Authenticated database tuning users in ArcadeDB 26.8.1 through 26.10.1 can disable the OpenCypher LOAD CSV server-side request forgery guard and then make the ArcadeDB server fetch arbitrary internal HTTP resources on their behalf. Because the SSRF block list (arcadedb.opencypher.loadCsv.blockedIpRanges) is a database-scoped setting changeable via ALTER DATABASE under the updateDatabaseSettings permission, an attacker who holds that permission but not updateSecurity or root can set it to an empty string, after which LOAD CSV returns the body of loopback, RFC 1918 and link-local targets such as cloud metadata at 169.254.169.254 as query rows. The exposure is read-only and requires that privilege split to exist in practice; the advisory publishes a reproducible proof-of-concept walkthrough using curl against POST /api/v1/command/{database}, but no active exploitation has been reported and no CISA KEV entry applies. EPSS data was not supplied; the vuln.today decision label is this_week, reflecting a genuine but bounded risk rather than an emergency.
SQL injection in Dell OpenManage Enterprise versions prior to 4.8.0 allows an authenticated, low-privileged remote user to influence SQL queries and access confidential data; the assessed impact is high confidentiality loss with no integrity or availability impact. No public exploit code or active exploitation is identified in the supplied intelligence, and Dell has released the fix in version 4.8.0 or later. The vulnerability is tracked with a this_week priority label.
Path traversal in Moodle's Blackboard question-import format lets an authenticated Teacher-level user copy arbitrary files readable by the web server - notably config.php, which holds database credentials and the site salt - into their own draft file area. Affected releases are 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11 and 4.5.x through 4.5.15; scoring is CVSS 4.0 7.1 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), a confidentiality-only impact gated behind existing question-import or lesson-edit rights. There is no CISA KEV listing and no confirmed working exploit code; a public Abraxas Labs research writeup describes the flaw, and the issue is prioritized for remediation this week.
Jellyfin through 12.4 allows any authenticated non-administrator to bypass library and parental-control restrictions through SuggestionsController.GetSuggestions when the userId parameter is omitted. An attacker can repeatedly call GET /Items/Suggestions without userId to enumerate restricted item IDs and server filesystem paths, then stream the restricted media; the CVSS 4.0 vector confirms network access, low privileges (PR:L), no user interaction, and high confidentiality impact with no integrity or availability impact. A public research write-up is referenced, but working exploit code is not verified in the provided data; no CISA KEV entry is provided, and the vuln.today decision label is this_week.
Jellyfin through 12.4 allows an authenticated low-privilege user to bypass SvgSecurityValidator by uploading a profile image that hides gzip-compressed SVG inside a non-SVG image data URI, then trigger server-side rendering through unauthenticated GET /UserImage requests. The Svg.Skia rasterizer resolves external <image xlink:href> references, enabling SSRF to internal URLs, disclosure of local files that decode as images, and repeatable memory exhaustion because the stored SVG is re-rasterized on every request. CVSS 4.0 scores this 7.1 with high availability impact; no KEV listing or confirmed public exploit code is present in the supplied data.
Element Web and Element Desktop 1.12.31 and earlier will silently log out a logged-in user who opens a link whose URL fragment carries both guest_user_id and guest_access_token, because loadSession adopted those attacker-supplied guest credentials and cleared local stores. The practical consequence is loss of unbacked end-to-end encryption keys and, where no secure backup exists, of the user's digital identity; users with secure backup enabled can recover keys, reducing the outcome to a forced logout. Exploitation requires the victim to already be signed in and to click a crafted link - there is no zero-click path - and version 1.12.32 fixes it; no public exploit code has been confirmed, though the advisory and a research write-up describe the mechanism.
Authenticated path traversal in SABnzbd before 5.1.0Beta3 lets a holder of a valid API key delete files and directories writable by the SABnzbd process, including its configuration, queue database, and downloads. The orphan-job status handlers pass the user-controlled value parameter into os.path.join() with download_dir, so an absolute path overrides the base and reaches recursive deletion through shutil.rmtree(); the advisory also flags _api_add_orphan and _api_delete_all_orphan for the same validation gap. No CISA KEV entry confirms active exploitation, and the vendor advisory includes a public curl-based PoC reference that was not independently verified as working exploit code; the issue is fixed in 5.1.0Beta3.
