Unauthenticated remote code execution in MLflow 3.12.0rc0 through 3.16.x lets any network caller reach the tracking server place a Python module under an allow-listed third-party scorer package and have the server import and instantiate it via the scorer invoke endpoint, executing arbitrary code in the MLflow server process. The flaw is a prefix-matching mistake in the third-party scorer allow-list combined with MLflow's own experiment, run and artifact-upload endpoints, which can be used to publish a module inside a writable scorer package directory; the shipped v3.14.0 container image, running as uid 0 with a writable site-packages tree, is fully exploitable without credentials, while basic-auth deployments require a principal able to create an experiment and run and upload artifacts (the invoke endpoint is gated only by validate_gateway_proxy, with no experiment- or scorer-level permission check). A public proof-of-concept script and a working reproduction accompany the GitHub advisory, and the vendor fixed the issue in 3.17.0.
Remote memory corruption and denial of service in EPICS Base 7.0.10 and prior can be triggered by a remote, unauthenticated integer overflow in network request processing, which causes an undersized allocation before attacker-supplied data is handled; remote code execution is described by the vendor as potential rather than confirmed. Exploitation requires network reachability to a listening EPICS Base service on the affected request path, and EPICS is often deployed on segmented control or experiment networks, which limits exposure but does not protect reachable services. No public exploit was identified at time of analysis, and the vuln.today decision label is act_now.
OS command injection in Hitachi HiRDB Server (Version 10 builds from 10-00 before 10-12-01, and Version 9 / Version 9 Additional Function / Version 9(32) / Version 9(32) Additional Function builds from 09-00 through the various 09-66-xx releases) could let an attacker run arbitrary operating-system commands under the database server's privileges; Hitachi's own CVSS 3.1 vector scores this 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), i.e. remote and unauthenticated with no user interaction, although the specific injectable interface or trigger is not described in the available sources. Signals are mixed: severity and vendor priority are high (vuln.today decision label act_now, EPSS 1.77% at the 78th percentile, indicating above-average but not top-tier predicted exploitation likelihood), yet no public exploit code has been identified at time of analysis and the issue is not in CISA KEV. Affected organizations are those running the listed Hitachi HiRDB enterprise RDBMS builds where the vulnerable interface is network-reachable; Hitachi has released fixes in its advisory hitachi-sec-2026-146.
SQL injection in Adobe Campaign Classic, affecting all builds up to and including 7.4.4 build 9402, lets network-reachable attackers execute arbitrary SQL and - per Adobe - achieve arbitrary code execution in the context of the current user, with a CVSS 3.1 score of 10.0 under a changed-scope vector. No public exploit code or confirmed active exploitation was identified at time of analysis, but the vendor vector (AV:N/AC:L/PR:N/UI:N) requires no user interaction and the issue carries an act_now priority. One open question for defenders: although the vector is PR:N, Adobe's reference to the 'victim's account or session' leaves unconfirmed whether an authenticated session is a practical prerequisite, which materially changes exposure for internet-facing versus internal deployments.
The missing-authentication flaw in NVIDIA NeMo Agent Toolkit 1.0 through 1.8.0 leaves a critical toolkit function without a credential check, giving unauthenticated network attackers a path whose rated consequences include code execution, privilege escalation, data tampering, denial of service, and information disclosure. CVSS is 10.0 with AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, and the vuln.today priority label is act_now. No public exploit identified at time of analysis, and no CISA KEV entry appears in the supplied data; network reachability of the toolkit interface is the main practical exposure constraint, and upgrading past 1.8.0 is the vendor-directed remediation.
Authentication bypass in Hitachi HiRDB Server (CWE-290, spoofing) lets a remote attacker who can reach the database service impersonate a trusted party and slip past authentication, with maximum impact on confidentiality, integrity and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). All five listed build lines are affected: Server Version 10 (10-00 before 10-12-01), Version 9 and Version 9(32) plus their 'with Additional Function' variants across the 09-00/09-02 to 09-66 branches. Exploitation is unauthenticated and needs no user interaction, so real-world risk is governed mainly by whether the HiRDB listener is reachable from untrusted networks; EPSS is low at 0.64% (51st percentile) and no public exploit has been identified at time of analysis, but the vendor has published a fix and the case is triaged act_now, so exposure should be checked rather than assumed benign.
