MongoDB Database Tools builds prior to 100.20.0 (specifically 100.19.0, compiled with Golang 1.26.8) will accept TLS server certificates chaining to the eMudhra CA, which Go's crypto/x509 denylist only began rejecting in Golang 1.27.3. An attacker holding a man-in-the-middle position on the network path and a usable eMudhra-issued certificate for the targeted hostname could therefore intercept DB Tools connections to a MongoDB server and read or alter traffic; the victim must actively initiate the connection. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the flaw is resolved in DB Tools 100.20.0.
Authenticated SQL injection in OpenCATS prior to 0.10.0 lets any logged-in user who can reach the home Calls DataGrid (home:CallsDataGrid) or activity DataGrid (activity:ActivityDataGrid) rewrite the date-filter SQL and read data beyond their intended scope, including user accounts, candidate records, contacts, company records, job orders and activity history. The flaw sits in the request-controlled period, startDate and endDate parameters, which are concatenated into SQL date comparisons in modules/home/dataGrids.php and modules/activity/dataGrids.php without validation or escaping; a valid OpenCATS login is required and unauthenticated exploitation is not established. The confidentiality impact dominates (the data exposure is the practical harm), and no public exploit code was identified at time of analysis; the vendor-released patch is OpenCATS 0.10.0.
Out-of-bounds write in Dell PowerProtect Data Domain allows a low-privilege authenticated remote attacker to trigger memory corruption and deny service on affected appliances. The exposure spans Feature Release 7.7.1.0 through 8.8 and LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. The assessed impact is availability-only (C:N/I:N/A:H); no public exploit was identified at time of analysis, and priority is this_week rather than emergency.
Denial of service in jackson-dataformat-protobuf (2.21.6-2.21.7, 2.22.0-2.22.3, 3.1.6-3.1.7 and 3.2.2-3.2.3) lets an 8-byte malformed protobuf message force an oversized buffer allocation that ends in OutOfMemoryError, so any application that streaming-parses untrusted protobuf against a schema containing a string-keyed map (map<string, V>) is exposed. The overflow occurs in ProtobufParser._readStringKey(), where a declared key length of 0x7FFFFFFF wraps the signed bounds check and reaches TextBuffer.expandCurrentSegment(); StreamReadConstraints (maxStringLength, maxNameLength, maxDocumentLength, maxNestingDepth) do not block it, and JVMs started with -XX:+ExitOnOutOfMemoryError terminate outright (observed exit code 3). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), consistent with pure availability impact and no demonstrated confidentiality or integrity effect; a working proof-of-concept payload is documented in the vendor advisory, but there is no CISA KEV listing and no confirmed active exploitation, and the vuln.today decision label places remediation in this week's queue.
Eager, unbounded memory allocation in the asynchronous Smile parser (NonBlockingByteArrayParser) lets a Smile feed of roughly ten bytes force a byte[] allocation of approximately 2 GB before any body bytes are consumed, producing an OutOfMemoryError that crashes the request or processing thread on reactive/async Smile endpoints; a VInt crafted to overflow int instead yields a negative length and a NegativeArraySizeException that is not a JacksonException and so escapes the parser contract. Only applications that construct the non-blocking parser via SmileFactory.createNonBlockingByteArrayParser and feed it attacker-supplied Smile bytes are exposed - the blocking SmileParser already contains the (value >>> 25) overflow guard - and no authentication, privileges or user interaction are required beyond the ability to submit data for parsing (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-789). No public exploit code has been identified at time of analysis, although the upstream advisory includes a code-verified reproduction recipe, and fixes are published across all supported branches.
Information disclosure in the Animated Text Block WordPress plugin (versions up to and including 1.2.6) allows an authenticated user with Contributor-level access or higher to read the rendered content of any published post on the site. The 'animated-text' shortcode handler accepts an attacker-supplied post ID and, in its 'publish' branch, renders the post without any capability check and without verifying that the post type is the plugin's own custom post type or is otherwise viewable - so posts in non-public custom post types (public=false, show_in_rest=false) that WordPress normally hides from direct URLs and the REST API can be disclosed. Impact is confidentiality-only (no modification or denial of service), the target post must be in 'publish' status, and no public exploit code or PoC reference is present in the available sources; the vuln.today decision label is this_week.