Path traversal in the GNU C Library gettext implementation lets an attacker who can set the LANGUAGE environment variable make any gettext-using program load an attacker-supplied .mo message catalog from an arbitrary filesystem location, even though the earlier CVE-2014-0475 fix blocked '..' components in the locale variables. A crafted catalog can crash the target through out-of-range offsets or supply translations whose printf format directives do not match the program's arguments, producing undefined behaviour that may escalate to code execution with the program's privileges. Exploitation is conditional: the program must not be running AT_SECURE (setuid/setgid, which rejects such LANGUAGE entries), the environment must cross a trust boundary (the description's example is an SSH server with AcceptEnv accepting LANGUAGE and LANG for an account limited to a forced command), a non-C/POSIX LC_MESSAGES locale must also be selectable, and the crafted .mo file must be readable by the target. The vendor advisory GLIBC-SA-2026-0025 is published, the assigned CVSS is 7.0 with AV:L/AC:H/PR:L, and no public exploit code has been identified at time of analysis; the priority signal is to address this within the current week rather than as an emergency.
Credential leakage in pgAdmin 4 before 9.19 allows one authenticated user of a server-mode deployment to connect to a PostgreSQL server using another user's saved password, because the server manager wrote passwords into pgAdmin's own shared process environment (PGPASSWORD and a per-process utility variable) and never removed them. Only multi-user web deployments are exposed: pgAdmin's environment is shared by every user's requests and copied into every process it starts, so a later PSQL session or background utility started on behalf of a different user inherits the value, and libpq silently applies PGPASSWORD to any connection made without a password of its own. Exploitation is opportunistic rather than attacker-controlled - it requires a victim to have triggered a password-bearing process earlier and the value to still be resident, and the attacker gains only the database access the victim's credentials grant; no public exploit code was identified at time of analysis and there is no CISA KEV entry.
Argument injection in Zuke's @zuke/core package (all versions before 1.51.0) on Windows lets attacker-influenced text passed to a resolved node_modules/.bin .cmd or .bat shim escape the argument boundary and be executed by cmd.exe as an additional attacker-chosen command, running in the build's own context with access to whatever credentials that build holds. Only Windows builds that resolve a batch shim and interpolate untrusted text - a branch name, a filename, or a parameter taken from repository content - into a wrapper argument are on the affected path; POSIX platforms were never affected and the CVSS vector records local attack, high attack complexity, no privileges required and user interaction required. The issue is fixed in 1.51.0, and no public exploit code was identified at time of analysis; the advisory notes the flawed launch path was the primary route for every wrapper resolving its tool from node_modules on Windows, not a rarely-taken fallback.
mTLS client authentication can be silently bypassed in Traefik 3.7.0-ea.1 through 3.7.14 when the Kubernetes Ingress NGINX provider is used and a second Ingress on the same host declares a path without matching auth-tls-secret settings. With core.strictTLSOptions disabled, Traefik falls back to default TLS options that do not request a client certificate, allowing unauthenticated remote attackers to reach backends intended to require mTLS. No public exploit identified at time of analysis; exploitation requires the non-default multi-Ingress same-host configuration collision described by the vendor.
Unauthenticated denial of service in Elixir's standard-library JSON module: JSON.decode/1, JSON.decode!/1 and JSON.decode/3 accept integer literals of unbounded length and pass them unchanged to erlang:binary_to_integer/1, so a single large numeric run consumes roughly 100 to 300 times the CPU of a string literal of the same size. Because phx.new-generated applications configure JSON as the Phoenix json_library and pass it to Plug.Parsers - which decodes bodies of up to 8 MB before routing and authentication - a multi-megabyte request body can tie up a scheduler for about a second per call and allocate large bignums; sustained traffic degrades availability. Note the assigned CVSS 4.0 score of 6.9 reflects low availability-only impact, and there is no indication of exploit code or active exploitation; the fix is shipped in 1.18.6, 1.19.7 and 1.20.5.
HTTP request smuggling in OpenWrt's uhttpd affects unpatched repository snapshots that predate the upstream fixes, allowing an unauthenticated remote attacker who controls raw request framing over a keep-alive connection to send a mixed-case Transfer-Encoding token such as 'Chunked' and have the chunked POST body left unread, so leftover bytes are parsed as a follow-on request. The result is boundary desynchronization with integrity impact rather than direct confidentiality or availability loss; default deployments that accept POST bodies over persistent connections are in scope. No CISA KEV listing or confirmed working exploit code is identified in the supplied data, although the upstream advisory includes reproduction steps; the supplied CVSS 4.0 score is 6.9 and the assessed CVSS 3.1 base is 5.3, aligning with a this-month priority.
