Unauthenticated OS command injection in Control Web Panel (CWP) builds prior to webpanel_version 1.16 lets remote attackers run arbitrary shell commands through the protected_directory user-panel module by posting a crafted 'file' parameter to the acc=deletedp action, which flows unsanitized into shell_exec. No credentials or user interaction are required against default installations, and the resulting commands execute in the user panel context. VulnCheck reported the issue and published a blog plus advisory describing it as a pre-auth module-dispatch RCE; only a public PoC reference exists (not verified as working exploit code), and no confirmed active exploitation is reported, though the act_now priority label, CVSS 9.3 severity and network-only attack path make rapid upgrade to 1.16 the clear action.
OS command injection in WAVLINK WN551X3-A firmware M51X3_V251020-WO-182e965 allows unauthenticated remote attackers who can reach the DNS Resolution Handler to manipulate the 'data' argument passed to sub_41a430 in /bin/ioos, with high confidentiality, integrity, and availability impact. The flaw is CWE-78 and carries a CVSS 4.0 score of 9.3; the vuln.today priority decision label is act_now. A public PoC reference exists; it is not verified as working exploit code.
OS command injection in the WAVLINK WN551X3-A WireGuard CLI group handler lets remote attackers inject shell metacharacters through the group_name argument processed by the system function in /bin/ioos, potentially executing arbitrary commands on the router. The CVSS 4.0 score is 9.3 and the vector rates network reachability with no privileges or user interaction, though the provided sources do not explicitly confirm whether the handler is reachable pre-authentication; an admin session is a plausible limiting factor. A public PoC reference exists but is not verified as working exploit code; the issue is labeled act_now, and no CISA KEV active exploitation is indicated.
Remote, unauthenticated stack-based buffer overflow in the OpenVPN handler of the WAVLINK WN536AX6-A router (firmware V260507) lets an attacker who can reach the /protocol.csp endpoint corrupt stack memory by supplying an overlong openvpn_ip value to an unsafe strcpy, with high confidentiality, integrity and availability impact. Only this model and firmware build are identified in the affected CPE, and a public PoC reference exists at github.com/F-yyjy/cve (WN536AX6-A_openvpn_ip.md) but is not verified as working exploit code; no KEV listing is reported. Real-world exposure hinges on reachability - the available sources do not confirm whether OpenVPN must be enabled or whether the management web interface is exposed to the WAN, so LAN-only deployments are materially less exposed, and the current triage label is act_now.
OS command injection in the WAVLINK WN536AX6-A router running firmware V260507 allows remote attackers to run arbitrary shell commands on the device through the WireGuard group configuration handler, with no authentication or user interaction required per the assessed vector (PR:N/UI:N) and a CVSS 4.0 base score of 9.3 reflecting high confidentiality, integrity and availability impact on both the vulnerable system and downstream dependent systems. Exploitation is gated by reachability rather than by credentials: the web management service that exposes /protocol.csp is typically LAN-facing by default, so Internet-side attacks depend on remote administration being enabled or the router being directly exposed. A public proof-of-concept reference targets the group_id and group_name parameters; it is not verified as working exploit code, and no confirmed active exploitation is recorded. vuln.today prioritisation labels this act_now.
OS command injection in WAVLINK WN536AX6-A firmware V260507 allows remote unauthenticated attackers to execute arbitrary operating-system commands through the /protocol.csp endpoint's openvpn_cli handler by manipulating the file_id argument. Exploitation requires network reachability to the device's web management service; on consumer routers that interface is typically LAN-bound, so internet-wide attacks depend on WAN-side remote management being enabled or an existing LAN foothold. A public PoC reference exists but is not verified as working exploit code, no CISA KEV entry is supplied, and the assigned priority is act_now.
Account takeover in HotGo through 2.15.1 is possible because the /admin/sms/send handler honours a client-supplied Code field instead of always generating a server-side SMS verification code, letting an attacker pin a code they already know and replay it against /admin/site/mobileLogin. Unauthenticated remote attackers who know a victim's registered mobile number can sign in as that user, including administrators, with high confidentiality, integrity and availability impact. A public PoC reference exists but is not verified as working exploit code; there is no CISA KEV entry, exploitation is gated by the need to know the target's mobile number and by the SMS/mobile login flow being enabled, and the vendor has published an upstream fix - priority is act_now.
