Integer overflow in TeamViewer's remote-control screen processing component affects Full Client, Portable, and Remote Control App versions before 15.83, allowing a malicious or already compromised remote host to crash the viewer and, on some platforms, potentially execute code with the viewer process's privileges. The victim must deliberately establish an outbound remote-control session as the viewer (UI:R), so the attack model is targeted or social-engineering oriented rather than unsolicited remote compromise. No public exploit code has been identified at time of analysis, and vendor patches are available.
Memory corruption in the V8 JavaScript engine of Google Chrome before 156.0.8078.73 allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. User interaction is mandatory and the resulting code execution is sandbox-contained, so compromising the host would require an additional sandbox-escape flaw; the CVSS 3.1 score is 8.8 with C:H/I:H/A:H. No public exploit was identified at time of analysis, and the vendor has released Chrome 156.0.8078.73; the priority is this week, not an emergency.
Loading a crafted HTML page can trigger memory corruption in Google Chrome's WebAudio component before version 156.0.8078.73, potentially allowing code execution inside the renderer sandbox. The attack is remote and requires no authentication, but user interaction is required because the victim must visit the attacker-controlled page; scope is unchanged, so host compromise would require chaining a separate sandbox escape. No public exploit was identified at time of analysis, and Google has released Chrome 156.0.8078.73 as the fix.
Use-after-free in Google Chrome's FileSystem component allows a remote attacker who convinces a victim to open a crafted HTML page to corrupt memory and potentially execute arbitrary code inside the browser's renderer sandbox in versions prior to 156.0.8078.73. Exploitation is network-reachable, low-complexity and requires no authentication, but it is gated by user interaction - the target must actively load and render the attacker-controlled page - and any resulting code execution is confined to the sandbox, so full host compromise would additionally require a separate sandbox escape. Google rates the issue Chromium security severity High and has released 156.0.8078.73 as the fixed build; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so this is a patch-this-week item rather than a confirmed active campaign.
Improper input validation in the ANGLE graphics translation layer of Google Chrome on macOS prior to 156.0.8078.73 allows a remote attacker to potentially execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects a low-complexity, network-reachable flaw that needs no privileges but requires the user to visit an attacker-controlled or compromised page; the impact is confined to the sandbox, so host compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the issue as High severity with a vendor patch available in Chrome 156.0.8078.73.
Privilege escalation in the Supermicro BMC IPMI implementation allows an attacker who already holds a low-privilege BMC account to send crafted RAKP+ authentication messages and gain administrator-level access on affected MBD-X12SPI systems running firmware 01.07.20. The issue is rated CVSS 8.8 because exploitation is network-reachable, requires low privileges, and yields high confidentiality, integrity, and availability impact, although EPSS is low at 0.26% (17th percentile). No public exploit identified at time of analysis; reachability is limited to BMC management interfaces, typically IPMI/RMCP+ on UDP 623.
Improper input validation in the Skia graphics component of Google Chrome allows a remote, unauthenticated attacker to potentially achieve arbitrary code execution inside the browser sandbox by convincing a victim to load a crafted HTML page. All Chrome builds prior to 156.0.8078.73 are affected; the flaw is rated Critical by Chromium and carries a CVSS score of 8.8 with a user-interaction requirement (UI:R) and no privileges required (PR:N). Vendor-released patch: 156.0.8078.73, available from the Chrome stable channel advisory; the vendor describes the vulnerability as potentially allowing arbitrary code execution inside the sandbox, and no public exploit code has been identified in the provided sources, though the reference links to the Chromium issue tracker (restricted bug) and the stable-channel release notes.
Use-after-free in Google Chrome's Layout component allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in versions before 156.0.8078.73. Exploitation requires user interaction but no authentication or special browser configuration; code execution is scoped to the renderer, and full host compromise would require chaining a separate sandbox escape. Vendor patch 156.0.8078.73 is available, no public exploit was identified at time of analysis, and the issue is rated high priority for this week rather than an emergency.
Improper input validation in Chrome's FileAPI component allows a remote, unauthenticated attacker to achieve code execution inside the renderer sandbox by convincing a victim to load a crafted HTML page; the flaw is fixed in Chrome 156.0.8078.73. Because the attacker must lure the user into opening the page (UI:R), delivery depends on a drive-by or social-engineering vector, and the resulting code execution is confined to the sandbox (S:U), so full host compromise would require chaining a separate sandbox escape. Google rates the issue Critical; no public exploit code is identified in the available data, and the fix is available from the vendor with a this-week remediation priority.