HTTP request smuggling in OpenWrt's uhttpd allows a remote attacker to desynchronize request boundaries on a keep-alive connection by delivering the JSON body of a POST /ubus across multiple TCP segments, so the unread body suffix is parsed as a brand-new request and the server emits two responses for one exchange (a JSON-RPC parse error followed by the smuggled request's response). The defect is in the application-layer body handler uh_ubus_data_send() in ubus.c and affects unpatched repository snapshots; the /ubus endpoint is enabled in the default OpenWrt configuration, and the impact matters most where uhttpd is deployed behind a reverse proxy or CDN that reuses backend connections. Reported severity is CVSS 4.0 6.9 (the independent assessment uses CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N, integrity-only with a scope change), the reporter described a Python PoC script but it is not verified as working, generally available exploit code, there is no CISA KEV entry, and the issue is fixed in upstream repository commits rather than a confirmed tagged release.
OpenVM's OpenVmHalo2Verifier Solidity wrapper accepts non-canonical app commitments: verify() takes appExeCommit and appVmCommit as raw bytes32 without rejecting values greater than or equal to the BN254 scalar field modulus (0x30644e72...f0000001), so the byte-level input a caller supplies can differ from the field element the verifier arithmetic actually consumes. Applications built on the wrapper - OpenVM SDK releases before 1.7.0 in the 1.x line, plus the 2.0 and 2.1 prereleases before 2.0.0-rc.3 and 2.1.0-preview - can therefore accept ambiguous commitments if their own logic assumes a one-to-one mapping between the supplied bytes and the verified elements. This is a moderate input-validation issue (CWE-20) that does not forge or bypass the underlying Halo2 proof check; no public exploit has been identified at time of analysis, and the network-reachable path is unauthenticated per the CVSS vector (PR:N).
The Rust snark-verifier library before 0.2.5 accepts non-canonical KZG accumulator limb encodings at the verifier boundary, and its native verifier path can be panicked by malformed accumulator public inputs rather than returning a verification error. Deployments are only exposed where accumulator limbs are not already constrained in-circuit before the verifier boundary: the vendor states standard SDK aggregation circuits do so, which is the primary limit on practical exploitability. No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is fixed in version 0.2.5.
The Halo 2 aggregation loader in axiom-crypto's snark-verifier (versions prior to 0.2.5) can mishandle prover-supplied proof points that are encoded as the point at infinity, allowing an unauthenticated attacker acting as a prover to inject an identity element into the multi-scalar multiplication or accumulator computation through the scalar-one shortcut. The flaw is a soundness gap rather than a demonstrated forgery primitive: whether a mishandled identity element actually corrupts the aggregated result or causes an invalid proof to be accepted depends on the surrounding aggregation and final-decider checks, and the advisory does not establish universal acceptance of invalid proofs. Version 0.2.5 resolves the issue by moving to halo2-lib v0.5.3, where EccChip::sum treats encoded identity inputs as no-ops; no public exploit code has been identified at time of analysis, and the vendor rates the issue medium severity.
Denial of service in Cloud Foundry UAA's private_key_jwt client-authentication path lets an attacker force repeated deserialization of a large cached remote JWKS object, driving excessive CPU consumption and eventual Java heap exhaustion (OutOfMemoryError) that makes the identity server unavailable. The CVSS 4.0 score is 6.9 and the impact is availability-only - no confidentiality or integrity loss - but the vector is PR:H because the attacker must first obtain write access to client configuration (to point a jwks_uri at an oversized payload) or control an already-trusted JWKS endpoint; once that condition is staged, the triggering requests are anonymous and need no interaction. Affected are UAA deployments that use private_key_jwt with a remote jwks_uri that UAA fetches and caches; no public exploit has been identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated organization provisioning through the GraphQL Mutation.createOrg operation in ROOST Coop releases before 1.0.0 lets any remote actor who can reach a publicly exposed instance create arbitrary organization records and, with no rate limiting on the operation, generate log noise or drive database resource exhaustion. No credentials or user interaction are needed (PR:N/UI:N in the assessed vector), and impact stays bounded at low integrity and low availability with no confidentiality loss; the vendor's decisive limiting factor is network placement, since running Coop on an authenticated private network prevents outside actors from querying the GraphQL API at all. The issue is not in CISA KEV and no active exploitation is confirmed, a public PoC reference (a sample GraphQL mutation) exists in the advisory but is not verified as working exploit code, and the flaw is fixed in version 1.0.0.
