Labstack Echo's global Static middleware serves files whose paths were percent-encoded to dodge route- or group-level middleware guards: when `middleware.Static` is mounted with `e.Use(...)` and an application protects a path such as `/admin` with a group middleware, a request for `/admin%2Fsecret.txt` skips the guard because the router matches on the raw, still-encoded path, yet the handler opens and returns the same file because it reads the already-decoded `c.Request().URL.Path`. Echo v5 releases from 5.0.0 before 5.4.0 and v4 releases before 4.16.0 are affected; the advisory ships a reproduction PoC against v5.3.1 (literal path returns 401, `%2F` form returns the file) and there is no CISA KEV entry or confirmed active exploitation. Impact is bounded to files already inside the served static root - nothing outside the root is reachable - so this is an authorization-consistency flaw exploitable only by deployments that both publish a directory statically and rely on a route guard, rather than keeping sensitive files out of that root.
Quadratic-time denial of service in RE2JS (npm re2js 2.2.0 through 2.8.6) lets attacker-influenced text pin a CPU core when an application compiles a lookbehind pattern with the opt-in RE2JS.LOOKBEHINDS flag and scans it with a repeated-matching API such as matcher().find() in a loop, matchAll(), split(), or matcher().replaceAll(). The engine's advertised linear-time guarantee breaks down because lookbehind automata are re-seeded from offset zero on every match request, so a dense match stream produces Θ(n²) total work - roughly 36-39 seconds of CPU on a single 16,000-character input in the reporter's measurement. No authentication, user interaction, or crafted payload is required: ordinary dense alternating input triggers it, and on Node.js the single-threaded worker is frozen for the duration. No CISA KEV listing is present in the supplied data; a full copy-paste reproduction script is published in the vendor advisory and fix PR, though it is not independently verified as working exploit code here. Fixed in 2.8.7.
An integer overflow (CWE-190) in the deep-packet-inspection certificate scanner of Juniper Networks Session Smart Router allows a remote attacker to deny service by feeding a specially crafted TLS server certificate through the inspection path. Per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), the flaw is network-reachable, low complexity, and requires no authentication or user interaction, but its entire impact is availability - no confidentiality or integrity effect is assessed. Exposure is bounded by configuration: only deployments in which the DPI certificate scanner actually inspects attacker-influenced TLS certificates are reachable, and whether that inspection is enabled by default is not confirmed in the available sources; no public exploit has been identified at time of analysis, and vulnerability prioritization places this in the this-week remediation window rather than an emergency one.
Heap-based out-of-bounds write in SimulationCraft builds after release-820-01 and before the May 7, 2026 nightly, fixed in simc-1205-01-516b5d7, allows attacker-controlled gear JSON with more than four socket entries to overflow the four-element gem_id array and corrupt adjacent gem_bonus_id vector storage. The vendor advisory reports crashes and demonstrated code execution in a testing environment, but assessed exploitation requires the victim or hosted service to import malicious .simc profile data, a compromised addon export, or tampered Battle.net API responses, with high attack complexity and user interaction; a public crash-reproducing JSON PoC exists, and no CISA KEV entry or confirmed active exploitation is reported.
Missing authorization in the iHomefinder Optima Express (MarketBoost IDX) WordPress plugin, affecting all versions through 9.0.0, lets remote attackers without credentials reach plugin functionality that should be access-controlled and read data they are not entitled to see. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) confirms a network-reachable, low-complexity, unauthenticated issue whose impact is confined to confidentiality, with no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the specific plugin feature or endpoint that must be reachable is not described in the available sources, leaving an active installation of an affected version as the only firm precondition.
Unauthenticated information disclosure in the Supsystic Contact Form WordPress plugin (all versions through 1.10.5) lets remote attackers retrieve sensitive data that the plugin embeds in the data it sends. The CVSS 3.1 score of 7.5 reflects network-only access with no privileges and no user interaction, high confidentiality impact, and no integrity or availability effect; vuln.today triage rates it this_week, i.e. moderate rather than emergency priority. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the precise endpoint, parameter, or output path that exposes the embedded data is not described in the available sources.