Use-after-free in Google Chrome's Paint component allows a remote attacker who persuades a user to load a crafted HTML page to potentially execute arbitrary code inside the browser sandbox on versions prior to 156.0.8078.73. The issue requires user interaction and does not by itself provide a sandbox escape, so full host compromise would require an additional vulnerability. No public exploit has been identified at time of analysis, EPSS is 0.24%, and a vendor patch is available.
A use-after-free (CWE-416) in Chromium's Animation component affects Google Chrome builds prior to 156.0.8078.73; a remote attacker who convinces a victim to load a crafted HTML page can trigger the memory-corruption condition and execute arbitrary code inside the browser sandbox. The CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting high confidentiality and integrity impact but requiring user interaction and remaining confined to the renderer sandbox until a separate sandbox escape is chained. There is no CISA KEV listing and no confirmed public exploit code in the supplied intelligence; a Chromium issue tracker reference exists but is not verified as working exploit code, and Google rates the flaw High with a vendor patch already released.
Improper input validation in the Headless component of Google Chrome before 156.0.8078.73 lets a remote, unauthenticated attacker who convinces a victim to load a crafted HTML page run arbitrary code inside the browser sandbox. The realistic exposure is less ordinary desktop browsing and more automated Headless Chrome deployments - CI pipelines, server-side rendering, scraping and PDF generation - that render attacker-influenced HTML. No public exploit code or active exploitation is confirmed in the available data; the vendor has released Chrome 156.0.8078.73 as the fix, and this is assessed as a genuine but moderate-urgency priority rather than an emergency.
WebRTC input validation in Google Chrome prior to 156.0.8078.73 can allow a remote attacker to potentially execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R, so no authentication is required but user interaction is necessary. No public exploit was identified at time of analysis, and a vendor patch is available in Chrome 156.0.8078.73.
Memory corruption in Google Chrome's Media component can let a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting Chrome releases prior to 156.0.8078.73. Exploitation requires user interaction and, with scope unchanged, is limited to renderer-process compromise rather than full host takeover unless combined with a separate sandbox escape. No public exploit identified at time of analysis; the vendor has released a fixed build, and this is a high-priority patch item rather than a drop-everything emergency.
Memory corruption in Google Chrome's V8 engine prior to 156.0.8078.73 can let a remote attacker who gets a user to load a crafted HTML page run arbitrary code inside the browser sandbox. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) and requires user interaction; code execution is contained within the renderer sandbox, so full host compromise would require chaining a separate sandbox-escape flaw. No public exploit identified at time of analysis, and the vendor has released a fixed Chrome build, consistent with a this_week priority.
Memory corruption in Chrome's HTML handling lets a remote attacker potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Google Chrome desktop builds prior to 156.0.8078.73. The CVSS vector shows unauthenticated network delivery (PR:N, AV:N) but requires the user to navigate to the attacker's page (UI:R), and the description scopes any code execution to the sandbox (S:U), so full host compromise would need a separate sandbox escape. No public exploit code or in-the-wild exploitation has been identified at time of analysis, and Google rates the issue Chromium security severity High with a vendor fix already published in 156.0.8078.73.
Improper input validation in the UI layer of Google Chrome for Android before 156.0.8078.73 allows remote attackers to achieve code execution inside the browser sandbox when a victim loads a crafted HTML page. The attack requires user interaction (UI:R) but no authentication (PR:N), and impact is contained to the sandbox rather than the underlying Android OS, so full device compromise would need a separate sandbox-escape flaw. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low (0.22%, 13th percentile); Google rates the issue High severity and has released a patched build.
Use-after-free in Chrome's Video component lets a remote attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Chrome builds prior to 156.0.8078.73. Google rates the flaw High and our assessment matches CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no authentication is required, but the attacker depends on the user visiting or being redirected to attacker-controlled content, and the resulting code execution is confined to the sandbox (S:U), so host compromise additionally requires a separate sandbox escape. Signals conflict in a way worth stating plainly: the severity is high and the vuln.today priority label is this_week, yet EPSS is only 0.22% (13th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis.