Out-of-bounds heap reads in Blender's .blend file loader let a crafted file crash the application or leak process memory, affecting releases before 4.5.15 and 5.x before 5.2.3. The weakness sits in the blo_bhead_id_* accessors in readfile.cc, which consume ID block fields without first checking that the block is long enough; a .blend file containing deliberately short ID blocks triggers the over-read when a victim browses or appends data from it. No authentication or elevated privileges are required (PR:N), but exploitation is local and file-based (AV:L) and requires the user to open or append from a malicious asset (UI:P), so realistic exposure is social engineering or supply-chain distribution of .blend content rather than remote attack; no public exploit code or KEV listing was identified at time of analysis, and this is a moderate-priority issue rather than an emergency, with vendor patches available.
Heap out-of-bounds reads in Scribus before 1.6.7 let a crafted Mac PICT/PCT image trigger a crash or leak bounded amounts of heap memory when the file is opened, placed on a document, or imported. Exploitation requires the victim to open or import a malicious image (CVSS 4.0 UI:P, AV:L), and because the condition is read-only, the realistic outcomes are denial of service and limited information disclosure rather than code execution. No public exploit code has been identified at time of analysis; a vendor fix is available in Scribus 1.6.7 via commit d667b3b1d38e1808721315dc976d67b72070f6b4.
Double free and use-after-free in the Tesseract OCR PAGE XML renderer (5.4.0 through 5.5.3) leaves the caller-owned right-to-left line-polygon accumulator (line_top_rtl_pts / line_bottom_rtl_pts) dangling, so a page containing Hebrew or Arabic words makes the renderer free the same heap object once per recognised RTL word and then join stale coordinates into the live line polygon. The bug fires deterministically under AddressSanitizer with the shipped defaults (page_xml_polygon=true, page_xml_level=0; one 1000x220 Hebrew page yields 19 sanitizer errors), and the corrupted extremes have been observed to reach RecalcPolygonline, producing a 250 MB allocation followed by an out-of-bounds read. On glibc release builds the same code executed cleanly for fifty runs, so observable impact depends on allocator behaviour and on concurrent allocation in a long-running multi-threaded OCR service; there is no KEV listing and no confirmed active exploitation, and the upstream advisory's sanitizer reproduction recipe is a public PoC reference that is not verified as working exploit code. Fixed in 5.5.4.
Heap out-of-bounds write in AFFLIB through 3.7.22 during page reads: when a crafted AFF (Advanced Forensic Format) image declares a page size that is larger than and not an integer multiple of its sector size, the sector zero-fill loop in af_get_page() writes past the allocated heap buffer. The issue is local and requires a user or operator to open or ingest the untrusted image (UI:P), and the assessed impact is no confidentiality loss, limited integrity damage and high availability impact, meaning the practical outcome is a corrupted heap and crash of the forensic tool. A public technical write-up of the flaw exists but is not verified as working exploit code, and there is no CISA KEV entry; the vendor priority is 'this_month' rather than an emergency.
Unauthenticated visitors to NodeBB 1.18.0 through 4.16.5 can supply a victim's uid during POST /register and then submit an empty email at /register/complete to clear that account's email and confirmation state and revoke all of its sessions. The bypass is limited to accounts that lack a local password, such as SSO-created passwordless accounts, or to cases where the attacker knows the account password; password-protected accounts are not clearable without it. No KEV entry or public exploit was identified at time of analysis, and the vendor has published a fix commit for this CVSS 6.9 issue.
Unauthenticated attackers can read unpublished changelog.com content - draft posts, unsent newsletters and declined news items - by requesting the site's editorial preview actions, which in builds before commit 7b35e829 performed no admin or authorization check. Any remote user can enumerate identifiers (hashid-encoded post IDs, sequential newsletter slugs, plain integer news IDs) against the preview endpoints and retrieve material that was never meant to be public. Rated CVSS 6.9 with confidentiality-only impact (no integrity or availability effect), it is not listed in CISA KEV and no public exploit code has been identified at time of analysis, though a public researcher writeup describing the enumeration approach exists; the vuln.today decision label is monitor, so this is a genuine but low-to-moderate disclosure issue rather than an emergency. No EPSS score was supplied in the available intelligence.