Hard-coded production MQTT broker credentials in the Attendo (formerly Petpooja Payroll) Admin Android app through version 3.0.13 let unauthenticated attackers decompile the publicly available APK, recover the credentials from bundled Flutter assets, and authenticate to the production MQTT broker over TCP 1883 to read employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material and to publish messages to those topics. The issue requires the broker to remain network-reachable and the embedded credentials to remain valid and unrotated. A public PoC reference exists; it is not verified as working exploit code, and no CISA KEV entry is present in the provided data.
Stack-based buffer overflow in ReadyMedia (formerly MiniDLNA) 1.3.0 through 1.3.3 allows remote attackers to corrupt stack memory by dropping a crafted DFF audio file with an oversized PROP chunk size into a directory the DLNA server monitors, where an inotify watcher parses it automatically with no user interaction. The oversized value is used without validation to size a variable-length stack array and then to read file data into it, giving remote code execution on builds lacking stack protections and denial of service (crash) on hardened builds. Write access to a monitored media path is the practical prerequisite, which is why the assessed vector is PR:L rather than unauthenticated; a public PoC reference exists, but it is not verified as working exploit code, and no confirmed active exploitation has been reported.
Munshi (by Petpooja) subscription billing can be activated without any real payment: the webhook at POST /api/payment/order/webhook accepts a forged payment-success notification and marks the subscription paid, because the endpoint performs no webhook authentication, no cryptographic signature check, no source validation, and no independent reconciliation with the payment provider. Any remote attacker can trigger it without credentials or user interaction (PR:N/UI:N) once they hold an order reference, which the payment-status redirect URL exposes during a checkout they can start themselves. Releases dated before 2026-06-30 are affected. There is no CISA KEV entry or EPSS data in the supplied intelligence; a public write-up describing the forgery technique exists, but it is a reference only and is not verified as working exploit code.
Control Web Panel (CWP) releases before webpanel_version 1.16 expose an OS command injection in the loopback /newpass/ password-change route, where the POST 'user' parameter is concatenated without escaping into a shell command that runs as root. Any party able to reach that route can execute arbitrary OS commands with root privileges; the supplied vectors indicate local/loopback access (AV:L, PR:N, UI:N), while a VulnCheck reference describes a pre-auth module-dispatch path that may bridge external requests to the loopback endpoint, making deployment-specific reachability the deciding factor. A vendor update to 1.16 is available, and a public PoC reference exists but is not verified as working exploit code; no CISA KEV confirmation is present.
Missing authentication in the Control Web Panel (CWP) loopback API service allows anyone who can reach the localhost-bound API to invoke root-privileged routes - including /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/ and /user_panel_dashboard/ - without presenting an access token, yielding high confidentiality, integrity and availability impact on the vulnerable host (CVSS 4.0 base 8.6, CWE-306, VC:H/VI:H/VA:H). CWP installations below webpanel_version 1.30 are affected, and the vendor fix is the 1.30 release. The gating factor is reachability: the vector is AV:L/PR:N/UI:N, so the attacker must be able to address the loopback listener (a local account, code execution on the host, or an SSRF/reverse-proxy path to 127.0.0.1); a public PoC reference exists but is not verified as working exploit code, and no CISA KEV entry appears in the supplied data.
DoraCMS through 3.1.0 accepts a full request body when updating an API key at PUT /api/v1/user/api-keys/:id, letting any authenticated low-privileged user set the userId field on a key they own to a victim's account id and thereby operate as that victim, including editing profiles and publishing or deleting content. The vendor commit shows the pre-patch service spread the entire submitted object into the database update, so default deployments are exposed to any logged-in account that holds an API key and can obtain the target user id; no availability impact or unauthenticated path was identified. Severity is high (CVSS 4.0 base 8.6; independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), no CISA KEV entry exists, but a public PoC reference is published at vul.yulun.ac.cn and is not verified as working exploit code.