A crafted XLSX or XLS workbook, or a crafted formula inside one, can terminate or hang the host process that parses it with RadSpreadProcessing or RadSpreadStreamProcessing in Progress Telerik Document Processing Libraries before 2026.3.1027. The root cause is a cluster of resource-consumption defects (CWE-674 uncontrolled recursion, infinite loop, unchecked loop condition, inefficient regular expression) reachable without authentication or user interaction at the library level, giving a high availability-only impact (CVSS 7.5, A:H, no confidentiality or integrity effect). The practical exposure depends on deployment: any application feature that accepts and processes untrusted spreadsheets is exposed, while installations that only process trusted internal documents effectively avoid the remote path; no public exploit code is identified in the available data and the vendor's stated complete fix is upgrading to 2026.3.1027 or later.
Denial of service in Progress Telerik Document Processing Libraries before 2026.3.1027 allows unauthenticated remote attackers to hang or terminate the host process by submitting a crafted PDF to RadPdfProcessing or crafted document text to the AI document summarization and question-answering features (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). The flaw is reachable only where an application built on the libraries exposes PDF upload or AI summarization intake to untrusted users; installations that process only trusted internal documents are not realistically exposed, and there is no data disclosure or code execution. No public exploit has been identified at time of analysis and the issue is not in CISA KEV; the vendor states that upgrading to version 2026.3.1027 is the only complete fix. This is a genuine but moderate-priority availability issue rather than a high-severity emergency.
Denial of service in Progress Telerik Document Processing Libraries before 2026.3.1027 allows an unauthenticated remote attacker to terminate or hang the host process by supplying a crafted DOCX, DOC, RTF, or HTML document to RadWordsProcessing. The flaw involves uncontrolled recursion, inefficient algorithmic complexity, and infinite-loop conditions during parsing, with impact limited to availability. No public exploit identified at time of analysis, and no CISA KEV entry is present in the supplied data.
RadPdfProcessing, the PDF component of Progress Telerik Document Processing Libraries before version 2026.3.1027, performs improper verification of cryptographic signatures and improper certificate validation when validating signed PDFs. Per the vendor CVSS vector the flaw is remotely reachable without authentication or user interaction and yields an integrity-only impact (C:N/I:H/A:N, score 7.5), because a crafted signed PDF can make the library report forged content as unmodified and its signing certificate as valid. Exposure is limited to applications that actually call this library to verify PDF signatures and then act on the verification result as a trust decision; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, though the vendor-published advisory places it on a this-week remediation cadence.
XML external entity injection in Progress Telerik Document Processing Libraries before 2026.3.1027 allows remote unauthenticated attackers to read local files on the server when an application processes or exports a crafted SVG image to PDF. The malicious input uses a nested embedded SVG carrying an external entity reference, and the CVSS 3.1 vector rates confidentiality impact High with no integrity or availability impact. No public exploit was identified at time of analysis, and practical exposure depends on whether the host application renders or PDF-exports untrusted SVG content.
OAuth token revocation in WSO2 Identity Server fails to invalidate access and refresh tokens for accounts whose usernames contain mixed-case characters when the deployment pairs a case-insensitive user store with a case-sensitive identity database. An authenticated attacker (PR:L) who already holds a valid, unexpired token for such an account can keep using it for actions that should have been blocked after a revocation-triggering lifecycle event, bounded by the token's natural expiry. Affected deployments are a non-default configuration subset, the trigger requires that specific store/database mismatch plus a mixed-case username, and no public exploit has been identified at time of analysis; the input 7.4 score assumes AC:L, whereas the assessed vector uses AC:H, so real-world risk is materially lower than the headline number suggests.
Acronis Cyber Protect 17 on Linux and Windows before build 42587 can expose sensitive information and allow manipulation of protected resources through improper token validation, reachable over the network without authentication but requiring high attack complexity. Vendor CVSS is 7.4, and the this_week decision label makes this a moderate-priority remediation rather than an emergency. No public exploit code was identified at time of analysis.