Unauthenticated shortcode injection in the My Calendar WordPress plugin 3.8.8 through 3.8.10 allows remote attackers to make the plugin render shortcodes already registered on the site by supplying bracketed content through the 'mcs' search parameter, enabling content injection and spoofing on pages or posts. The vendor addressed it in 3.8.11 by HTML-encoding brackets before do_shortcode() runs, and no public exploit was identified at time of analysis. Because only existing shortcodes can be triggered and there is no server-side code execution, data exfiltration or availability impact, this is a moderate-priority issue rather than a top-tier emergency.
Rate limiting in PipesHub 0.1.0 through 0.9.1 can be evaded entirely by any unauthenticated remote client, because the limiter derives its bucket key from the client-supplied X-Forwarded-For or X-Real-IP header rather than the real socket address. Rotating that header on each request yields a fresh counter every time, so the global limiter that is the only protection on /authenticate, /login/otp/generate and /password/forgot never engages, enabling password spraying, OTP guessing and password-reset email flooding against arbitrary addresses. The bypass itself only removes throttling, with integrity-only impact (CVSS 3.1 C:N/I:L/A:N); conversion into account takeover still depends on guessing a valid password or six-digit OTP, and email-bombing impact depends on the reset endpoint accepting arbitrary addresses. Fixed in 0.10.0; the vendor advisory includes an executed proof of concept showing 0 of 90 header-rotating requests throttled, and no confirmed active exploitation (CISA KEV) has been reported.
Grimoire versions before 1.0.0 expose an unauthenticated SSRF in the /api/fetch-metadata POST handler, which passes attacker-supplied URLs into getMetadata() without any authentication check. Remote attackers who can reach a Grimoire instance can point it at loopback addresses, internal network hosts, or cloud metadata endpoints and read back the parsed title, description, and page content. Impact is limited to read-only information disclosure (CVSS 4.0: 6.9, VC:L); a public PoC reference exists but it is not verified as working exploit code, and there is no KEV confirmation of active exploitation. The vuln.today priority label places it in this_month: moderate, not emergency.
Unauthenticated POST requests to /api/notify in SerpBear earlier than 3.1.1 bypass the application's verifyUser() authentication check and let any remote party trigger the instance's notification-email pipeline, optionally targeting a specific domain parameter. Repeated requests can exhaust SMTP sending quotas, trip email-provider abuse flags, and flood notification recipients; impact is limited to availability and mail abuse, with no data disclosure or modification. Meaningful impact requires the instance to have working SMTP/notification settings configured and the API to be network-reachable; no public exploit code was identified at time of analysis, and the issue is rated moderate priority rather than an emergency, with a vendor fix released in 3.1.1.
Unauthenticated callers can create comments on WordPress content they are not allowed to see through the createComment GraphQL mutation in WPGraphQL 2.24.0 and earlier, because the mutation validated only that the target post existed and had comments open, not that the caller could read it. On sites configured to allow guest comments, an attacker who supplies or enumerates a post ID can attach comments to draft, pending, private, trashed or password-protected posts, and each new comment fires wp_notify_moderator(), whose subject line contains the post title - so hidden titles are emailed off the site. The same mutation also returns distinguishable error messages for non-existent, hidden and comment-closed IDs (enabling post ID enumeration) and let any caller set a comment's date and type, permitting backdated comments and comments filed as pingbacks or trackbacks; no public exploit code or CISA KEV entry was identified at time of analysis, and the case is assessed as a moderate-priority information-disclosure and integrity issue rather than a code-execution threat. Sites that require registration or login before commenting block unauthenticated exploitation of the write path, and the vendor's only complete fix is upgrading to 2.24.1.