Authentication bypass in Hitachi JP1/Automatic Job Management System 3 - Manager (versions 10-00 up to but not including 13-50-31) lets remote attackers reach the management service without credentials and, per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N), potentially take full control of confidentiality, integrity and availability. The flaw is rated 9.8 and flagged act_now by vuln.today, while EPSS is modest at 0.64% (51st percentile) and it is not in CISA KEV; no public exploit code has been confirmed. Exposure is greatest where the JP1/AJS3 Manager service is reachable from untrusted networks, since it is normally an internal management server.
Unauthenticated network attackers can invoke a critical HiRDB Server function without an authentication check, exposing affected Hitachi HiRDB Version 10 and Version 9-family deployments to high confidentiality, integrity, and availability impact (CVSS 9.8). The flaw is CWE-306 and is reachable over the network with no privileges or user interaction; Hitachi reports a vendor patch and the vuln.today decision is act_now, while EPSS is 0.61% (49th percentile). No CISA KEV status is provided, and no public exploit identified at time of analysis; Version 10 is fixed in 10-12-01, while the supplied data does not name fixed builds for the Version 9, Version 9(32), or 'with Additional Function' branches.
Stack-based buffer overflow in Hitachi HiRDB Server can corrupt memory and, per the supplied CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8), is scored as remotely reachable by an unauthenticated attacker with no user interaction, yielding high confidentiality, integrity and availability impact. Affected builds are HiRDB Server Version 10 (10-00 before 10-12-01), Version 9 (09-00 through 09-66-22), Version 9 with Additional Function (09-00 through 09-66/V), Version 9(32) (09-02 through 09-66-22) and Version 9(32) with Additional Function (09-00 through 09-66-/V); EPSS is low at 0.52% (44th percentile) and no public exploit has been identified at time of analysis, although the vuln.today decision label is act_now and Hitachi has published an advisory with a vendor patch available.
Heap-based buffer overflow in Hitachi HiRDB Server affects Version 10 builds from 10-00 before 10-12-01 and multiple Version 9 branches (09-00 through 09-66-22, and the Additional Function and 9(32) variants through 09-66/V), allowing a remote, unauthenticated attacker who can reach the database service to corrupt heap memory with high impact on confidentiality, integrity and availability (CVSS 9.8). No public exploit code was identified at time of analysis and EPSS is low at 0.52% (44th percentile), so the exploitability signal is weak even though severity is critical. The priority label is act_now, driven by the maximum-severity network-reachable overflow rather than by observed exploitation, and Hitachi has released updated builds.
A heap-based buffer overflow (CWE-122) in Hitachi JP1/Automatic Job Management System 3 - Manager and 3 - Agent, covering versions from 11-00 up to but not including 13-50-31, is rated 9.8 with a network vector (AV:N/AC:L/PR:N/UI:N) - meaning successful exploitation could give remote, unauthenticated attackers full compromise of confidentiality, integrity and availability of the job-management service. Hitachi has released fixed builds at 13-50-31, but the available sources do not describe the specific feature, protocol or input that triggers the overflow, so no particular enabling configuration can be named. No public exploit code is confirmed, EPSS is low (0.52%, 44th percentile), and there is no KEV listing, yet the vuln.today decision label is act_now given the severity and the fact that this is an unauthenticated network-reachable memory-corruption flaw in infrastructure software.