Path traversal in Termix (Termix-SSH) up to 2.9.2 lets a remote attacker who holds a valid low-privilege account write files outside the intended directory by manipulating the destPath argument sent to the file-manager plugin endpoint /plugin-api/file-manager/transferToHost, with assessed impact of high confidentiality, integrity and availability loss and a scope change beyond the application. Exploitation requires an authenticated session and a reachable, installed file-manager plugin, so it is not an unauthenticated attack. A public PoC reference exists; it is not verified as working exploit code, there is no CISA KEV confirmation of active exploitation, and the issue is fixed in the standalone File Manager plugin v1.0.0 and in core v26.10.0.
OS command injection in the WAVLINK WN536AX6-A Wi-Fi router (firmware V260507) allows an attacker who can reach the device's web management interface to execute arbitrary operating-system commands through the mac argument handled by the host_black function of /protocol.csp. The CVSS v4.0 vector reports PR:L, so exploitation requires a low-privileged authenticated management session (or reachable credentialed/default-login state) rather than being unauthenticated against a default configuration, and it additionally requires network reachability to the router's web UI, which on properly segmented networks is LAN-side only. A public PoC reference has been published on GitHub; it is not verified as working exploit code, there is no CISA KEV entry, and the vendor was contacted prior to disclosure. Priority guidance places remediation in the current week.
Local privilege escalation to root affects the Amlogic Android SDK's pppoe_wrapper daemon as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, where any unprivileged local process or app can send a crafted message to the world-writable AF_UNIX datagram socket at /dev/socket/pppoe_wrapper. A message beginning with 'pppd pty' and containing shell metacharacters is passed unfiltered to system(3) and executed by /system/bin/sh -c as root, giving full control of the device. Exploitation is local-only (CVSS 4.0 AV:L, independently assessed CVSS 3.1 AV:L/AC:L/PR:L/UI:N) and requires the attacker to already have local code execution; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV active-exploitation entry is present.
Munshi, the Petpooja business/company management platform, fails to enforce authorization on its company deletion workflow at DELETE /api/companies/{company_id}, allowing an authenticated invited sub-user who merely has access to a company to hard-delete that company record and irreversibly destroy its invoices, configurations, and chat sessions. The flaw is a missing-authorization condition (CWE-862) affecting releases prior to 2026-07-07: no elevated role is needed because the dedicated company_delete permission and company-ownership check are simply not applied, and no victim interaction is required (CVSS:4.0 PR:L/UI:N with high integrity and availability impact, no confidentiality impact). Exposure is bounded by the prerequisite that the attacker must already hold a valid sub-user invitation to the target company, so this is an insider-adjacent or compromised-account risk for multi-user tenants rather than an anonymous mass-exploitation event; a public PoC write-up reference exists but is not verified as working exploit code, and no CISA KEV entry is associated with this CVE. Priority is assessed as remediation this week rather than emergency response.
Unauthenticated path traversal in GoFound through 1.4.1 allows remote attackers to delete arbitrary directories by supplying ../ sequences in the 'database' parameter of GET requests to /api/db/create and /api/db/drop, which reaches os.RemoveAll with an attacker-controlled path. The assigned CVSS 4.0 vector (7.2, High) rates it AV:N/AC:L/PR:N, so a network-reachable instance is directly attackable without credentials; because the endpoints accept GET, the same action can also be triggered from a victim's browser, which is what the UI:P metric captures. There is no KEV entry indicating active exploitation, and the available exploit reference is a public PoC write-up that has not been verified as working exploit code; no EPSS score was supplied, and the vuln.today decision label is 'this_week'.
Broken object-level authorization in Petpooja Munshi before the 2026-06-17 fix lets any authenticated user read another user's purchase-inquiry thread by altering the thread identifier in GET /purchase-inquiry/thread/{thread-id}, exposing supplier communications and quotation content. Exploitation requires a valid Munshi account and a guessable or enumerable thread ID; impact is read-only confidentiality loss with no integrity or availability effect. A public PoC reference (Medium write-up) exists but is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation; vuln.today prioritizes it as this_week.