Memory corruption in the Media component of Google Chrome prior to 156.0.8078.73 lets a remote attacker who convinces a user to open a crafted HTML page potentially execute arbitrary code inside the browser sandbox. The flaw carries a CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R) and is rated High by Chromium security severity; exploitation is not confirmed in the wild, no public exploit code has been identified at time of analysis, and EPSS is low at 0.22% (13th percentile), though the vendor classifies it among the higher-severity fixes in this stable-channel release. Because the described impact is code execution inside the sandbox, host compromise would additionally require a separate sandbox-escape vulnerability not covered by this CVE; patched builds are available in 156.0.8078.73 and later.
Google Chrome desktop builds prior to 156.0.8078.73 mishandle input validation during SVG processing, allowing a remote attacker to achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects a high-severity flaw that requires user interaction and yields code execution confined to the sandbox, so full host compromise would additionally require chaining a separate sandbox-escape bug. No public exploit code has been identified at time of analysis, the EPSS score is low at 0.22% (13th percentile), and the issue is not in CISA KEV; the vendor has released a fix and priority is rated as remediation this week.
Heap-based buffer overflow (CWE-122) in Ubiquiti airMAX M, LTU PTMP, LTU PTP and SolarPoint/SolarSwitch firmware lets an attacker who is already on the adjacent network (CVSS AV:A) execute arbitrary code on the device with no authentication and no user interaction (CVSS 3.1 base 8.8, PR:N/UI:N), giving full confidentiality, integrity and availability impact. The adjacency requirement, not any account or feature prerequisite, is the limiting factor: default deployments of unpatched versions are exposed once the attacker shares the wireless link or local L2 segment. Fixed firmware is available from the vendor (airMAX M 6.3.26, LTU PTMP 2.4.2, LTU PTP 1.5.7, SolarPoint/SolarSwitch 2.0.3); there is no CISA KEV listing and no public exploit was identified at time of analysis, and EPSS is low (0.21%, 12th percentile), which places this at a this_week rather than emergency priority.
Use-after-free in Google Chrome's WTF component before 156.0.8078.73 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, with CVSS 3.1 scored 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Impact stays confined to the sandbox unless chained with a separate sandbox escape, and the precise trigger is not described in the supplied sources. Vendor-released patch: 156.0.8078.73; no public exploit was identified at time of analysis, and this is assessed as a genuine high-priority issue for this week rather than an emergency.
Remote code execution inside the Chrome renderer sandbox is possible in Google Chrome desktop builds prior to 156.0.8078.73, where improper input validation in the bundled Skia graphics library can be triggered by a crafted HTML page. The flaw is network-reachable and needs no privileges (PR:N), but it does require the victim to load attacker-controlled content (UI:R), and because CVSS scope is Unchanged it does not by itself escape the sandbox-full host compromise would require chaining a separate sandbox-escape bug. Google has shipped a stable-channel fix in 156.0.8078.73, and no public exploit code was identified at time of analysis.
Use-after-free in Chrome's Paint rendering component allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in any Chrome build prior to 156.0.8078.73. The user-interaction requirement (UI:R, opening the page) is the main limiting factor; no credentials or non-default configuration are needed since Paint is core browser functionality, yet successful exploitation yields code execution only within the renderer sandbox, so full system compromise would additionally require a separate sandbox-escape flaw. Google rates the issue Chromium security severity High and has released a fixed build; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vulnerability is prioritized for remediation this week.
Memory corruption in Google Chrome's Cache component before 156.0.8078.73 allows a remote attacker to execute arbitrary code inside the renderer sandbox by convincing a user to load a crafted HTML page. The flaw carries a CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R) and requires user interaction, which is the primary limiting factor; no public exploit code was identified at time of analysis. Google has released a patched build, and the issue is prioritized for remediation this week.
Memory corruption in the Skia graphics library shipped in Google Chrome before 156.0.8078.73 allows a remote attacker to achieve code execution inside the renderer sandbox when a victim loads a crafted HTML page. Affected users are those running Chrome builds prior to 156.0.8078.73; exploitation requires user interaction (CVSS UI:R, PR:N, AV:N), and the impact is confined to the renderer sandbox rather than host-level compromise. No public exploit is identified at time of analysis, and EPSS/KEV signals were not provided; the vendor classifies the issue as Chromium security severity High.