Stack-based buffer overflow (CWE-121) in Hitachi JP1/Automatic Job Management System 3 - Manager, - Agent, and - Agent Minimal Edition lets remote attackers crash or potentially execute code in the context of the JP1/AJS3 service, with a vendor-assigned CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N). Affected builds are Manager and Agent from 10-00/11-00 up to, but not including, 13-50-31, plus Agent Minimal Edition from 11-50 before 13-50-31; Hitachi has released 13-50-31 as the fix for all three branches. Severity signals and exploitation signals diverge: EPSS is only 0.52% (44th percentile) and no public exploit or KEV listing was identified at time of analysis, yet the vulnerability is remotely reachable with no authentication or user interaction, so vuln.today priority is act_now - the practical exposure limiter being that JP1/AJS3 components normally sit on segmented internal operations networks rather than the internet.
Heap-based buffer overflow in Hitachi JP1/Base versions 11-00 through before 12-50-54 can be triggered by remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and, per the vendor's severity rating of 9.8, may lead to full loss of confidentiality, integrity and availability of the affected service. Hitachi has released a fix in 12-50-54 and later, so exposure is limited to installations that have not yet been updated and that are reachable over the network. No public exploit code has been identified at time of analysis, and the EPSS score is modest at 0.52% (44th percentile), although the vendor's own advisory and the vuln.today decision signal both point to remediation as an immediate priority.
OS command injection in Adobe Campaign Classic (through 7.4.4 build 9402) lets a low-privileged, authenticated network attacker execute arbitrary code in the context of the current user without user interaction. The flaw is rated CVSS 9.9 (CWE-78) with scope changed, and vuln.today assigns it an act_now priority. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Arbitrary code execution in Adobe Campaign Classic (versions 0 through 7.4.4 build 9402) stems from incorrect authorization that lets a low-privileged, authenticated attacker run code in the context of the current user, with no user interaction required. The CVSS 9.9 score reflects a scope change (S:C), meaning the impact crosses a security boundary beyond the vulnerable component, and the only real prerequisite is a valid low-privilege account on a network-reachable ACC instance. No public exploit has been identified at time of analysis, but the issue carries an act_now priority, so exposure should be treated as urgent wherever ACC is reachable by untrusted networks or widely provisioned with low-privilege users.
SQL injection in Adobe Campaign Classic through 7.4.4 build 9402 lets an authenticated low-privileged attacker execute arbitrary code in the context of the current user; the CVSS 3.1 score is 9.9 with scope change and no user interaction required. The flaw is CWE-89 and is reachable over the network by an account with low privileges. No public exploit identified at time of analysis; the vuln.today priority is act_now.
Arbitrary code execution in Adobe Campaign Classic (ACC) up to 7.4.4 build 9402 allows an authenticated low-privileged attacker to run code in the context of the current user over the network without user interaction, with scope change. The act_now priority label and CVSS 9.9 reflect the high impact, but the CVSS vector requires a valid low-privilege account (PR:L) and the exact code-injection sink is not described in available sources. No public exploit code is identified at time of analysis, and no KEV designation or EPSS score is included in the supplied data.
Unauthenticated remote attackers who can reach the Supermicro X12SPI BMC's IPMI interface may be able to bypass integrity and encryption enforcement and execute arbitrary commands against an active IPMI session. The flaw is rated CVSS 9.8 (CWE-306), but exposure is limited by the need for network reachability to the BMC management interface and an existing active session. The vuln.today decision label is act_now, while EPSS is 0.40% (34th percentile) and no CISA KEV entry or public exploit was identified in the provided data.
Authentication bypass in the Qode Membership plugin for WordPress, in all versions up to and including 2.0.6.2, lets unauthenticated attackers log in as any existing account, including Administrator accounts, by posting a known or enumerated WordPress login username to the qode_membership_check_facebook_user AJAX action. A typographic error in the Facebook OAuth guard (testing $check_social_useqoder instead of $check_social_user) makes empty() always evaluate true, so the Graph API token-verification branch is dead code and wp_set_auth_cookie() is reached with no credential or token validation. Exploitation requires a valid qode_validate_facebook_login nonce, which is rendered on any public front-end page containing the [qode_user_login] or [qode_user_register] shortcode and is therefore obtainable without authentication; no public exploit code was identified at time of analysis, EPSS is 0.37% (30th percentile), yet the vuln.today decision label is act_now given automatable exploitation and total technical impact.