Authenticated sub-users of Petpooja Munshi can permanently delete invoices owned by the tenant owner - individually or in bulk - by calling the invoice deletion APIs with arbitrary invoice identifiers. Both DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete verify only that the caller belongs to the tenant and never check object-level ownership or per-object permissions (CWE-639), so any valid low-privileged sub-user account is sufficient to cause unauthorized data loss; confidentiality and availability of other data are not affected, but the integrity impact on invoice records is high (VC:N/VI:H/VA:N, PR:L, UI:N). There is no confirmation of active exploitation, and the publicly referenced Medium write-up is a PoC reference that is not verified as working exploit code; the issue is scoped to Munshi versions before the 2026-07-28 fix and has been prioritized for remediation this week.
Physical access to a Nexbox A95X TV box built on the Amlogic S905X platform lets an attacker attach a USB-to-TTL adapter to an internal UART header and obtain a passwordless uid 2000 (system) shell; from there the pppoe_wrapper vendor daemon's OS command injection can be used to gain root, resulting in full device compromise. The issue is rated CVSS 4.0 7.0 (High) and independently assessed as CVSS 3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with physical access as the dominant limiting factor rather than exploitation complexity. No CISA KEV listing is present, a public PoC reference exists but is not verified as working exploit code, and vuln.today prioritizes the issue as this_week.
An out-of-bounds stack write in the VobSub subtitle decoder (libsub_vob) of the Amlogic DroidLogic SubTitleService allows remote attackers to corrupt memory on Nexbox A95X (Amlogic S905X) TV boxes and other devices built from the Amlogic Android SDK. A crafted SET_CONTR command carrying an attacker-controlled alpha value drives the change_data index past the end of the fixed four-element PixelDatas array inside vob_fill_pixel(), zeroing adjacent stack bytes; the payload can arrive over the unauthenticated tcp/10100 socket or by getting the device to parse a malicious .sub file. No authentication and no user interaction are required, but the assessed impact is limited to silent stack corruption or a process crash rather than code execution, and the tcp/10100 service is typically LAN-exposed rather than internet-facing. A public PoC reference exists; it is not verified as working exploit code, and no confirmed active exploitation has been reported.
An infinite loop in the get_vob_spu() function of the libsub_vob VobSub subtitle decoder, part of Amlogic's DroidLogic SubTitleService shipped on Amlogic S905X-based devices such as the Nexbox A95X TV box, lets remote network attackers reachable on the LAN or local users loading a crafted file stall the subtitle decode thread at 100% CPU indefinitely, producing a denial of service. Two trigger paths are documented: sending a crafted AMLU data block with mismatched length fields to the unauthenticated tcp/10100 listener, or loading a malicious VobSub (.sub) file. No authentication or user interaction is required (CVSS 4.0 base 6.9 Medium; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N with availability-only low impact), and only a public PoC reference exists - it is not verified as working exploit code, and no active exploitation has been confirmed. Exposure is bounded by the fact that tcp/10100 is a local service typically reachable only from the LAN, with no confidentiality or integrity impact and no code execution.
Remote code execution in the s2Member WordPress plugin, affecting all versions up to and including 260927, allows an authenticated user holding the plugin's custom-level capability or above to inject and execute PHP on the hosting server through the 'item_name' parameter of the plugin's PayPal notification handling paths. The Wordfence-reported flaw (CWE-94) is rated 9.8 and carries a vuln.today 'act_now' decision label, though the prerequisites are real: the attacker must already hold a custom-level-or-above s2Member account, so the original CVSS vector's PR:N understates the bar and the independently assessed vector is PR:L. No CISA KEV entry or working public exploit was identified at time of analysis, but given the severity, the low attack complexity and the availability of the vulnerable code in the public plugin repository, verified exploitation should be assumed feasible.
Unauthenticated arbitrary file deletion in Ultra Addons for Contact Form 7, affecting all versions up to and including 3.5.54, lets remote attackers delete files such as wp-config.php when the PDF Generator add-on is active and a Contact Form 7 form is configured for PDF generation, creating a path to remote code execution. The flaw is rated CVSS 9.8 and priority signals are strongly aligned toward high priority, but exploitation depends on that non-default add-on configuration. No CISA KEV entry or public exploit was identified in the supplied data, and installations without the PDF generator enabled are not exposed.