Token forgery in Acronis Cyber Protect 17 before build 42587 can allow remote, unauthenticated attackers to bypass authentication or authorization, resulting in sensitive information disclosure and data manipulation on Linux and Windows installations. The CVSS 3.0 score is 7.4 with high attack complexity (AC:H), indicating non-trivial preconditions; no public exploit identified at time of analysis and no CISA KEV entry is present.
Integer overflow (CWE-190) in Dell PowerProtect Data Domain appliances allows a high-privileged, remotely connected attacker to achieve code execution on the affected system. Affected releases are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. The CVSS vector (AV:N/AC:L/PR:H/UI:N) confirms exploitation requires an existing administrative account, so realistic exposure is confined to insiders, compromised admin credentials, or chaining from another access vector; no public exploit has been identified at time of analysis and CVE-2026-86389 is not in CISA KEV.
Integer overflow (CWE-190) in Dell PowerProtect Data Domain (Feature Release 7.7.1.0 through 8.8, plus the LTS2024, LTS2025 and LTS2026 branches) allows a remote attacker who already holds administrative-level access to the appliance to bypass protection mechanisms, with high impact on confidentiality, integrity and availability. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) confirms the decisive limiting factor is the PR:H prerequisite: no user interaction is needed and complexity is low, but the flaw cannot be reached without pre-existing high privileges, making this a post-authentication protection-bypass risk rather than an externally exploitable entry point. No public exploit code has been identified at time of analysis and no KEV listing applies; priority is this_week per the decision signals, and the specific interface that processes the overflowing integer is not described in the available sources.
Unauthenticated remote attackers can drive AVideo-Encoder's privileged queue processor and read its control and status plane in default installations prior to 8.1.0. Because the application ships no global authentication layer (the bundled .htaccess denies only .git, *.log and avideo.log), the PHP endpoints view/run.php, view/queue.json.php, view/status.php and view/listFiles.json.php are directly reachable and perform their privileged actions for anonymous callers - invoking Encoder::run(), disclosing the job queue and every streamer site URL, returning host memory statistics with a wildcard Access-Control-Allow-Origin header, and enumerating media file names and paths in any directory readable by the web-server user. Impact is bounded to control-plane manipulation and information exposure (no code execution, and enumeration is limited to configured media extensions and does not return file contents); a public PoC reference with anonymous curl requests exists in the vendor advisory, but it is not verified as working exploit code and there is no KEV listing, with priority assessed as remediation this week and a vendor fix available in 8.1.0.
Local privilege escalation in Norton Antivirus, Avast Antivirus, and AVG Internet Security before version 26.5.10933 on Windows lets a low-privileged local user gain NT AUTHORITY\SYSTEM through the Data Shredder component. The flaw is a link-following defect (CWE-59): during a privileged shred operation, the component follows attacker-placed filesystem links, resulting in deletion of arbitrary files or folders that the attacker then leverages to elevate to SYSTEM. Exploitation requires authenticated local access with low privileges and depends on the privileged shred operation being performed (UI:R); a vendor patch is available, so this rates as a this-week priority rather than an emergency, and no public exploit code has been identified at time of analysis.
Improper privilege management in Dell PowerProtect Data Domain appliances allows a high-privileged, authenticated attacker with network reachability to elevate their privileges on the appliance, with high impact to confidentiality, integrity and availability. Affected releases are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40 and LTS2026 8.6.1.0 through 8.6.1.20. The dominant limiting factor is the PR:H prerequisite: this is a post-authentication escalation for a malicious or compromised high-privilege operator rather than a path for an unauthenticated outsider; no public exploit is identified at time of analysis and this is a non-emergency 'this_week' priority.