Arbitrary code execution in Adobe Connect Desktop App and Android Mobile App lets unauthenticated remote attackers run code in the context of the current user, provided they persuade a victim to visit a maliciously crafted URL or interact with a compromised web page. Affected builds are Windows ≤2026.8.51, Mac Apple Silicon ≤2026.08.45, Mac Intel ≤2026.01.39, and Android ≤4.4. The CVSS 3.1 score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), and the vuln.today decision label is act_now; the supplied intelligence does not include CISA KEV status, and no public exploit identified at time of analysis.
Memory corruption in Google Chrome's FileSystem component before 156.0.8078.73 can let a remote, unauthenticated attacker potentially execute arbitrary code outside the browser sandbox when a victim opens or is navigated to a crafted HTML page. Exploitation requires that user interaction and an unpatched desktop build; the vendor has released 156.0.8078.73 as the fix, and the issue is rated Critical (CVSS 9.6) and prioritized act_now. EPSS is 0.24% (15th percentile); no public exploit code or KEV confirmation is present in the available data.
Memory corruption in the Turbolev component of Google Chrome before 156.0.8078.73 lets a remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. The flaw is scored 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H): no authentication or privileges are required, user interaction is the only prerequisite, and the scope change reflects code execution escaping the Chrome sandbox. No public exploit code has been identified at time of analysis and EPSS is low at 0.24% (15th percentile), but the sandbox-escape impact and severity place this in the act-now remediation queue.
Memory corruption in the Skia graphics component of Google Chrome before 156.0.8078.73 can let a remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page, making this a sandbox-escape-class remote code execution issue (CVSS 9.6, scope changed, C/I/A all High). No authentication is required, but exploitation is gated on user interaction - the victim must visit or be served the malicious page - and only unpatched builds are exposed, since 156.0.8078.73 and later are fixed by the vendor. Exploitation status is currently quiet: there is no CISA KEV listing and no public exploit identified at time of analysis, while EPSS sits at 0.22% (13th percentile), yet the vuln.today decision label is act_now, driven by the severity and sandbox-escape potential rather than observed activity.
Improper input validation in the Core component of Google Chrome on Android allows a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. All Android Chrome builds prior to 156.0.8078.73 are affected; the scope-change metric (S:C) plus the description's 'outside the sandbox' phrasing mark this as a sandbox-escape-class defect, which carries the highest consequences of any browser bug class. Exploitation requires the user to open the crafted page (UI:R) and no credentials or non-default settings are needed (PR:N); no public exploit code has been identified at time of analysis, and EPSS is low at 0.22% (13th percentile), but the vuln.today priority decision is act_now. Vendor-released patch: 156.0.8078.73.
Arbitrary code execution outside the browser sandbox is the potential impact of memory corruption in Google Chrome's Paint component when a victim opens a crafted HTML page, affecting versions prior to 156.0.8078.73. The signal set is mixed: CVSS is 9.6 and the priority label is act_now, but EPSS is only 0.22% and no public exploit was identified at time of analysis. Google has released a fixed build.
Sandbox escape in Google Chrome on Windows lets a remote, unauthenticated attacker execute arbitrary code outside the browser's sandbox when a victim is induced to open a crafted HTML page; the flaw is rated 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) because the successful attack crosses a security boundary and yields high confidentiality, integrity and availability impact beyond the renderer. It is an improper input validation defect (CWE-20) in the Views component, affecting Chrome builds on Windows prior to 156.0.8078.73. EPSS is low at 0.22% (13th percentile) and no public exploit has been identified at time of analysis, but the internal priority signal is act_now, and a vendor patch is already available, so the update should be applied on an expedited basis rather than waiting for exploitation evidence.