A stack-based buffer overflow in the ims_registrar_pcscf module of Kamailio 6.1.3 and 6.1.4 allows unauthenticated remote attackers to crash the P-CSCF process by sending a crafted application/reginfo+xml NOTIFY message whose alias parameter carries an over-long port value. The assessed impact is availability only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): process_contact() copies the port string into a fixed 5-byte stack buffer with no length validation, corrupting the stack and terminating the SIP process. Exposure is limited to IMS/VoLTE deployments that actually run this module in a P-CSCF role and accept reginfo+xml NOTIFY traffic on an attacker-reachable SIP interface; no public exploit is confirmed - a community gist is linked from the NVD entry but is not verified as working exploit code - and the vulnerability is not listed in CISA KEV.
Unauthenticated arbitrary file upload in the Joomla Custom Tables extension before 3.7.8 allows an attacker to place a polyglot file with an attacker-controlled extension in the site's web-accessible tmp directory when a public Custom Tables submission form is exposed, and the response discloses the stored path. Because uploaded files are served as static content by default, the assessed impact is integrity only: hosting attacker-controlled content such as phishing or malware pages under the victim domain, not confirmed code execution. No public exploit was identified in the supplied data, and the supplied priority label is act_now.
Code injection in dayrui XunRuiCMS through 4.7.4 allows remote, unauthenticated attackers to manipulate the dirname argument processed by str_replace in the Mobile Site Directory component (/zzmob/index.php), with low impact on confidentiality, integrity and availability. The CVSS 4.0 base score is 6.9 (medium) with E:P; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV entry is associated. Exploitation requires the zzmob mobile-site feature to be present and reachable.
Server-side code injection in the email-template rendering path of dayrui XunRuiCMS up to 4.7.4 (_get_tpl_content in dayrui/Fcms/Library/Notice.php) lets an attacker who can influence rendered template content have injected code evaluated by PHP, giving limited confidentiality, integrity and availability impact. The vendor was contacted and did not respond, and no fixed version is listed. A public proof-of-concept reference exists (a GitHub disclosure report against 4.7.2) but is not verified as working exploit code, and there is no KEV or confirmed active exploitation; our independent assessment rates this medium severity (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, C:L/I:L/A:L) and the trigger path is not described in the available sources, so whether template editing requires an authenticated administrative session - a strong limiting factor - should be verified per deployment.
SQL injection in the Member Module of dayrui XunRuiCMS through 4.7.4 lets remote attackers manipulate the 'catid' argument handled by the View function in dayrui/Fcms/Core/View.php. The CVSS vector indicates no authentication or user interaction is required, so requests can be sent directly against a vulnerable instance, though the member endpoint must be reachable and the precise how the parameter reaches the query is not detailed in available sources. Impact is bounded to Low confidentiality, integrity, and availability per the assessed vector; exploit code is referenced publicly but is not verified as working code, and no confirmed active exploitation or CISA KEV listing is associated with this CVE.
Unauthenticated SQL injection in mathurvishal's CloudClassroom-PHP-Project lets remote attackers manipulate the eid parameter of viewquery.php to alter the SQL query the application executes, exposing and potentially modifying data stored by the classroom application. The flaw is remotely reachable without credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), but impact is scored as limited confidentiality and integrity loss rather than full compromise; the product is a niche individual open-source project, so real-world exposure depends on whether an instance is network-accessible. A public PoC reference exists; it is not verified as working exploit code, the issue is not on CISA KEV, and the vendor did not respond to disclosure and ships a rolling release, so no version-specific fix information is available.
CloudClassroom-PHP-Project exposes protected student records through studentdetails.php because the script continues executing after an access-control redirect (CWE-698). The endpoint is network-reachable with low complexity and no authentication or user interaction per the assessed vector, but impact is limited to low-grade confidentiality loss and the project has a tiny rolling-release footprint. A public PoC reference exists; it is not verified as working exploit code, and no vendor-released fixed version is identified.