Stored cross-site scripting in the Menu Cart for WooCommerce plugin before 3.2.1 allows unauthenticated attackers to persist crafted cart item variation data that executes in another user's session when the cart slide-out is rendered, including a logged-in administrator's session. Execution requires user interaction: a victim must load a page that displays the stored payload. EPSS is 0.19% (percentile 9%), no public exploit is identified at time of analysis, and the vendor has released version 3.2.1 as the fix.
Unauthenticated SQL injection in the AVideo-Encoder streamer login endpoint (objects/login.json.php) lets remote attackers read arbitrary data from the encoder database, including stored upstream streamer credentials, allowlist configuration and job queue records. All deployments prior to 8.1.0 are affected, and exploitation additionally requires the operator to have left the streamer allowlist empty (the default) and to be reachable by an attacker-controlled login-response host. CVSS 3.1 base score is 7.5 (HIGH), driven entirely by confidentiality impact from a network-reachable, low-complexity, unauthenticated attack; there is no CISA KEV entry, exploitation in the wild is not confirmed, and while the vendor advisory documents a public proof-of-concept reproduction, it is not verified as working exploit code.
Broken access control in the Bricks Builder WordPress plugin/theme through version 2.4.3 lets unauthenticated remote attackers read content that WordPress would otherwise withhold, including draft and private posts and WooCommerce coupon records, through the plugin's /wp-json/bricks/v1/query_result REST endpoint. An attacker submits crafted post_status and post_type values inside the originalQueryVars parameter; the required nonce is described as publicly obtainable, so it does not act as a real barrier, and no authentication or user interaction is needed. Scored 7.5 with confidentiality-only impact (CWE-862) and flagged as a this-week priority; no public exploit identified at time of analysis.
Unauthenticated attackers can leak password hashes, email addresses, and post metadata from WordPress sites running Bricks Theme 2.4.3 and earlier by injecting dynamic-data tags through the query_result REST endpoint. The flaw is remotely exploitable with no authentication or user interaction (CVSS 7.5, confidentiality-only impact), and the vendor has released Bricks 2.4.4 as the fix. No CISA KEV entry is present and no public exploit was identified at time of analysis, but the unauthenticated confidentiality impact makes this a high-priority update.
Server-side request forgery in Happy DOM's @happy-dom/server-renderer package (versions <= 21.0.1) lets unauthenticated remote attackers redirect the proxy's outbound fetch to any HTTP or HTTPS endpoint the host can reach - including localhost and internal services - and read the relayed response headers and body. The flaw is limited to deployments that run ServerRendererServer in reverse-proxy/SSR mode with a configured server.targetOrigin and expose its HTTP/2 port; using happy-dom purely as a DOM or test library does not trigger it. Version 21.0.2 fixes the issue by rejecting any request whose resolved origin no longer matches targetOrigin, and the vendor advisory includes a complete proof-of-concept reproduction (Dockerfile plus poc.py) that demonstrates the bypass and the leaked internal response.
Labstack Echo's global Static middleware serves files whose paths were percent-encoded to dodge route- or group-level middleware guards: when `middleware.Static` is mounted with `e.Use(...)` and an application protects a path such as `/admin` with a group middleware, a request for `/admin%2Fsecret.txt` skips the guard because the router matches on the raw, still-encoded path, yet the handler opens and returns the same file because it reads the already-decoded `c.Request().URL.Path`. Echo v5 releases from 5.0.0 before 5.4.0 and v4 releases before 4.16.0 are affected; the advisory ships a reproduction PoC against v5.3.1 (literal path returns 401, `%2F` form returns the file) and there is no CISA KEV entry or confirmed active exploitation. Impact is bounded to files already inside the served static root - nothing outside the root is reachable - so this is an authorization-consistency flaw exploitable only by deployments that both publish a directory statically and rely on a route guard, rather than keeping sensitive files out of that root.