Privilege escalation in Mage Eventpress (Event Booking Manager for WooCommerce) versions up to and including 5.7.8 allows an authenticated WooCommerce Shop Manager to elevate to Administrator. The mep_grant_shop_manager_access() function hooks user_has_cap and grants manage_options whenever an attacker-controlled $_GET['page'] value begins with 'mep_' or 'mpwem_', without validating that the page is a registered EventPress screen; deployments that assign Shop Manager accounts to non-administrators are exposed. The CVSS 3.1 score is 7.2 with PR:H, reflecting the need for an existing elevated account, and no public exploit identified at time of analysis; vuln.today assigns this CVE a this_week priority.
Stored DOM-based cross-site scripting in the MxChat - AI Chatbot & Content Generation for WordPress plugin, affecting all versions up to and including 3.2.25, lets an unauthenticated visitor submit a crafted 'feedback' value in a single POST to admin-ajax.php and have arbitrary script execute when an administrator subsequently loads the plugin's Transcripts page. It carries CVSS 7.2 (scope-changed, low confidentiality and integrity impact) with an unauthenticated, no-interaction attack vector, though the practical constraint is that an admin must open that specific wp-admin screen while the malicious record is stored. No CISA KEV entry and no public exploit code were identified in the supplied data; the vuln.today priority label is 'this_week'.
Stored DOM-based cross-site scripting in the WordPress plugin AI Marketing Expert (all versions up to and including 1.2.8) allows unauthenticated attackers to persist arbitrary JavaScript through the chatbot's unescaped 'name' parameter and have it execute in an administrator's browser. The storage path is reachable only when the chatbot module is active with at least one bot configured: the attacker writes the payload via three unauthenticated REST calls, and the dashboard widget's auto-poll then renders it when a logged-in admin opens wp-admin/index.php. Impact is bounded by that admin-only execution context (CVSS 7.2, scope-changed, low confidentiality/integrity), and no public exploit code was identified at time of analysis; a fixed release is available as version 1.2.9.
Stored cross-site scripting in the Prime Slider Elementor addons plugin for WordPress (versions up to and including 4.7.2) allows unauthenticated attackers to inject arbitrary web scripts via the 'comment' parameter, because the plugin's regex fallback consumes closing quotes of allowed attributes containing 'bdt-' and promotes injected event handlers such as onfocus into stored HTML. The payload executes when a victim subsequently loads the page containing the injected comment, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) reflects network-reachable, low-complexity, unauthenticated injection with scope change. No public exploit identified at time of analysis.
Stored cross-site scripting in the affiliate-toolkit - Multi-Network Affiliate & Amazon Product Display WordPress plugin, affecting all versions through 3.9.2, allows script to be persisted through the 'atkp_product_producturl' product-URL field because the value is insufficiently sanitized on input and not escaped on output, so it executes in the browser of any user who later opens the injected product page. In a default installation the practical bar is contributor-level access or above, matching the independently assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N; the unauthenticated path described in the original 7.2 rating only opens up when the plugin's AJAX loading or AJAX handler option is enabled and the attacker knows a valid product id to render, making it a non-default configuration. Impact is confined to browser-context script execution with limited confidentiality and integrity effect and no availability impact, and no public exploit code, PoC reference, or CISA KEV entry was identified at time of analysis.
Stored cross-site scripting in the AMP for WP - Accelerated Mobile Pages WordPress plugin through version 1.1.17 allows a malicious 'headline-*' shortcode attribute to be persisted and rendered as script in AMP author archive pages, executing for any visitor of the injected page. This is a moderate-priority issue rather than an emergency: the concrete path described in the available sources requires a Subscriber-level account (and therefore open user registration) to plant the shortcode in a biographical info field, while the advisory title also references an unauthenticated shortcode-attribute path whose trigger is not described in the supplied data - the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. No CISA KEV entry and no public exploit code were identified at time of analysis, and a plugin Trac changeset (3722863) points to an upstream fix.