A use-after-free in the P2P session teardown handler of VStarcam O-KAM SuperIPCam 1.3.3.32 (SuperIPCam.exe, function FUN_005a2d44) allows remote, unauthenticated attackers who can reach the camera's P2P connectivity feature to corrupt memory during session teardown, producing a partial loss of confidentiality, integrity and availability consistent with a denial-of-service crash rather than confirmed code execution. Only version 1.3.3.32 is identified as affected, and the vendor was contacted about the disclosure but did not respond. A public PoC reference exists (a GitHub gist linked from the VulDB entry); it is not verified as working exploit code, and there is no CISA KEV listing or other confirmation of active exploitation.
A stack-based buffer overflow (CWE-121) exists in the Windows client software VStarcam O-KAM Client 1.3.3.32, specifically inside the exported/imported function FUN_10003EA0 of the native library DevDll_925.dll. The vendor was contacted but did not respond and no vendor-released patch has been identified at time of analysis; the affected version is the only one confirmed in the CPE data (cpe:2.3:a:vstarcam:o-kam_client), so exposure is limited to users running that build. The issue is remotely reachable according to the CVSS 4.0 vector (AV:N/PR:N/UI:N, score 6.9; our assessed CVSS 3.1 vector scores it 6.5 with Low confidentiality, integrity and availability impact), and a public PoC reference exists in a GitHub gist; it is not verified as working exploit code and there is no CISA KEV confirmation of active exploitation. The exact feature, protocol, or code path that delivers attacker-controlled data into FUN_10003EA0 is not described in the available sources.
Path traversal in the Aklivity Zilla http-filesystem binding lets remote unauthenticated attackers who can reach the binding manipulate the params argument so that Path.resolve in FileSystemServerFactory escapes the intended filesystem root, exposing files the Zilla process can read. All releases up to and including 1.3.4, 2.4.7 and 2.5.0-rc2 are affected, but only deployments that actually configure and expose the http-filesystem binding are reachable; the assessed impact is confidentiality-only, bounded by the process's host read permissions. A public PoC reference exists (a write-up in a GitHub CVE repository); it is not verified as working exploit code, no CISA KEV listing confirms active exploitation, and vendor fixes are available in 2.5.0-rc3.
Improper neutralization of template-engine syntax in the publishing component of Amazon Virtual Engineering Workbench (VEW) lets a remote low-privileged authenticated third party run arbitrary code under the publishing Lambda's IAM role by submitting a crafted CloudFormation template body through the product versioning API. Because that role can reach resources across tenant projects, successful exploitation ranges from code execution to cross-tenant data and resource access, and AWS rates the issue at CVSS 9.4 (CWE-1336). No public exploit code has been identified at time of analysis; the vendor has published an upstream fix and directs users to redeploy from the latest awslabs/virtual-engineering-workbench release.
A cross-site request forgery flaw in the Secure Access server, version 14.60, lets unauthenticated remote attackers bypass an anti-CSRF security control on the account-creation function and induce a logged-in administrator to create an account the attacker controls - effectively handing over administrative access to the management plane (CVSS v4.0 9.4; assessed CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R). Exploitation is not autonomous: it requires an administrator with a live authenticated session to be tricked into triggering an attacker-crafted request, so a human must be in the loop for each attempt and the flaw is scoped to the affected build. No public exploit code or PoC reference was identified at time of analysis, no EPSS score or KEV listing is associated with the CVE, and the vuln.today decision signal is act_now based on the severity of the administrative takeover path rather than on observed exploitation.
Authenticated arbitrary file upload in the DJ-Classifieds extension for Joomla before 3.11.3 lets a low-privileged account (PR:L) place files of a dangerous type on the web server and escalate to full remote code execution. The vendor-reported severity is high - CVSS 9.4 as published, with an assessed 3.1 vector of AV:N/AC:L/PR:L/UI:N and high confidentiality, integrity and availability impact - and the current priority label is act_now, so sites running the component should be updated promptly. No CISA KEV entry and no public exploit code were identified at time of analysis; the exact upload parameter and the validation-bypass technique are not described in the available sources.