Quadratic-time denial of service in RE2JS (npm re2js 2.2.0 through 2.8.6) lets attacker-influenced text pin a CPU core when an application compiles a lookbehind pattern with the opt-in RE2JS.LOOKBEHINDS flag and scans it with a repeated-matching API such as matcher().find() in a loop, matchAll(), split(), or matcher().replaceAll(). The engine's advertised linear-time guarantee breaks down because lookbehind automata are re-seeded from offset zero on every match request, so a dense match stream produces Θ(n²) total work - roughly 36-39 seconds of CPU on a single 16,000-character input in the reporter's measurement. No authentication, user interaction, or crafted payload is required: ordinary dense alternating input triggers it, and on Node.js the single-threaded worker is frozen for the duration. No CISA KEV listing is present in the supplied data; a full copy-paste reproduction script is published in the vendor advisory and fix PR, though it is not independently verified as working exploit code here. Fixed in 2.8.7.
An integer overflow (CWE-190) in the deep-packet-inspection certificate scanner of Juniper Networks Session Smart Router allows a remote attacker to deny service by feeding a specially crafted TLS server certificate through the inspection path. Per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), the flaw is network-reachable, low complexity, and requires no authentication or user interaction, but its entire impact is availability - no confidentiality or integrity effect is assessed. Exposure is bounded by configuration: only deployments in which the DPI certificate scanner actually inspects attacker-influenced TLS certificates are reachable, and whether that inspection is enabled by default is not confirmed in the available sources; no public exploit has been identified at time of analysis, and vulnerability prioritization places this in the this-week remediation window rather than an emergency one.
Heap-based out-of-bounds write in SimulationCraft builds after release-820-01 and before the May 7, 2026 nightly, fixed in simc-1205-01-516b5d7, allows attacker-controlled gear JSON with more than four socket entries to overflow the four-element gem_id array and corrupt adjacent gem_bonus_id vector storage. The vendor advisory reports crashes and demonstrated code execution in a testing environment, but assessed exploitation requires the victim or hosted service to import malicious .simc profile data, a compromised addon export, or tampered Battle.net API responses, with high attack complexity and user interaction; a public crash-reproducing JSON PoC exists, and no CISA KEV entry or confirmed active exploitation is reported.
Missing authorization in the iHomefinder Optima Express (MarketBoost IDX) WordPress plugin, affecting all versions through 9.0.0, lets remote attackers without credentials reach plugin functionality that should be access-controlled and read data they are not entitled to see. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) confirms a network-reachable, low-complexity, unauthenticated issue whose impact is confined to confidentiality, with no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the specific plugin feature or endpoint that must be reachable is not described in the available sources, leaving an active installation of an affected version as the only firm precondition.
Unauthenticated information disclosure in the Supsystic Contact Form WordPress plugin (all versions through 1.10.5) lets remote attackers retrieve sensitive data that the plugin embeds in the data it sends. The CVSS 3.1 score of 7.5 reflects network-only access with no privileges and no user interaction, high confidentiality impact, and no integrity or availability effect; vuln.today triage rates it this_week, i.e. moderate rather than emergency priority. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the precise endpoint, parameter, or output path that exposes the embedded data is not described in the available sources.
A crafted XLSX or XLS workbook, or a crafted formula inside one, can terminate or hang the host process that parses it with RadSpreadProcessing or RadSpreadStreamProcessing in Progress Telerik Document Processing Libraries before 2026.3.1027. The root cause is a cluster of resource-consumption defects (CWE-674 uncontrolled recursion, infinite loop, unchecked loop condition, inefficient regular expression) reachable without authentication or user interaction at the library level, giving a high availability-only impact (CVSS 7.5, A:H, no confidentiality or integrity effect). The practical exposure depends on deployment: any application feature that accepts and processes untrusted spreadsheets is exposed, while installations that only process trusted internal documents effectively avoid the remote path; no public exploit code is identified in the available data and the vendor's stated complete fix is upgrading to 2026.3.1027 or later.