Authenticated WordPress users holding a delegated non-administrator role can rewrite the GoSMTP plugin's SMTP configuration in any version before 1.2.5, redirecting outbound mail and ultimately taking over an administrator account. The settings page is gated only on the plugin's activation capability and lacks a proper settings-management authorization check, so the flaw is a broken-access-control / improper-privilege-management issue rather than an anonymous remote attack - the attacker must already have a valid sub-administrator account with that capability. No public exploit code has been identified at time of analysis, exploitation is not confirmed in CISA KEV, and EPSS is low at roughly 0.15% (4th percentile), though the vendor has released a fix in 1.2.5 and the priority signal points to patching this week.
Authenticated remote code execution in OpenCATS versions prior to 0.10.0 lets an administrator-level user with Settings-module access inject PHP syntax into config.php through the Professional License key field, producing persistent arbitrary code execution as the web server user. The flaw is gated by the PR:H metric in the CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High): the attacker must already hold an administrator account with permission to update the Professional License configuration, and config.php must be writable by the web server process for the write-based path to succeed. Successful exploitation gives full confidentiality, integrity and availability impact over candidate, contact, company, job order and user data, and the vendor states unauthenticated exploitation or exploitation by users without Settings access is not established; no public exploit code has been identified at time of analysis and the issue is fixed in v0.10.0.
DOM-based cross-site scripting in Vue I18n's sanitizeTranslatedHtml() lets attacker-influenced content survive sanitization when it is placed inside an <iframe srcdoc="..."> value: the sanitizer escapes markup and neutralizes on* handlers using character references, but the browser re-decodes that value and parses it as a same-origin nested document, so the injected markup executes script. Applications are exposed only in a specific configuration - escapeParameter (escapeParameterHtml in the Legacy API) enabled, translations rendered as HTML (for example with v-html), and untrusted data reaching an srcdoc value via a parameter, untrusted/stored message content, or unescaped named values passed alongside a list (GHSA-8rc2-428q-7ww3) - while rendering through <i18n-t> is not affected. Affected ranges are vue-i18n 11.1.10 through 11.4.13 and 12.0.0-alpha.4, with unsupported 9.14.5 and 10.0.8 also vulnerable and left unfixed; the vendor advisory includes a public PoC snippet illustrating the bypass, which is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing).
Prototype pollution in the Highcharts JS charting library (6.1.0 up to 11.4.9, 12.0.0 up to 12.6.1, and 13.0.0 through 13.0.2) lets an attacker who controls a chart's series.keys array and the matching per-point data write arbitrary named properties onto Object.prototype using dot-separated paths such as '__proto__.polluted' or 'constructor.prototype.alsoPolluted'. No user interaction is required beyond rendering the chart, and because the injected properties are visible to all JavaScript on the page rather than only to the chart - reflected as scope-changed (S:C) in both the vendor CVSS 4.0 vector and the independently assessed CVSS 3.1 vector - concrete harm depends on what other page code later reads. Exploitation is contextual: series.keys is normally a static developer-defined configuration, so only applications that route untrusted input into both keys and point data are exposed, and the advisory links a live JSFiddle demonstration of the pollution (a public PoC reference exists; it is not verified as working exploit code). There is no CISA KEV entry and no confirmed active exploitation; the vuln.today decision label is 'this_week', a moderate context-dependent priority rather than an emergency.
Prototype pollution in Highcharts JS 13.0.0 through 13.0.2 lets attacker-controlled series point data write integer-keyed properties onto Object.prototype and the Object constructor, which then surface in out-of-range index reads and for...in enumeration of every object on the page. No user interaction is required beyond rendering a chart built from those point objects, and the injected properties persist after the chart is constructed; the practical consequence runs from broken rendering to whatever the consuming application does with attacker-supplied inherited values. The issue is fixed in 13.1.0, is not listed in CISA KEV, and no working exploit code is confirmed - the vendor advisory does publish a live JSFiddle demo for testing, and the current priority label is this_week rather than an emergency call.