Google Chrome on Android prior to 156.0.8078.73 is affected by a sandbox escape in the browser's UI layer, tracked as CVE-2026-118309, where insufficient validation of crafted input lets a remote attacker potentially execute arbitrary code outside the browser sandbox. The CVSS 3.1 vector scores 9.6 (AV:N/AC:L/PR:N/UI:R/S:C with C/I/A:H), but exploitation is gated on the victim loading a crafted HTML page; no authentication or special configuration is required. No public exploit code or confirmed active exploitation was identified at time of analysis, EPSS sits at 0.22% (13th percentile), and a vendor-released patch is available in Chrome 156.0.8078.73 - Google rates the underlying flaw High severity.
Use-after-free in Google Chrome's SVG handling lets a remote attacker who gets a victim to open a crafted HTML page run arbitrary code outside the browser sandbox, affecting Chrome builds prior to 156.0.8078.73. Exploitation needs no authentication or privileges (CVSS PR:N) and no special configuration, since it involves default SVG rendering; the only gate is the required user interaction of loading the page (UI:R), while the changed scope plus high confidentiality, integrity and availability impact give CVSS 9.6 / Chromium severity High. Google has published a fixed build in the stable channel and the priority assessment is act_now; EPSS is modest at 0.22% (13th percentile), the CVE is not in CISA KEV, and no public exploit has been identified at time of analysis.
Improper input validation in Google Chrome's command handling component can let a remote attacker potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page, affecting desktop Chrome builds prior to 156.0.8078.73. Exploitation is not confirmed as active (no CISA KEV listing) and no public exploit code has been identified at time of analysis, while EPSS is low at 0.21% (11th percentile) and Chromium rates the flaw High; per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) no authentication is required but the victim must interact with attacker-controlled content, and the resulting impact crosses a security boundary (S:C). Despite the modest EPSS figure, the vendor patch is available and the exposure combines a sandbox-escape-class impact with trivial remote delivery, so this warrants prompt remediation.
Out-of-bounds write in Google Chrome builds prior to 156.0.8078.73 can allow code execution outside the browser sandbox when a victim opens a crafted HTML page. Exploitation is remote and does not require authentication, but it does require user interaction; successful attacks can affect confidentiality, integrity, and availability with a scope change beyond the browser process. No public exploit was identified at time of analysis, and EPSS is low at 0.21% (11th percentile), yet the supplied priority decision is act_now and a vendor patch is available.
Code execution that escapes the browser sandbox is possible in Google Chrome releases prior to 156.0.8078.73, where improper input validation in the Compositing component lets a remote attacker deliver a crafted HTML page that, once rendered, can run arbitrary code outside the sandbox at the severity scored by the vendor (Chromium security severity: High). Exploitation is not covert: the CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C with high confidentiality, integrity and availability impact, so no credentials are needed but the victim must load attacker-controlled content, typically through phishing, malvertising or a compromised site. Both KEV status and public exploit code are absent for this CVE (EPSS 0.21%, 11th percentile), yet the vuln.today decision label is act_now and the scope-change plus sandbox-escape outcome makes prompt patching the appropriate response; a vendor patch exists in 156.0.8078.73.
Sandbox-escaping remote code execution in Google Chrome's V8 JavaScript engine allows an attacker who gets a victim to load a crafted HTML page to run arbitrary code outside the browser sandbox, at host privilege level rather than merely in-page. All Chrome builds prior to 156.0.8078.73 on the stable channel are affected, and no authentication is required, though exploitation depends on the victim navigating to or rendering the attacker-controlled page (UI:R), so delivery hinges on phishing, malvertising, or a compromised or attacker-hosted site rather than autonomous network propagation. Google rates the Chromium severity High and the CVSS v3.1 vector scores 9.6 with a scope change; at the time of analysis EPSS is low at 0.21% (11th percentile) and there is no CISA KEV listing, and no public exploit identified at time of analysis, although the vuln.today decision label is act_now given the sandbox-escape impact and the availability of a vendor fix.