Use-after-free in the Turbolev component of Google Chrome allows an unauthenticated remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in builds prior to 156.0.8078.73. The CVSS score is 8.8, but exploitation requires user interaction and the impact remains sandbox-contained, so full host compromise would require chaining an additional sandbox-escape flaw. No public exploit code or active exploitation has been identified at time of analysis; Google has released a fixed build, and the available intelligence supports a near-term patching priority rather than an emergency response.
Arbitrary code execution inside the Chrome sandbox can be triggered in Google Chrome builds prior to 156.0.8078.73 by a crafted HTML page that exploits a memory-corruption flaw in the Payments component. The CVSS score of 8.8 reflects high confidentiality and integrity impact, but exploitation requires user interaction (UI:R) and the code execution is scoped to inside the sandbox, so host compromise would require an additional sandbox escape. No public exploit or active exploitation is identified at time of analysis, and Google has released a fixed build.
Google Chrome before 156.0.8078.73 contains a use-after-free in its FileSystem component that lets a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) shows a network-reachable, low-complexity issue that requires user interaction, with code execution confined to Chrome's renderer sandbox unless a separate sandbox-escape flaw is chained. Vendor-released patch: 156.0.8078.73; no public exploit was identified at time of analysis, and no CISA KEV entry was supplied.
Use-after-free in Google Chrome's Compositing component (versions prior to 156.0.8078.73) allows remote attackers to corrupt memory and potentially execute arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. Exploitation requires no authentication or prior privileges (CVSS 8.8, AV:N/AC:L/PR:N) but does require user interaction, and because the scope is unchanged the resulting code execution stays confined to the sandbox, so a separate sandbox escape would be needed to reach the host OS. The trigger mechanism inside the compositing code path is not described in the available sources; no public exploit has been identified at time of analysis, and Google has shipped a fixed build in the stable channel.
Use-after-free in PDFium, the PDF rendering engine bundled with Google Chrome, allows remote, unauthenticated attackers to potentially execute arbitrary code within the renderer sandbox when a victim renders a crafted HTML page in Chrome builds prior to 156.0.8078.73. The issue is rated high priority for this week's patch cycle rather than an emergency, a vendor fix exists in Chrome 156.0.8078.73, and no public exploit was identified at time of analysis. Per the vendor description, code execution is confined to the renderer sandbox; full host compromise would require chaining a separate sandbox-escape vulnerability that is not part of this CVE.
Improper input validation in Chrome's ReadingList component (fixed in 156.0.8078.73) lets a remote attacker who convinces a victim to open a crafted HTML page run arbitrary code inside the renderer sandbox. No authentication or prior privileges are needed, but user interaction is mandatory and the impact is confined to the sandbox - escaping to the host would require chaining a separate sandbox-escape flaw. No public exploit code or CISA KEV entry is reported, and the vendor considers the issue High severity in Chromium; the practical risk is real but not a drop-everything emergency given the sandbox boundary and the fact that a fixed build is already available.
Use-after-free in Google Chrome's Modularization component before 156.0.8078.73 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms no authentication is required, but exploitation hinges on the target loading the attacker's HTML, and the impact is bounded by Chrome's sandbox - this flaw alone does not give control of the host operating system, so a separate sandbox escape would be needed for full device compromise. Chromium rates it High (CVSS 8.8), and no public exploit code or confirmed active exploitation is identified in the available data; the priority call is 'this_week', positioning it as a genuine priority within the normal Chrome patching cycle rather than a drop-everything emergency.
A use-after-free in Chrome's Animation component before 156.0.8078.73 lets a remote attacker who convinces a user to load a crafted HTML page potentially execute arbitrary code inside the renderer sandbox. No authentication is required, but user interaction is the limiting factor, and code execution remains confined to the sandbox - escaping to the host demands a separate sandbox-escape chain. Google rates the Chromium severity Medium while the CVSS vector scores 8.8; the flaw was fixed in the vendor's stable channel update and no public exploit code has been identified at time of analysis.
Improper input validation in the Metrics component of Google Chrome for macOS allows remote code execution inside the browser sandbox when a victim opens a crafted HTML page in any build prior to 156.0.8078.73. The attack is unauthenticated and network-delivered (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but it is gated on user interaction and confined to the renderer sandbox - escaping to the host would require a separate, distinct sandbox-escape flaw that is not described here. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a moderate-urgency, patch-this-week item rather than a drop-everything emergency; a vendor patch (156.0.8078.73) is available.