Client-side cross-site scripting in Highcharts 12.0.0 through <12.6.1 and 13.0.0 through 13.0.2 - including the Stock, Maps and Gantt products shipped in the same package - lets markup placed in HTML-rendered text options execute event handlers in the origin of the page hosting the chart when that page re-renders the chart from a Chromium beforeprint handler and printing is started. All four of those conditions must hold together, so exposure is confined to pages that route untrusted data into useHTML titles, axis labels, data labels or responsive text; the issue is rated high (CVSS 4.0 base 7.2; assessed CVSS 3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) rather than critical. No public exploit is identified at time of analysis, and vendor-released fixes 12.6.1 and 13.1.0 are available.
SVG anchors whose xlink:href carries a javascript: URL slip past the markup filter that Highcharts applies to href and src, so a chart text option such as the title can retain an active script link in its serialized form. The bug affects npm package highcharts from 10.3.2 through the 11.x, 12.x and 13.x branches prior to 11.4.9, 12.6.2 and 13.1.1 respectively, and only becomes dangerous when the chart is exported (the default SVG download declares the XLink namespace) or its container markup is serialized and then re-parsed as a document, at which point a user click runs script in that document's origin - the live rendered page itself does not produce a clickable link. Exploitation therefore needs attacker-controlled data in the chart configuration, an export/re-inline step, and user interaction (CVSS:4.0 PR:L/UI:A, and the assessor's CVSS:3.1 AC:H/PR:L/UI:R with scope change); no public exploit code or in-the-wild activity was identified at time of analysis, and the priority label is this_week rather than emergency.
PHP object injection via unsafe deserialization affects the WordPress/WooCommerce plugin Filter Everything through version 1.9.7, allowing an attacker with administrator-level privileges (CVSS PR:H) to deserialize untrusted data and potentially achieve high impact on confidentiality, integrity and availability. The flaw is network-reachable with low attack complexity and no user interaction, but meaningful exploitation depends on a usable POP gadget chain being present in the loaded code base, which the available sources do not confirm. No public exploit code or CISA KEV entry is identified at time of analysis; the vulnerability was reported by Patchstack and the affected parameter or feature that triggers deserialization is not described in the available sources.
PHP object injection in weDevs Dokan (dokan-lite) through 5.3.1 lets a high-privilege authenticated WordPress user trigger deserialization of untrusted data over the network without user interaction, potentially affecting confidentiality, integrity, and availability (CVSS 7.2). The vulnerable endpoint or parameter is not described in the available sources, and practical impact depends on a usable PHP object-injection gadget chain that the evidence does not enumerate. No public exploit identified at time of analysis; vuln.today priority is this_week.
PHP object injection (CWE-502) in the PickPlugins Accordion WordPress plugin through version 2.3.25 lets an administrator-level user on a vulnerable site deserialize untrusted data, potentially achieving object injection that leads to code or data compromise. The flaw is rated 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and PR:H means exploitation requires an authenticated high-privilege account; the vendor reference from Patchstack identifies the issue as a PHP object injection vulnerability in the plugin. Realistic impact additionally depends on a usable PHP POP gadget chain being present in the plugin, WordPress core, or another installed component; there is no CISA KEV entry and no confirmed public exploit code, and the exact parameter or feature reaching the deserialization sink is not described in the available sources.
OS command injection in Dell PowerProtect Data Domain (Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20) allows a remote attacker who already holds high administrative privileges to execute arbitrary OS commands on the appliance, with high confidentiality, integrity and availability impact. The CVSS vector confirms PR:H, so unauthenticated or low-privileged users cannot reach the flaw; there is no CISA KEV entry and no public exploit identified at time of analysis. Dell has released fixed versions (8.9.0.0, 7.13.1.90, 8.3.1.50, 8.6.1.30) and the issue is prioritized for remediation this week, but it remains a conditional-risk issue rather than a drop-everything emergency.