Cross-site request forgery in the Tribulant Newsletters WordPress plugin (newsletters-lite) through version 4.18.2 allows an attacker with no account of their own to induce a logged-in privileged WordPress user to carry out unintended administrative actions on the plugin. The attacker must get that victim to load attacker-controlled content while an authenticated session is active, and the affected request lacks adequate anti-CSRF nonce validation; the exact endpoint and forced action are not described in the available sources. The CNA-scored CVSS of 9.6 reflects a scope change and high confidentiality, integrity and availability impact, while the independent assessment treats it as scope-unchanged with limited confidentiality and integrity impact, so the practical risk should be read as contingent on a privileged user being successfully social-engineered rather than as an unauthenticated takeover. No public exploit code is identified at time of analysis and the CVE is not listed in CISA KEV, although the vulnerability carries an act_now priority label.
Remote code execution and denial-of-service against WatchGuard Fireware OS 12.12 (before 12.12.4) and 2026.2 (before 2026.4) hinges on a stack-based buffer overflow in the WireGuard configuration parser, which is reachable when a tampered FireCloud Gateway configuration payload arrives from WatchGuard Cloud. The decisive constraint is the prerequisite network position: the attacker must already sit in a man-in-the-middle position with TLS-decrypted visibility of the Firebox-to-WatchGuard Cloud session (reflected as AT:P in the CVSS 4.0 vector and AC:H in the assessed CVSS 3.1 vector), so casual remote attackers are excluded even though no credentials or user interaction are required. No public exploit code has been identified at time of analysis, but the vuln.today decision label is act_now, so patching should be treated as urgent.
A remote out-of-bounds write in Hitachi's JP1 operations-management suite lets an unauthenticated network attacker corrupt memory in affected JP1 service processes, with the vendor-assigned CVSS 3.1 score of 9.4 reflecting high confidentiality and integrity impact and a partial availability impact (AV:N/AC:L/PR:N/UI:N). Affected are JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent and Agent Minimal Edition from 13-00 before 13-50-31, and JP1/Base from 11-00 before 12-50-54. Hitachi has released fixed versions, no public exploit code or KEV entry was identified at time of analysis, and EPSS is modest at 0.46% (39th percentile), though the vuln.today decision signal is act_now given the unauthenticated network vector and memory-corruption class.
Stack-based buffer overflow in Hitachi HiRDB Server allows remote, unauthenticated attackers to corrupt memory and potentially execute code, with high confidentiality and integrity impact. The affected ranges are Version 10 from 10-00 before 10-12-01 and Version 9 branches - including 9(32) and Additional Function variants - from 09-00/09-02 through 09-66-22 or 09-66/V. Hitachi has released fixed versions; EPSS is 0.45% (39th percentile), no public exploit was identified at time of analysis, and vuln.today priority guidance is act_now despite the conflicting urgency signals noted in the independent assessment.
Stack-based buffer overflow in Hitachi JP1/AJS3 Manager (versions 10-00 before 13-50-31) could let remote, unauthenticated attackers trigger memory corruption with high confidentiality and integrity impact and limited availability impact (CVSS 9.4). The vendor CVSS vector is AV:N/AC:L/PR:N/UI:N, so no credentials or user interaction are required, but the sources do not identify the specific network interface or input that reaches the vulnerable code. No public exploit identified at time of analysis and EPSS is low at 0.45% (39th percentile), while a vendor fix is available in 13-50-31.
Heap-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 - Manager (versions 10-00 through builds prior to 13-50-31) is reachable over the network with no authentication or user interaction required under the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), giving a worst-case impact of high confidentiality and integrity loss plus limited availability impact (CVSS 9.4). No public exploit code or CISA KEV entry is associated with the issue, and EPSS is low at 0.45% (39th percentile), yet the vuln.today decision label is act_now, driven by the maximum-severity, pre-authentication, network-reachable profile against an enterprise job-scheduling manager; the notable tension is that low observed exploitation likelihood sits alongside a maximum-severity rating and the absence of a published trigger description. The vendor has released a fix, and deployments on 13-50-31 or later are not affected.