A use-after-free in Chrome's ImageCapture component lets remote attackers who convince a victim to open a crafted HTML page execute arbitrary code - but, per the advisory, that execution is confined to the renderer sandbox rather than the host. Chrome builds prior to 156.0.8078.73 are affected and the vendor has released a fix; exploitation requires user interaction (CVSS UI:R) with no authentication or special configuration needed. No public exploit or active exploitation is identified in the supplied data, and the assessed priority places remediation in the near-term 'this week' window rather than emergency status, because host compromise would additionally require a separate sandbox-escape flaw.
Use-after-free memory corruption in Google Chrome on Windows allows a remote attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page in any build prior to 156.0.8078.73. Exploitation is not zero-click - it requires the user to navigate to or be served the malicious content (the UI:R factor in the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) - and the resulting code execution is confined to the Chrome sandbox, so host-level compromise would additionally require a separate sandbox-escape chain. Google rates the issue Chromium security severity High and has released a stable-channel fix; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the flaw is tracked with a this_week remediation priority.
Improper input validation in SVG handling in Google Chrome before 156.0.8078.73 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page containing malicious SVG (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Successful exploitation is gated by mandatory user interaction - the victim must open the attacker-supplied page in a vulnerable build - and the resulting code execution is confined to the Chrome sandbox, so full host compromise requires an additional, separate sandbox-escape vulnerability. No public exploit code has been identified at time of analysis and the flaw does not appear on CISA KEV; EPSS is 0.21% (11th percentile), and Google rates the Chromium security severity as High with a fix already shipped in the stable channel.
Stored cross-site scripting in Ubiquiti airMAX M devices running firmware before 6.3.26 allows an attacker positioned on the adjacent network to plant script content that executes when a victim views it, and Ubiquiti states this can escalate privileges on the device. Exploitation requires adjacent-network access (AV:A) and user interaction (UI:R) with a victim, most plausibly an administrator, viewing the poisoned page, and the vendor further limits the issue to 'certain conditions' that the available sources do not specify; authentication is not required to trigger per the PR:N vector. Signals are moderate-to-elevated but not emergency-grade: EPSS is only 0.19% (9th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, and a vendor patch is available in firmware 6.3.26.
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauthorized code on the affected module. Certificate Manager 1.17 before 1.17.417, 1.18 before 1.18.368, and 1.22 before 1.22.119 are affected; the vendor has released fixed builds and vuln.today assigns this_week priority. No public exploit identified at time of analysis.
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code remotely, with high confidentiality, integrity, and availability impact (CVSS 8.8; AV:N/AC:L/PR:L/UI:N). Affected branches are 4.17 before 4.17.327, 4.12 before 4.12.349, and 4.9 before 4.9.476, and the vendor has released fixed builds. No public exploit identified at time of analysis; active exploitation is not confirmed in the provided sources, and the vuln.today priority is this_week, reflecting a credible near-term priority rather than an inflated high-CVSS score.
Authlib 0.15 through 1.9.0 can let a party holding any valid RFC 7592 registration access token read, modify, or delete a different client's registration record, because the library's documented example implementations of ClientConfigurationEndpoint.authenticate_client and check_permission never bind the presented token to the target client. The exposure is conditional: it applies to deployments that expose the ClientConfigurationEndpoint and implemented those two methods by copying the shipped docstring examples, which resolve the target from the request-supplied client_id and check only client.editable. Exploitation is authenticated (CVSS PR:L - a valid registration_access_token is required) and also needs the victim's client_id, but under the common open/anonymous RFC 7591 self-registration model an attacker can self-issue a qualifying token for free, after which redirect_uri rewriting enables authorization code or token interception and deletion causes denial of service. Authlib 1.9.1 fixes the flaw; no public exploit was identified at time of analysis, and the overall signal is a conditional this-week remediation priority rather than a mass-exploitation emergency.
Privilege escalation in Mozilla Firefox's DOM: Navigation component allows remote attackers to gain elevated privileges within the browser when a victim loads attacker-controlled web content, with the flaw resolved in Firefox 159. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, score 8.8) indicates no prior authentication or attacker privileges are needed, but the required victim interaction is the primary limiting factor and is consistent with CISA SSVC scoring of Automatable: no and Exploitation: none. No public exploit code or active exploitation has been identified at time of analysis, and the vendor-reported issue is tracked as Mozilla Bugzilla 2075440 with advisories mfsa2026-118 and mfsa2026-121.
