holding administrative privileges because the vulnerable script is an admin function; full server compromise is only possible if the uploaded file lands in a web-accessible, script-executable directory, which the sources do not confirm. A public PoC reference exists in the project's GitHub issue tracker; it is not verified as working exploit code, and there is no KEV listing, so the practical priority is moderate (vuln.today decision: this_month).