Broken access control in WSO2 API Manager's System REST APIs lets a low-privilege authenticated user invoke administrative operations that should be restricted, and the same authorization gap is listed for WSO2 Identity Server as Key Manager, Open Banking AM/IAM, API Control Plane, Universal Gateway, Traffic Manager, and related Carbon REST API components. The vendor states that APIs exposed through the API Manager API Gateway are not affected, confining exposure to the management/System REST API surface. Priority is act_now because of the high impact, although no CISA KEV entry or public exploit code is identified in the supplied intelligence; the assessed vector requires PR:L while the vendor-published vector lists PR:N, a discrepancy that should be confirmed with WSO2.
Unauthenticated remote attackers can alter client security settings through affected Absolute Secure Access servers running version 13.0 up to but not including 14.61, an authentication bypass rated 9.3 critical with a vuln.today priority of act_now. The affected component is a VPN/secure-access gateway that is commonly internet-facing, so exposure is highest where the server is reachable over the network; upgrading to 14.61 removes the affected code path. No public exploit was identified at time of analysis.
Unauthenticated SQL injection in the frontend search of the DJ-Classifieds extension for Joomla (versions before 3.11.3) lets remote attackers reach the site's database without logging in, with high confidentiality, integrity and availability impact (CVSS 9.3, CWE-89). Affected are Joomla sites running the third-party classifieds component from dj-extensions.com; exploitation requires only that the extension be installed and its frontend search be publicly reachable, which is the normal deployment mode for an anonymous-visitor listings component. No CISA KEV entry exists and no public exploit identified at time of analysis, but the vendor-reported severity and the lack of any authentication or interaction prerequisite make this an act_now priority.
kaniko builds before v1.25.20 can leak the build's Microsoft Entra ID (Azure AD) access token to an attacker-controlled registry host, because the bundled ACR credential helper github.com/chrismellard/docker-credential-acr-env matches ACR hosts with an unanchored regular expression and therefore accepts any name that merely contains '.azurecr.io', '.azurecr.cn', '.azurecr.de' or '.azurecr.us'. A Dockerfile the operator does not fully control needs only a FROM or COPY --from=<image> pointing at a lookalike host such as x.azurecr.io.attacker.com - no RUN instruction and no push - for kaniko to fetch a token from the build's Azure identity (service principal variables, a federated workload identity token, or a managed identity via IMDS/MSI_ENDPOINT) and POST it to https://<host>/oauth2/exchange, where the attacker can reuse it against Azure Resource Manager and exchange it for credentials to any ACR registry the identity can reach. The vector is AV:N/AC:L/PR:N/UI:R/S:C with high confidentiality and integrity impact and no availability impact; exploitation is only possible where an Azure identity is actually reachable from the build environment, and no public exploit code was identified at time of analysis. Vendor-released patch: kaniko v1.25.20.
Authentication bypass in Control Web Panel (CWP) builds before webpanel_version 1.12 lets remote attackers who know a single valid hosting username reach user-panel module code paths without supplying a password, and the advisory describes this bypass as a step in a pre-authentication chain to root access. The root cause is an execution-after-redirect flaw (CWE-698): the user-panel authentication flow's unauthenticatedFlow() calls toLoginWithIntendedUri(), which emits a redirect header but never calls exit(), so PHP execution continues into the module dispatcher include unauthenticated. No public exploit was identified at time of analysis, but a vendor patch exists in 1.12 and the issue carries a 9.3 CVSS 4.0 score with PR:N, making it an act-now priority; the practical gating factor is that an attacker must first know or guess a valid tenant username, which is not a credential but is not anonymous either.
Authentication bypass in ape-volo-admin before 3.6.1 lets unauthenticated, network-reachable attackers forge administrator JWTs because the application ships a hardcoded JWT signing key in Ape.Volo.Api/appsettings.json. Because that key is published in the project's public source, an attacker can sign a token offline with the jti claim set to the seeded administrator id and obtain full API control over users, roles, permissions and data; the flaw is rated 9.3 (CVSS 4.0) and prioritised act_now. Default deployments are the exposed population, while instances whose operators replaced the signing key with a unique secret are not forgeable this way, and upgrading to 3.6.1 resolves the issue completely. No confirmed active exploitation or verified working exploit code is documented in the available data, though a public PoC reference exists.