Denial of service in Progress Telerik Document Processing Libraries before 2026.3.1027 allows unauthenticated remote attackers to hang or terminate the host process by submitting a crafted PDF to RadPdfProcessing or crafted document text to the AI document summarization and question-answering features (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). The flaw is reachable only where an application built on the libraries exposes PDF upload or AI summarization intake to untrusted users; installations that process only trusted internal documents are not realistically exposed, and there is no data disclosure or code execution. No public exploit has been identified at time of analysis and the issue is not in CISA KEV; the vendor states that upgrading to version 2026.3.1027 is the only complete fix. This is a genuine but moderate-priority availability issue rather than a high-severity emergency.
Denial of service in Progress Telerik Document Processing Libraries before 2026.3.1027 allows an unauthenticated remote attacker to terminate or hang the host process by supplying a crafted DOCX, DOC, RTF, or HTML document to RadWordsProcessing. The flaw involves uncontrolled recursion, inefficient algorithmic complexity, and infinite-loop conditions during parsing, with impact limited to availability. No public exploit identified at time of analysis, and no CISA KEV entry is present in the supplied data.
RadPdfProcessing, the PDF component of Progress Telerik Document Processing Libraries before version 2026.3.1027, performs improper verification of cryptographic signatures and improper certificate validation when validating signed PDFs. Per the vendor CVSS vector the flaw is remotely reachable without authentication or user interaction and yields an integrity-only impact (C:N/I:H/A:N, score 7.5), because a crafted signed PDF can make the library report forged content as unmodified and its signing certificate as valid. Exposure is limited to applications that actually call this library to verify PDF signatures and then act on the verification result as a trust decision; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, though the vendor-published advisory places it on a this-week remediation cadence.
XML external entity injection in Progress Telerik Document Processing Libraries before 2026.3.1027 allows remote unauthenticated attackers to read local files on the server when an application processes or exports a crafted SVG image to PDF. The malicious input uses a nested embedded SVG carrying an external entity reference, and the CVSS 3.1 vector rates confidentiality impact High with no integrity or availability impact. No public exploit was identified at time of analysis, and practical exposure depends on whether the host application renders or PDF-exports untrusted SVG content.
OAuth token revocation in WSO2 Identity Server fails to invalidate access and refresh tokens for accounts whose usernames contain mixed-case characters when the deployment pairs a case-insensitive user store with a case-sensitive identity database. An authenticated attacker (PR:L) who already holds a valid, unexpired token for such an account can keep using it for actions that should have been blocked after a revocation-triggering lifecycle event, bounded by the token's natural expiry. Affected deployments are a non-default configuration subset, the trigger requires that specific store/database mismatch plus a mixed-case username, and no public exploit has been identified at time of analysis; the input 7.4 score assumes AC:L, whereas the assessed vector uses AC:H, so real-world risk is materially lower than the headline number suggests.
Acronis Cyber Protect 17 on Linux and Windows before build 42587 can expose sensitive information and allow manipulation of protected resources through improper token validation, reachable over the network without authentication but requiring high attack complexity. Vendor CVSS is 7.4, and the this_week decision label makes this a moderate-priority remediation rather than an emergency. No public exploit code was identified at time of analysis.
Token forgery in Acronis Cyber Protect 17 before build 42587 can allow remote, unauthenticated attackers to bypass authentication or authorization, resulting in sensitive information disclosure and data manipulation on Linux and Windows installations. The CVSS 3.0 score is 7.4 with high attack complexity (AC:H), indicating non-trivial preconditions; no public exploit identified at time of analysis and no CISA KEV entry is present.
Integer overflow (CWE-190) in Dell PowerProtect Data Domain appliances allows a high-privileged, remotely connected attacker to achieve code execution on the affected system. Affected releases are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. The CVSS vector (AV:N/AC:L/PR:H/UI:N) confirms exploitation requires an existing administrative account, so realistic exposure is confined to insiders, compromised admin credentials, or chaining from another access vector; no public exploit has been identified at time of analysis and CVE-2026-86389 is not in CISA KEV.