Unauthenticated email flooding in WPGraphQL 2.24.0 and earlier lets a remote attacker send roughly a thousand password reset emails from a single HTTP request by aliasing the sendPasswordResetEmail mutation until the site's transactional mail quota is exhausted and legitimate password recovery is blocked. The plugin's batch limit of 10 counts entries in a batched request array, not aliased field invocations inside one operation, so it never applies, and the two vectors multiply: 10 batched operations carrying 200 aliases each yield about 2000 emails from one POST. Because get_password_reset_key() overwrites the previous key on every call, repeated sends also invalidate each reset link before the account holder can use it; no data is exposed or modified, so impact is confined to availability (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). There is no CISA KEV listing and no public exploit identified at time of analysis; the vendor patch is 2.24.1, and the priority decision is this_month.
WPGraphQL 2.24.0 and earlier leak object existence through four GraphQL write mutations - deleteMediaItem, updateMediaItem, deleteComment and updateComment - because each resolved the target object and validated its type before checking whether the caller was permitted to act at all, so every failure mode returned a distinguishable error. Remote unauthenticated attackers can walk the ID space with these mutations to learn whether drafts, pending, scheduled, private and trashed posts, any custom post type, or unapproved comments exist, and to harvest their IDs, although no post or comment content is ever returned and nothing is written. Vendor-released patch: 2.24.2; no public exploit identified at time of analysis, and vuln.today prioritises this as a this_month remediation rather than an emergency, consistent with a moderate-priority disclosure (CVSS 6.9, CWE-204 observable response discrepancy).
Unbounded automatic persisted-query storage in WPGraphQL Smart Cache 2.3.2 and earlier lets unauthenticated remote attackers inflate the WordPress wp_posts table by sending an endless stream of distinct query documents through the Automatic Persisted Query handler, degrading database queries and pushing managed-host storage toward hard caps. The write path is open to anyone who can reach the GraphQL endpoint, batched operations register one document per operation (the reporter measured roughly 100 documents in 1.6 seconds from a single thread), and default installs never reclaim them because garbage collection is opt-in, off by default, and prunes by age rather than by count. No data is exposed and nothing executes that the caller could not already run; the vendor fix in 2.3.3 caps automatic documents at 5000 by default, and no public exploit identified at time of analysis.
reCAPTCHA protection in the Kirki plugin for WordPress before 6.2.5 can be bypassed by unauthenticated remote attackers, who submit the plugin's frontend forms without solving a challenge simply by omitting the g-recaptcha-token field from the POST request. The verify() method returns early when the token is empty, so form submissions are accepted without verification, allowing repeated submissions that fire notification emails and webhooks and cause unbounded writes to the submissions database table. Sites are only exposed if they run an affected Kirki version and have a frontend form configured with reCAPTCHA; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated blind server-side request forgery in Forgejo (through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1) lets anyone who can reach the instance POST a crafted OpenID identifier to /user/login/openid and force the server to issue discovery GET requests against loopback, cloud metadata and internal addresses for port scanning and probing. Exposure depends entirely on the OpenID sign-in feature being enabled, which is not the default; where it is enabled no credentials or user interaction are required. The impact is limited to low confidentiality because the requests are blind and responses are not returned to the attacker - the flaw is not in CISA KEV, so no confirmed active exploitation has been reported, although the upstream advisory publishes a proof-of-concept reproduction script.
Unauthenticated CRLF injection in OPNsense's WebGUI login form lets a remote attacker forge syslog lines that the always-on lockout_handler parses as genuine authentication failures, causing attacker-chosen IP addresses to be added to the sshlockout pf table and their active pf states to be killed - disrupting management access, DNS, WAN or monitoring connectivity. A second variant injects forged 'Accepted' entries to reset the brute-force counter for an attacking host, enabling continued password guessing. The flaw affects OPNsense core before 26.7.8 (with backported fixes on the 26.1 and 26.4 branches), is reachable against a default install with only HTTP access to /index.php plus a CSRF token, and is scored 6.9 under CVSS 4.0 by the vendor (our assessment: CVSS 3.1 AV:N/AC:L/PR:N/UI:N, availability-only impact). It is not listed in CISA KEV and no active exploitation is confirmed, though the vendor advisory publishes a lab-tested proof-of-concept payload.