Stack-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 - Manager (versions from 10-00 up to but not including 13-50-31) gives remote, unauthenticated attackers who can reach the manager service a memory-corruption primitive that the CVSS 3.1 vector rates at 9.4 with high confidentiality and integrity impact and limited availability impact. No privileges and no user interaction are required per CVSS:3.1/AV:N/AC:L/PR:N/UI:N, and the concrete service, protocol or malformed input that overflows the stack buffer is not described in the available sources. No public exploit has been identified at time of analysis and the EPSS score is low (0.45%, 39th percentile); the act_now priority label is driven by the unauthenticated network-reachable attack surface rather than by observed exploitation. Vendor-released patch: 13-50-31.
Stack-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 Manager, Agent, and Agent Minimal Edition before 13-50-31 allows remote, unauthenticated attackers to corrupt memory over the network with no user interaction, potentially compromising confidentiality and integrity and causing limited availability impact (CVSS 9.4). Hitachi reports affected Manager and Agent branches from 11-00 before 13-50-31, while EUVD also maps 10-00 branches and Agent Minimal Edition 11-50 to versions below 13-50-31. A vendor patch is available; no public exploit was identified at time of analysis (EPSS 0.45%), and CISA KEV does not list this CVE.
Heap-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 Manager, Agent, and Agent Minimal Edition before 13-50-31 can be reached over the network without authentication or user interaction under the vendor CVSS vector (CVSS 9.4, AV:N/AC:L/PR:N/UI:N), yielding high confidentiality and integrity impact and low availability impact. Hitachi has released fixed version 13-50-31, and the vuln.today priority is act_now. No CISA KEV entry or public exploit code was identified at time of analysis; EPSS is 0.45% (39th percentile), so the priority reflects severity and network exposure rather than observed exploitation.
Heap-based buffer overflow (CWE-122) in Hitachi JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent and Agent Minimal Edition (13-00 before 13-50-31), and JP1/Base (11-00 before 12-50-54), rated CVSS 3.1 9.4 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - remote, low-complexity, no privileges and no user interaction, with high confidentiality and integrity impact and low availability impact. The vulnerability is unauthenticated per the PR:N vector, and the specific service, port, or crafted input that triggers the overflow is not described in the available sources. Hitachi has released fixed versions (13-50-31 for the 13-00 branch products, 12-50-54 for JP1/Base), there is no CISA KEV entry or confirmed exploitation, and no public exploit was identified at time of analysis; EPSS is 0.45% (39th percentile) - the main real-world limiter is whether the JP1 service is network-reachable by an attacker.
Stack-based buffer overflow in Hitachi JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 (Manager, Agent, and Agent Minimal Edition) 13-00 through 13-50-30, and JP1/Base 11-00 through 12-50-53 lets remote unauthenticated attackers corrupt stack memory, carrying high confidentiality and integrity impact alongside a lower availability impact (CVSS 3.1 base 9.4, AV:N/AC:L/PR:N/UI:N). No public exploit code has been identified at time of analysis and EPSS is low at 0.45% (39th percentile), but the vendor-reported severity and the absence of any privilege or user-interaction prerequisite place this at act_now priority for the listed versions. Vendor-released fixes exist: 13-50-31 for all 13-00 JP1 branches and 12-50-54 for JP1/Base.
Unauthenticated handling of FireCluster Sync traffic in WatchGuard Fireware OS lets an attacker who already holds a position on the cluster interconnect - a compromised cluster peer or an on-path attacker on the synchronization network - invoke privileged firewall management actions as root with a single crafted request, with no credentials or user interaction required. The flaw affects the Fireware OS 12.0 branch before 12.12.4, the 2025.1 branch before 2026.4, and the 12.0 branch before 12.5.22; Fireboxes that are not running FireCluster are not exposed through this path, which together with the typically isolated nature of the cluster interconnect is the main gating factor on real-world risk. Vendor patches are available on all three branches, and no public exploit code or CISA KEV entry was identified at time of analysis, though the vendor-reported CVSS of 9.4 and adjacent-network reachability warrant prompt remediation on clustered deployments.