Integer overflow (CWE-190) in Dell PowerProtect Data Domain (Feature Release 7.7.1.0 through 8.8, plus the LTS2024, LTS2025 and LTS2026 branches) allows a remote attacker who already holds administrative-level access to the appliance to bypass protection mechanisms, with high impact on confidentiality, integrity and availability. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) confirms the decisive limiting factor is the PR:H prerequisite: no user interaction is needed and complexity is low, but the flaw cannot be reached without pre-existing high privileges, making this a post-authentication protection-bypass risk rather than an externally exploitable entry point. No public exploit code has been identified at time of analysis and no KEV listing applies; priority is this_week per the decision signals, and the specific interface that processes the overflowing integer is not described in the available sources.
Unauthenticated remote attackers can drive AVideo-Encoder's privileged queue processor and read its control and status plane in default installations prior to 8.1.0. Because the application ships no global authentication layer (the bundled .htaccess denies only .git, *.log and avideo.log), the PHP endpoints view/run.php, view/queue.json.php, view/status.php and view/listFiles.json.php are directly reachable and perform their privileged actions for anonymous callers - invoking Encoder::run(), disclosing the job queue and every streamer site URL, returning host memory statistics with a wildcard Access-Control-Allow-Origin header, and enumerating media file names and paths in any directory readable by the web-server user. Impact is bounded to control-plane manipulation and information exposure (no code execution, and enumeration is limited to configured media extensions and does not return file contents); a public PoC reference with anonymous curl requests exists in the vendor advisory, but it is not verified as working exploit code and there is no KEV listing, with priority assessed as remediation this week and a vendor fix available in 8.1.0.
Local privilege escalation in Norton Antivirus, Avast Antivirus, and AVG Internet Security before version 26.5.10933 on Windows lets a low-privileged local user gain NT AUTHORITY\SYSTEM through the Data Shredder component. The flaw is a link-following defect (CWE-59): during a privileged shred operation, the component follows attacker-placed filesystem links, resulting in deletion of arbitrary files or folders that the attacker then leverages to elevate to SYSTEM. Exploitation requires authenticated local access with low privileges and depends on the privileged shred operation being performed (UI:R); a vendor patch is available, so this rates as a this-week priority rather than an emergency, and no public exploit code has been identified at time of analysis.
Improper privilege management in Dell PowerProtect Data Domain appliances allows a high-privileged, authenticated attacker with network reachability to elevate their privileges on the appliance, with high impact to confidentiality, integrity and availability. Affected releases are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40 and LTS2026 8.6.1.0 through 8.6.1.20. The dominant limiting factor is the PR:H prerequisite: this is a post-authentication escalation for a malicious or compromised high-privilege operator rather than a path for an unauthenticated outsider; no public exploit is identified at time of analysis and this is a non-emergency 'this_week' priority.
Privilege escalation in Mage Eventpress (Event Booking Manager for WooCommerce) versions up to and including 5.7.8 allows an authenticated WooCommerce Shop Manager to elevate to Administrator. The mep_grant_shop_manager_access() function hooks user_has_cap and grants manage_options whenever an attacker-controlled $_GET['page'] value begins with 'mep_' or 'mpwem_', without validating that the page is a registered EventPress screen; deployments that assign Shop Manager accounts to non-administrators are exposed. The CVSS 3.1 score is 7.2 with PR:H, reflecting the need for an existing elevated account, and no public exploit identified at time of analysis; vuln.today assigns this CVE a this_week priority.
Stored DOM-based cross-site scripting in the MxChat - AI Chatbot & Content Generation for WordPress plugin, affecting all versions up to and including 3.2.25, lets an unauthenticated visitor submit a crafted 'feedback' value in a single POST to admin-ajax.php and have arbitrary script execute when an administrator subsequently loads the plugin's Transcripts page. It carries CVSS 7.2 (scope-changed, low confidentiality and integrity impact) with an unauthenticated, no-interaction attack vector, though the practical constraint is that an admin must open that specific wp-admin screen while the malicious record is stored. No CISA KEV entry and no public exploit code were identified in the supplied data; the vuln.today priority label is 'this_week'.