Authenticated SQL injection in Dolibarr ERP/CRM through version 23.0.0 lets any user holding the standard 'Third Party: Create/Edit' permission - not just an administrator - read or rewrite arbitrary database content. The unescaped lt1/localtax1_value (and lt2/localtax2_value) POST parameter is concatenated into an UPDATE statement in an unquoted numeric context, so an attacker can append a second SET clause and copy a target value such as a user's password hash into a field they can then read, potentially escalating to admin and onward to RCE via admin-only modules. The vendor advisory GHSA-v5fq-cf5m-vwv7 ships a complete reproduction including working request payloads; no confirmed active exploitation (CISA KEV) has been reported, and no fixed release is listed yet - the package data records composer/dolibarr/dolibarr as vulnerable at <= 23.0.0 with 'not yet patched'. With a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) and a this_week decision label, this is a genuine, actionable priority rather than an inflated CVSS score.
Remote, unauthenticated attackers can upload files of any type to arbitrary writable paths in PuMuKIT and can also delete files, according to CVE-2026-4337. The impact can extend to code execution when an uploaded file is placed in a web-accessible directory that executes that file type; otherwise the exposure is integrity and availability damage within the web server user's write scope, and the exact triggering endpoint is not described in the available sources. No public exploit code or CISA KEV entry has been identified at time of analysis.
Sensitive configuration data disclosure in WatchGuard Fireware OS stems from XPath injection in the management SSH authentication process, allowing a remote, unauthenticated attacker who can reach that interface to submit a crafted request and extract configuration data. Affected releases are Fireware OS 2025.1 before 2026.4 and 12.0 before 12.5.22 or 12.12.4; the vendor has released fixes, and no public exploit is identified at time of analysis, with no CISA KEV listing. Exposure is the key risk factor: appliances whose management SSH interface is reachable from untrusted networks are most at risk, while restricting that interface to trusted management networks substantially reduces exposure.
Remote code execution in Mistral Vibe before 3.0.3 occurs when the CLI is launched with --worktree against an untrusted repository: a crafted .git/config defines Git filter drivers and .gitattributes binds them to files, so git worktree add runs smudge, clean, or process commands before Vibe's trusted-folder check. The commands execute with the invoking user's privileges, and exploitation requires the user to add the malicious repository in worktree mode. The vendor released 3.0.3; no public exploit was identified at time of analysis and EPSS is 0.43% (37th percentile).
Authentication bypass in the TDDP v2 service of the TP-Link RE305 V3 range extender lets an unauthenticated attacker on the same local network forge protocol packets using a fixed, derivable cryptographic key and reach privileged TDDP operations, including functionality that can result in operating-system command execution with root privileges. Only devices running RE305 V3 firmware before 1.1.8 Build 20260921 Rel. 42853 are affected, and exploitation requires the TDDP service to be running and reachable from the attacker's adjacent network segment (CVSS 4.0 8.7 / assessed CVSS 3.1 8.7, AV:A). A vendor patch is available and no public exploit has been identified at time of analysis; the priority label is this_week because the flaw yields full confidentiality, integrity and availability impact once an attacker has local network presence.
Denial of service in WatchGuard Fireware OS lets remote unauthenticated attackers with network reachability to the management interface crash the management service by sending a crafted login request. Repeated attempts terminate active administrator sessions and block management operations while firewall traffic processing remains unaffected; affected branches are Fireware OS 2025.1 before 2026.4, 12.0 before 12.12.4, and 12.0 before 12.5.22, and the vendor reports a patch is available. The vendor CVSS 4.0 score of 8.7 (High) reflects availability-only impact (VA:H with VC:N/VI:N), and no public exploit was identified at the time of analysis.
Member-only content gated by the MembershipWorks plugin for WordPress before 6.17 can be retrieved by unauthenticated visitors through the WordPress REST API, exposing posts and pages the plugin is meant to hide from non-members. The plugin's protected-content filter is only registered during normal front-end request handling, so REST responses return the raw rendered content instead of the stripped version; no authentication or user interaction is required, and only confidentiality of the gated content is affected (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 8.7). No public exploit code has been identified at time of analysis, and the practical impact depends entirely on whether the site actually uses MembershipWorks content protection; sites in that configuration should plan to update this week.