Stirling-PDF before 3.0.0 lets remote attackers turn its AI PDF tool into a server-side request forgery and local file disclosure primitive: POST /api/v1/ai/tools/create-pdf-from-html-agent forwards attacker-supplied htmlContent to WeasyPrint without the CustomHtmlSanitizer that protects the /api/v1/convert/html/pdf control path. HTTP/HTTPS references are fetched by the server (reaching internal services or cloud-metadata endpoints) and file:// references pull files readable by the Stirling-PDF process into the generated PDF, which the attacker then extracts. The endpoint answers without credentials under the common default security.enableLogin=false, impact is confidentiality-only (no code execution, integrity or availability effect), exploitation is not confirmed in CISA KEV and a proof-of-concept reproduction is described in the vendor advisory; fixes ship in 3.0.0, making this a real but moderate-urgency issue rather than a drop-everything emergency.
Stack exhaustion in SQLite before 3.54.0 lets an unauthenticated local attacker crash a process that parses attacker-supplied SQL - or that opens an untrusted database file containing a crafted view - by submitting a WITH clause that chains tens of thousands of common table expressions and drives unbounded recursion in selectExpander(). The vector is local (AV:L) with passive user interaction required (UI:P / UI:R), meaning the victim application must accept and process the malicious SQL text or database file, and impact is confined to a process crash (A:H) with no code execution, data disclosure or integrity loss. No confirmed public exploit code has been identified at time of analysis, though a third-party research write-up on SQLite CTE nesting is referenced; the vendor has released SQLite 3.54.0, which now counts CTE expansion against SQLITE_LIMIT_EXPR_DEPTH.
An information disclosure flaw in SQLite before 3.54.0 lets an attacker who supplies a crafted database plus WAL file read uninitialized page-cache memory. When the WAL frame page size is smaller than the database page size, sqlite3WalReadFrame copies fewer bytes than requested without zeroing the remainder, so queries with oversized record payloads (for example substr()) can return stale bytes from other table rows and internal pointers. Exploitation is local and user-driven: the victim must open the attacker-supplied database and WAL pair in an application using WAL journaling and then issue such a query. No public exploit code has been identified at time of analysis, and the issue is rated medium tier with confidentiality-only impact; the vendor-released fix is SQLite 3.54.0.
Denial of service in SQLite's R-Tree extension before 3.54.0 allows an attacker who supplies a crafted database to crash the application process by manipulating the %_node shadow table so sqlite3_last_insert_rowid() returns 0 and nodeWrite() hashes a node with iNode==0 after an R-Tree node split. This is a local, medium-severity, denial-of-service-only issue that requires the victim application to be built with SQLITE_ENABLE_RTREE and to process the malicious database; it has no confidentiality or integrity impact. No public exploit has been identified at time of analysis.
SQLite releases before 3.54.0 fail to enforce SQLITE_LIMIT_EXPR_DEPTH for chained COLLATE postfix operators, so an expression carrying roughly 175,000 COLLATE clauses drives unbounded recursion in sqlite3WalkExprNN() and crashes the process. The flaw is rated 6.8 with local attack vector, no privileges, and passive user interaction; impact is availability-only - no data disclosure or code execution - and exploitation requires the application to parse attacker-controlled SQL text or open an untrusted database/view. An upstream fix commit and the 3.54.0 release address the issue; no public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and EPSS data was not provided.
Stored cross-site scripting in the Firelight Lightbox WordPress plugin before 2.3.23 lets an authenticated user with a role as low as Contributor plant script-bearing content that executes in another user's browser. The plugin does not escape the URL of links it renders in its Classic lightbox before inserting that URL into the page as HTML, so a crafted link URL is stored and later rendered as markup when a victim clicks it. Exploitation therefore requires a low-privileged account on the target site, use of Classic lightbox mode, and a separate victim who clicks the crafted link, which limits both blast radius and urgency: there is no public exploit identified at time of analysis and EPSS is only 0.15% (4th percentile), though the vendor fix in 2.3.23 is available and the issue is scheduled for this-month remediation.
Stored cross-site scripting in the Joinchat WordPress plugin before 6.4.2 lets authenticated users with the Author role or higher plant a script payload in the message field of the plugin's button block, which the plugin then writes unescaped into an HTML attribute on the front end of the post. The payload executes in the browser of any visitor who renders the affected post, including administrators, which is what gives an otherwise low-privilege author account a path to higher-impact actions; successful exploitation still depends on a privileged user actually viewing the crafted post. EPSS is low at 0.15% (4th percentile), CISA SSVC records Exploitation: none and Automatable: no, and no public exploit has been identified at time of analysis, so this is a real but bounded issue rather than an emergency and is scheduled on a this-month cadence.