OS command injection in Dell PowerProtect Data Domain allows a high-privileged remote attacker to execute arbitrary operating system commands on the appliance. The flaw affects Feature Release versions 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20, across the unified CPE cpe:2.3:a:dell:powerprotect_data_domain. Exploitation requires pre-existing administrative access (PR:H per the CVSS vector), so the realistic threat is from insiders or attackers who have already compromised admin credentials; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a security advisory (DSA-2026-416).
OS command injection in Dell PowerProtect Data Domain lets a remote attacker who already holds high (administrative) privileges on the appliance execute arbitrary operating system commands, with high impact on confidentiality, integrity and availability of the backup infrastructure. The affected set is bounded to Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; no public exploit was identified at time of analysis, and the mandatory PR:H prerequisite (unauthenticated access is not sufficient) narrows the realistic attacker set to credentialed administrators, compromised admin accounts and insiders. Dell rates the issue 7.2 with an AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H vector, matching an independent assessment that treats it as a moderate-severity, high-barrier problem rather than an urgent widespread threat, with remediation tracked for this week.
rtl_433 through 25.12 contains a stack-based buffer overflow in its Proflame 2 OOK decoder: more than seven valid Manchester-coded words are written past a fixed 7-byte stack buffer. A nearby unauthenticated attacker can deliver the trigger over RF or supply a crafted signal file, causing a crash on all vulnerable builds and potentially control-flow hijacking on builds compiled without stack canaries. The risk is moderate because exploitation requires the Proflame 2 decoder to be active plus RF adjacency or local crafted-file delivery; no public exploit has been identified at time of analysis.
Reflected cross-site scripting in the Persian WooCommerce SMS WordPress plugin (versions 7.2.0 up to, but not including, 7.3.2) lets an unauthenticated attacker reflect an unsanitised parameter into an HTML attribute, so script runs in the browser session of a logged-in privileged user who is tricked into submitting a crafted cross-site request. The attacker does not need credentials (PR:N), but successful exploitation depends on social-engineering a high-privilege account such as a WordPress administrator into triggering the request (UI:R), which is why the practical risk is moderate rather than urgent. A vendor fix is available in 7.3.2, EPSS is low at 0.17% (6th percentile), and no public exploit has been identified at time of analysis; the issue is not reported as confirmed actively exploited (CISA KEV).
AXIS Camera Station Pro and Camera Station 5 weakly encrypt database backups (CWE-326), so an attacker who obtains a backup file can attack it offline and recover the credentials stored inside. The exposure covers backups created before the fix and the extra recovery backup that Camera Station automatically creates when the update is applied; the CVSS 7.1 vector (AV:L/PR:L, UI:N) means local access to the backup artifacts and low privileges are required, not remote reachability. No public exploit code or confirmed active exploitation was identified at time of analysis, and updating alone does not remove already-exposed backups.
OS command injection in CherryTree through 1.7.2 lets an attacker run arbitrary commands with the victim's privileges when the victim opens a crafted document and clicks a web link containing unquoted shell metacharacters such as $(...), backticks, or semicolons. The vulnerable path is only reached when the non-default 'Custom Web Link Clicked Action' option is enabled and the link is handed to std::system via CtActions::link_clicked; with the default configuration that code path is not taken. Exploitation is therefore condition-gated and depends on victim interaction rather than remote or automatic attack, and no public exploit was identified at time of analysis.
Prototype pollution in n8n allows an authenticated low-privileged user who can create and save workflows to corrupt built-in JavaScript object behaviour, which then causes logins and writes to fail with server errors across the instance. The flaw lives in the routine that diffs workflow connection sets: a connections key named with a reserved property such as __proto__, constructor, or prototype is used directly as an object member, and the periodic workflow-history compaction task later processes it, polluting the process-wide object prototype. Instances running n8n before 2.41.4 or 2.42.x before 2.42.1 are affected, workflow history is enabled by default, and no public exploit code was identified at time of analysis.