Unauthenticated remote attackers can bypass authentication in Barracuda Email Security Gateway (ESG) deployments earlier than 9.4.0.030 and reach the configuration-import function, where restoring a crafted but compatible backup archive modifies the appliance's global configuration. The flaw is rated CVSS 9.3 and an independent assessment scores it CVSS:3.1 9.8 with network-only, no-credential access; the only stated prerequisite is a backup archive compatible with the target firmware. No public exploit code was identified in the available sources at time of analysis, but the act_now priority and Mandiant reporting make prompt upgrade to 9.4.0.030 the appropriate response.
Unauthenticated order-forgery in the PayHere Payment Gateway WordPress plugin, versions 2.4.0 through 2.4.5, allows an attacker to mark any order as paid without making a payment. The plugin fails to verify the authenticity of incoming payment notifications when the merchant secret is left unset - the default configuration - so a forged confirmation is accepted; sites that have configured a merchant secret are not exploitable. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3), impact is confined to order-status integrity with no data disclosure or availability effect, there is no CISA KEV entry, and only a public PoC reference exists that has not been verified as working exploit code; the vulnerability is tracked as a this_month priority item.
Stack-based buffer overflow in Linksys E8450 firmware 1.2.00.360516 allows remote, unauthenticated attackers to overwrite stack memory by sending an overlong hidden_timezone value to /www/cgi-bin/portal.cgi, with high confidentiality, integrity, and availability impact scored. The vuln.today decision is act_now, but exposure depends on reachability of the router's HTTP management interface and is bounded to the named firmware. No vendor patch or CISA KEV listing is provided, and no public exploit identified at time of analysis; the CVSS 4.0 vector nevertheless records E:P.
Stored cross-site scripting in Munshi (by Petpooja) before the build released on 2026-07-13 allows authenticated users to persist malicious markup via Purchase Inquiry item descriptions or thread messages at /purchase-inquiry/thread/{thread-id}, which the application assigns to innerHTML while rendering before text cleaning completes. The payload fires in the browser of any other user who opens or reopens the affected thread, giving script execution and full-page defacement that re-triggers on every revisit. Exploitation requires a valid Munshi account and a victim viewing that specific thread, and a public PoC reference exists; it is not verified as working exploit code. There is no CISA KEV listing, and this is assessed as a moderate-risk, authenticated stored XSS rather than a top-priority emergency, with patching aligned to this month's cycle.
Credential leakage in the SUSE Rancher Manager meta proxy causes the caller's own Rancher credentials - either the browser session cookie of a signed-in user or a Rancher API token - to be forwarded to third-party cloud provider hosts when the proxy relays a request. Any party that operates or can observe the receiving allow-listed host, including its request logs or a TLS-terminating intermediary in front of it, obtains a live Rancher credential that may carry administrative control over the Rancher Manager control plane and its managed clusters; long-lived API tokens extend the exposure window. Affected are Rancher 2.15.0 through 2.15.2, 2.14.0 through 2.14.6, 2.13.0 through 2.13.10, 2.12.0 through 2.12.14 and 2.11.0 through 2.11.18, and default installations are exposed as soon as a user opens an affected provisioning form; no public exploit code was identified at time of analysis, and the vuln.today decision label is act_now with a 9.1 CVSS score.
Privilege escalation in SUSE Rancher Fleet's agent-management (import) controller lets an authenticated Rancher user holding only the default 'user' global role obtain full cluster-admin on the Rancher management (local) cluster, and from there reach the credentials of every downstream cluster managed by that installation. The controller runs with cluster-administrator privileges and did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object could reference, so a Cluster defined in a namespace the user controls could be pointed at management-cluster administrative credentials; the impact extends to all secrets, RBAC and workloads on the management server. Affected ranges are Fleet 0.13.0 through 0.13.17, 0.14.0 through 0.14.12, 0.15.0 through 0.15.8 and 0.16.0 through 0.16.3 (possibly older releases too), and no public exploit identified at time of analysis, but the priority decision is act_now because Fleet workspace self-service is default behaviour and no non-default configuration is required for exposure.