Stored DOM-based cross-site scripting in the WordPress plugin AI Marketing Expert (all versions up to and including 1.2.8) allows unauthenticated attackers to persist arbitrary JavaScript through the chatbot's unescaped 'name' parameter and have it execute in an administrator's browser. The storage path is reachable only when the chatbot module is active with at least one bot configured: the attacker writes the payload via three unauthenticated REST calls, and the dashboard widget's auto-poll then renders it when a logged-in admin opens wp-admin/index.php. Impact is bounded by that admin-only execution context (CVSS 7.2, scope-changed, low confidentiality/integrity), and no public exploit code was identified at time of analysis; a fixed release is available as version 1.2.9.
Stored cross-site scripting in the Prime Slider Elementor addons plugin for WordPress (versions up to and including 4.7.2) allows unauthenticated attackers to inject arbitrary web scripts via the 'comment' parameter, because the plugin's regex fallback consumes closing quotes of allowed attributes containing 'bdt-' and promotes injected event handlers such as onfocus into stored HTML. The payload executes when a victim subsequently loads the page containing the injected comment, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) reflects network-reachable, low-complexity, unauthenticated injection with scope change. No public exploit identified at time of analysis.
Stored cross-site scripting in the affiliate-toolkit - Multi-Network Affiliate & Amazon Product Display WordPress plugin, affecting all versions through 3.9.2, allows script to be persisted through the 'atkp_product_producturl' product-URL field because the value is insufficiently sanitized on input and not escaped on output, so it executes in the browser of any user who later opens the injected product page. In a default installation the practical bar is contributor-level access or above, matching the independently assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N; the unauthenticated path described in the original 7.2 rating only opens up when the plugin's AJAX loading or AJAX handler option is enabled and the attacker knows a valid product id to render, making it a non-default configuration. Impact is confined to browser-context script execution with limited confidentiality and integrity effect and no availability impact, and no public exploit code, PoC reference, or CISA KEV entry was identified at time of analysis.
Stored cross-site scripting in the AMP for WP - Accelerated Mobile Pages WordPress plugin through version 1.1.17 allows a malicious 'headline-*' shortcode attribute to be persisted and rendered as script in AMP author archive pages, executing for any visitor of the injected page. This is a moderate-priority issue rather than an emergency: the concrete path described in the available sources requires a Subscriber-level account (and therefore open user registration) to plant the shortcode in a biographical info field, while the advisory title also references an unauthenticated shortcode-attribute path whose trigger is not described in the supplied data - the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. No CISA KEV entry and no public exploit code were identified at time of analysis, and a plugin Trac changeset (3722863) points to an upstream fix.
Authenticated WordPress users holding a delegated non-administrator role can rewrite the GoSMTP plugin's SMTP configuration in any version before 1.2.5, redirecting outbound mail and ultimately taking over an administrator account. The settings page is gated only on the plugin's activation capability and lacks a proper settings-management authorization check, so the flaw is a broken-access-control / improper-privilege-management issue rather than an anonymous remote attack - the attacker must already have a valid sub-administrator account with that capability. No public exploit code has been identified at time of analysis, exploitation is not confirmed in CISA KEV, and EPSS is low at roughly 0.15% (4th percentile), though the vendor has released a fix in 1.2.5 and the priority signal points to patching this week.
Authenticated remote code execution in OpenCATS versions prior to 0.10.0 lets an administrator-level user with Settings-module access inject PHP syntax into config.php through the Professional License key field, producing persistent arbitrary code execution as the web server user. The flaw is gated by the PR:H metric in the CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High): the attacker must already hold an administrator account with permission to update the Professional License configuration, and config.php must be writable by the web server process for the write-based path to succeed. Successful exploitation gives full confidentiality, integrity and availability impact over candidate, contact, company, job order and user data, and the vendor states unauthenticated exploitation or exploitation by users without Settings access is not established; no public exploit code has been identified at time of analysis and the issue is fixed in v0.10.0.