A use-after-free flaw in SQLite's FTS3/FTS4 snippet() support allows an attacker who can issue full-text queries against an FTS3/FTS4 virtual table to force the process to read freed heap memory and crash, yielding local denial of service rather than code execution or data disclosure of integrity value. All SQLite releases before 3.54.0 are affected, but only builds compiled with FTS3/FTS4 enabled together with the non-default option SQLITE_ENABLE_FTS3_PARENTHESIS carry the vulnerable configuration; the assessed vector (CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:N/C:N/I:N/A:H) requires local access and the ability to run or influence SQL reaching such a table. The vendor shipped a fix in SQLite 3.54.0 (commit e4635c4153), the issue is scored 6.8 Medium under CVSS 4.0, and it is not reported as actively exploited (not in CISA KEV); no working exploit code is confirmed in the available sources, and priority is moderate (this_month).
Opening a crafted .blend file in a vulnerable Blender build causes a heap out-of-bounds read inside read_file_dna() and crashes the application. Blender releases before 4.5.15 and 5.x releases before 5.2.3 are affected; the attacker must get a victim to open a .blend file whose GLOB block is truncated with an unvalidated declared length. The assessed impact is availability only - an application crash with no demonstrated code execution, privilege gain, or data disclosure - so this is a medium-severity issue rather than an emergency; no public exploit was identified at time of analysis.
Denial of service in SQLite before 3.54.0 allows an attacker who can submit SQL or supply a crafted database file to crash the host process by forcing count(*) to be evaluated over a large multi-row VALUES clause. The count-of-view optimization then builds a deeply nested TK_PLUS expression whose recursive destruction in sqlite3ExprDeleteNN() exhausts the C stack. The issue is local under the CVSS 4.0 vector (AV:L, UI:P) and affects availability only; it is not listed in CISA KEV and no public exploit code is identified in the available data at time of analysis.
Cross-site request forgery in AdminNeo before 5.5.1 lets anyone who sees a single CSRF token recover the per-session secret and mint unlimited valid tokens, because each token transmits both the XOR mask and the masked value in the clear as '(rand XOR secret):rand'. The session secret itself is drawn from rand(1, 1e6), roughly 20 bits, so it can also be brute-forced with up to about one million requests, and verification uses loose '==' comparison. Exploitation still requires a logged-in AdminNeo user to be lured into submitting the forged token (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H, base 6.8), and the advisory ships a PoC validated against a live AdminNeo 5.5.0 instance (MySQL 8.0, PHP 8.2); there is no CISA KEV entry and no confirmed active exploitation. With a forged token the attacker can run arbitrary SQL through the victim's session, including dropping tables, exfiltrating data and creating backdoor database users.
Script injection in Dell OpenManage Enterprise versions prior to 4.8.0 lets a high-privileged attacker positioned on an adjacent network inject special elements into output that is later consumed by a downstream component, potentially executing script in that context. The CVSS 3.1 vector (AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 6.8) requires the attacker to already hold high administrative privileges on the appliance and to be reachable over an adjacent network segment, so exposure is effectively confined to insiders or actors who have already compromised the management plane; no public exploit code was identified at time of analysis and there is no CISA KEV entry. Upgrade to 4.8.0 or later to remove the exposure.
Forgejo's restore-repo CLI can be induced to read files outside the dump directory - including repository configuration such as app.ini - and import them as release attachments when an administrator restores a crafted dump. The flaw affects Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1; exploitation requires local operation of restore-repo and administrator interaction (CVSS 4.0 6.8, confidentiality impact only). Vendor patch availability is reported; the supplied data does not confirm active exploitation or working public exploit code, and a public research write-up is referenced.
Arbitrary PHP code execution can occur in Chamilo LMS when attacker-influenced data reaches the names of HTML_QuickForm elements, because the vendored PEAR QuickForm code builds array accesses through eval() and therefore treats those names as PHP source. Exposure is conditional rather than universal: stock Chamilo forms hardcode their element names and are not exploitable, so only installations running a developer-written plugin or a misconfiguration that routes user input into element names are at risk, and reaching those forms generally requires an authenticated account with low privileges while the vulnerable path itself is attacker-uncontrolled. Where such a path does exist the outcome is full server compromise; versions 1.11.40 and 2.0.1 replace the eval() construction with safe key parsing, and no public exploit code was identified at time of analysis.