An authenticated n8n member who can create and run workflows can freeze the entire instance by supplying a wildcard-heavy File(s) Selector glob pattern to the Read/Write Files from Disk node, which compiles to a catastrophically backtracking regular expression and blocks the Node.js event loop with no time limit. The result is a denial of service in which the UI, API, webhooks and health checks stop responding until the process is restarted; there is no data disclosure or modification. Affected are n8n releases before 1.123.85, before 2.43.5 and before 2.44.1, and exploitation requires a valid member-level account with workflow create/execute rights plus the readWriteFile node being enabled. No public exploit code has been identified at time of analysis, and the vendor has released fixed versions.
Integer underflow in Juniper Networks Session Smart Router's DhcpMessageDecoder allows an attacker on the adjacent network to cause information disclosure and denial of service by sending a malicious DHCP reply. The issue affects Session Smart Router deployments where the router processes DHCP replies as a client or relay on an attacker-reachable Layer 2 segment; the CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, so no authentication or user interaction is required but exploitation is confined to local-segment presence. No public exploit code or active exploitation is identified in the provided data, and the priority label is this_week.
Broken object-level authorization in Xibo CMS 4.4.2 and earlier allows a logged-in user to point PUT and DELETE requests at /action/{id} and modify or delete Layout actions attached to any Layout in the CMS, not just their own. The CVSS vector confirms the attacker must be authenticated (PR:L) but needs no user interaction; the vendor notes the only required privilege - permission to edit, including delete, all created Layouts - is granted to non-administrators as standard, so ordinary accounts typically qualify. Integrity impact is high with a limited availability impact, confidentiality is unaffected, and there is no public exploit code identified at time of analysis; the vendor has released 4.4.3 and this is scheduled as this-week remediation rather than an emergency.
Missing authorization in NORA Registry (nora-registry) 0.9.4 and earlier lets any valid read-scoped bearer token enumerate token metadata - ID, owner, role, description, expiry and last-use - for every user through the globally scoped token-management list endpoint, while a write-scoped bearer token or write-capable OIDC workload identity can additionally revoke arbitrary admin and service tokens by ID, disrupting the registry and forcing credential recovery. The flaw is CWE-862: auth_middleware() authenticates /ui/tokens and /api/ui/tokens but only checks role.can_write() instead of role.can_admin(), so the handlers operate across all accounts. No CISA KEV entry or confirmed active exploitation was reported; the vendor advisory includes reproduction steps (a PoC reference) rather than verified working exploit code, and exploitation requires auth to be enabled, the token endpoints to be network-reachable, and the attacker to already hold a valid registry credential.
Stored cross-site scripting in the SliceWP WordPress plugin through 1.2.13 lets an attacker who can persist input through a SliceWP field have script run in a victim's browser when the affected page is later viewed. The victim must load the crafted page (UI:R), and exploitation depends on the plugin being installed and active; the specific form or endpoint carrying the injectable input is not described in the available sources. The reporter scored the issue 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), but an independent assessment treats the unauthenticated claim as unverified and scopes out availability impact; no public exploit was identified at time of analysis.
Reflected cross-site scripting in the WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) through version 2.0.24 lets remote attackers supply crafted input that the plugin reflects into a generated page without proper neutralization, so that script supplied by the attacker executes in the browser of a victim who follows a crafted request or URL. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows no authentication is needed but successful exploitation depends on the victim interacting with the crafted request, making social engineering the practical limiting factor rather than silent remote compromise. No public exploit code and no confirmed active exploitation are recorded in the available sources, and the specific parameter or page that reflects the input is not described in the available sources.
Reflected cross-site scripting (CWE-79) in the impleCode eCommerce Product Catalog WordPress plugin through version 3.6.4 allows a remote, unauthenticated attacker to run script in a victim's browser by persuading the victim to open a crafted URL that reflects an unsanitized input. Exploitation is constrained by the required victim interaction (UI:R) and the fact that the payload is not stored, so each target has to be lured individually; no public exploit code or proof-of-concept is referenced in the available intelligence, and the case is queued for handling this week under the vuln.today priority. No vendor-released fixed version is identified in the supplied data, and the advisory of record is the Patchstack database entry.