DOM-based cross-site scripting in Vue I18n's sanitizeTranslatedHtml() lets attacker-influenced content survive sanitization when it is placed inside an <iframe srcdoc="..."> value: the sanitizer escapes markup and neutralizes on* handlers using character references, but the browser re-decodes that value and parses it as a same-origin nested document, so the injected markup executes script. Applications are exposed only in a specific configuration - escapeParameter (escapeParameterHtml in the Legacy API) enabled, translations rendered as HTML (for example with v-html), and untrusted data reaching an srcdoc value via a parameter, untrusted/stored message content, or unescaped named values passed alongside a list (GHSA-8rc2-428q-7ww3) - while rendering through <i18n-t> is not affected. Affected ranges are vue-i18n 11.1.10 through 11.4.13 and 12.0.0-alpha.4, with unsupported 9.14.5 and 10.0.8 also vulnerable and left unfixed; the vendor advisory includes a public PoC snippet illustrating the bypass, which is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing).
Prototype pollution in the Highcharts JS charting library (6.1.0 up to 11.4.9, 12.0.0 up to 12.6.1, and 13.0.0 through 13.0.2) lets an attacker who controls a chart's series.keys array and the matching per-point data write arbitrary named properties onto Object.prototype using dot-separated paths such as '__proto__.polluted' or 'constructor.prototype.alsoPolluted'. No user interaction is required beyond rendering the chart, and because the injected properties are visible to all JavaScript on the page rather than only to the chart - reflected as scope-changed (S:C) in both the vendor CVSS 4.0 vector and the independently assessed CVSS 3.1 vector - concrete harm depends on what other page code later reads. Exploitation is contextual: series.keys is normally a static developer-defined configuration, so only applications that route untrusted input into both keys and point data are exposed, and the advisory links a live JSFiddle demonstration of the pollution (a public PoC reference exists; it is not verified as working exploit code). There is no CISA KEV entry and no confirmed active exploitation; the vuln.today decision label is 'this_week', a moderate context-dependent priority rather than an emergency.
Prototype pollution in Highcharts JS 13.0.0 through 13.0.2 lets attacker-controlled series point data write integer-keyed properties onto Object.prototype and the Object constructor, which then surface in out-of-range index reads and for...in enumeration of every object on the page. No user interaction is required beyond rendering a chart built from those point objects, and the injected properties persist after the chart is constructed; the practical consequence runs from broken rendering to whatever the consuming application does with attacker-supplied inherited values. The issue is fixed in 13.1.0, is not listed in CISA KEV, and no working exploit code is confirmed - the vendor advisory does publish a live JSFiddle demo for testing, and the current priority label is this_week rather than an emergency call.
Client-side cross-site scripting in Highcharts 12.0.0 through <12.6.1 and 13.0.0 through 13.0.2 - including the Stock, Maps and Gantt products shipped in the same package - lets markup placed in HTML-rendered text options execute event handlers in the origin of the page hosting the chart when that page re-renders the chart from a Chromium beforeprint handler and printing is started. All four of those conditions must hold together, so exposure is confined to pages that route untrusted data into useHTML titles, axis labels, data labels or responsive text; the issue is rated high (CVSS 4.0 base 7.2; assessed CVSS 3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) rather than critical. No public exploit is identified at time of analysis, and vendor-released fixes 12.6.1 and 13.1.0 are available.
SVG anchors whose xlink:href carries a javascript: URL slip past the markup filter that Highcharts applies to href and src, so a chart text option such as the title can retain an active script link in its serialized form. The bug affects npm package highcharts from 10.3.2 through the 11.x, 12.x and 13.x branches prior to 11.4.9, 12.6.2 and 13.1.1 respectively, and only becomes dangerous when the chart is exported (the default SVG download declares the XLink namespace) or its container markup is serialized and then re-parsed as a document, at which point a user click runs script in that document's origin - the live rendered page itself does not produce a clickable link. Exploitation therefore needs attacker-controlled data in the chart configuration, an export/re-inline step, and user interaction (CVSS:4.0 PR:L/UI:A, and the assessor's CVSS:3.1 AC:H/PR:L/UI:R with scope change); no public exploit code or in-the-wild activity was identified at time of analysis, and the priority label is this_week rather than emergency.