Unauthenticated attackers can forge valid administrator JSON Web Tokens against nest-admin before 1.0.1 because the JWT signing secret (and the refresh-token secret) is committed to the repository as the fixed placeholder value 'admin!@#123'. Any deployment still running with the shipped .env.production or .env.development secret is fully compromised: an attacker signs a token asserting any user ID or the admin role, and JwtStrategy and RbacGuard accept it without further checks, yielding complete confidentiality, integrity and availability impact (CVSS 4.0 base 9.3, assessed CVSS 3.1 9.3, CWE-321). No public exploit code has been identified at time of analysis, although the key material itself is publicly readable in the project's Git history; VulnCheck assigns an 'act_now' priority, and the sole limiting factor is whether an operator replaced the committed secret with an independent strong value. The vendor fixed the issue in 1.0.1 and states that any environment that ever ran with the historical default must rotate both secrets and reissue all sessions after upgrading.
Unauthenticated SQL injection in the Balbooa Gridbox extension for Joomla before 2.20.4.2 allows remote attackers to inject into the ORDER BY clause via the sort-by parameter on store product list pages and extract database contents. The issue requires a published Gridbox store/product listing page to be reachable but no authentication or user interaction, and the independent assessment limits impact to confidentiality (C:H/I:N/A:N). EPSS is modest at 0.39% (32nd percentile), yet the priority decision is act_now; no public exploit identified at time of analysis.
Sunhillo SureLine deployments running versions 8.0.0 through below 9.1.5 accept session cookies that contain nothing but a cleartext username, letting an unauthenticated remote attacker impersonate a logged-in user and chain that access into root command execution through networkDiag.cgi. The main limiting prerequisite is that the targeted account must already hold an active web session at attack time, and default account names such as Admin or sftp_user make the username guesswork trivial. The vendor has released SureLine 9.1.5 as the fix and prioritization guidance marks this as act_now; no CISA KEV listing or verified working exploit code is present in the available data.
Missing authorization in the Balbooa Gridbox extension for Joomla (versions 1.0.0 through 2.20.4.1) allows unauthenticated remote requests to invoke the EditorController::getBlogPosts() task and read blog-post data without the edit-level check applied to other controller tasks. The supplied CVSS 4.0 score is 9.3 with high confidentiality, integrity, and availability impact, but the independent assessment is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so the demonstrated impact should be treated as unauthorized blog-post read or exposure rather than data modification or denial of service. No public exploit was identified at time of analysis; EPSS is 0.32% (24th percentile), the fixed release is 2.20.4.2, and the vuln.today decision label is act_now despite the independent assessment noting conflicting signals.
Electrum wallets before 4.8.3 can be tricked into replacing a just-broadcast Bitcoin transaction with a conflicting invalidly-signed transaction that pays an attacker, because the client does not verify signatures of wallet-owned inputs in unconfirmed mempool transactions. A malicious Electrum server can swallow the user's transaction and display a zero-fee forged copy; if the user then manually RBF fee-bumps and signs it, funds are lost. The vendor advisory reports that some servers are performing this attack and two user reports of losses exist; exploitation requires the user to manually bump the fee and sign the forged transaction, and the vuln.today decision label is act_now.
Reflected cross-site scripting in Adobe Campaign Classic 7.4.4 build 9402 and earlier lets unauthenticated remote attackers inject script into a victim's browser session when an authenticated ACC user clicks a crafted URL, potentially enabling account or session takeover. The issue is rated CVSS 9.3 with scope change (S:C), high confidentiality and integrity impact, and mandatory user interaction (UI:R); because the payload is reflected rather than stored, each target must be lured individually. No public exploit code or exploitation has been identified at time of analysis, but the vendor-reported issue is prioritized as act_now given the high impact on authenticated sessions.