PHP object injection via unsafe deserialization affects the WordPress/WooCommerce plugin Filter Everything through version 1.9.7, allowing an attacker with administrator-level privileges (CVSS PR:H) to deserialize untrusted data and potentially achieve high impact on confidentiality, integrity and availability. The flaw is network-reachable with low attack complexity and no user interaction, but meaningful exploitation depends on a usable POP gadget chain being present in the loaded code base, which the available sources do not confirm. No public exploit code or CISA KEV entry is identified at time of analysis; the vulnerability was reported by Patchstack and the affected parameter or feature that triggers deserialization is not described in the available sources.
PHP object injection in weDevs Dokan (dokan-lite) through 5.3.1 lets a high-privilege authenticated WordPress user trigger deserialization of untrusted data over the network without user interaction, potentially affecting confidentiality, integrity, and availability (CVSS 7.2). The vulnerable endpoint or parameter is not described in the available sources, and practical impact depends on a usable PHP object-injection gadget chain that the evidence does not enumerate. No public exploit identified at time of analysis; vuln.today priority is this_week.
PHP object injection (CWE-502) in the PickPlugins Accordion WordPress plugin through version 2.3.25 lets an administrator-level user on a vulnerable site deserialize untrusted data, potentially achieving object injection that leads to code or data compromise. The flaw is rated 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and PR:H means exploitation requires an authenticated high-privilege account; the vendor reference from Patchstack identifies the issue as a PHP object injection vulnerability in the plugin. Realistic impact additionally depends on a usable PHP POP gadget chain being present in the plugin, WordPress core, or another installed component; there is no CISA KEV entry and no confirmed public exploit code, and the exact parameter or feature reaching the deserialization sink is not described in the available sources.
OS command injection in Dell PowerProtect Data Domain (Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20) allows a remote attacker who already holds high administrative privileges to execute arbitrary OS commands on the appliance, with high confidentiality, integrity and availability impact. The CVSS vector confirms PR:H, so unauthenticated or low-privileged users cannot reach the flaw; there is no CISA KEV entry and no public exploit identified at time of analysis. Dell has released fixed versions (8.9.0.0, 7.13.1.90, 8.3.1.50, 8.6.1.30) and the issue is prioritized for remediation this week, but it remains a conditional-risk issue rather than a drop-everything emergency.
OS command injection in Dell PowerProtect Data Domain allows a high-privileged remote attacker to execute arbitrary operating system commands on the appliance. The flaw affects Feature Release versions 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20, across the unified CPE cpe:2.3:a:dell:powerprotect_data_domain. Exploitation requires pre-existing administrative access (PR:H per the CVSS vector), so the realistic threat is from insiders or attackers who have already compromised admin credentials; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a security advisory (DSA-2026-416).
OS command injection in Dell PowerProtect Data Domain lets a remote attacker who already holds high (administrative) privileges on the appliance execute arbitrary operating system commands, with high impact on confidentiality, integrity and availability of the backup infrastructure. The affected set is bounded to Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; no public exploit was identified at time of analysis, and the mandatory PR:H prerequisite (unauthenticated access is not sufficient) narrows the realistic attacker set to credentialed administrators, compromised admin accounts and insiders. Dell rates the issue 7.2 with an AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H vector, matching an independent assessment that treats it as a moderate-severity, high-barrier problem rather than an urgent widespread threat, with remediation tracked for this week.
rtl_433 through 25.12 contains a stack-based buffer overflow in its Proflame 2 OOK decoder: more than seven valid Manchester-coded words are written past a fixed 7-byte stack buffer. A nearby unauthenticated attacker can deliver the trigger over RF or supply a crafted signal file, causing a crash on all vulnerable builds and potentially control-flow hijacking on builds compiled without stack canaries. The risk is moderate because exploitation requires the Proflame 2 decoder to be active plus RF adjacency or local crafted-file delivery; no public exploit has been identified at time of analysis.