Unauthenticated OS command injection in Control Web Panel (CWP) builds prior to webpanel_version 1.16 lets remote attackers run arbitrary shell commands through the protected_directory user-panel module by posting a crafted 'file' parameter to the acc=deletedp action, which flows unsanitized into shell_exec. No credentials or user interaction are required against default installations, and the resulting commands execute in the user panel context. VulnCheck reported the issue and published a blog plus advisory describing it as a pre-auth module-dispatch RCE; only a public PoC reference exists (not verified as working exploit code), and no confirmed active exploitation is reported, though the act_now priority label, CVSS 9.3 severity and network-only attack path make rapid upgrade to 1.16 the clear action.
OS command injection in WAVLINK WN551X3-A firmware M51X3_V251020-WO-182e965 allows unauthenticated remote attackers who can reach the DNS Resolution Handler to manipulate the 'data' argument passed to sub_41a430 in /bin/ioos, with high confidentiality, integrity, and availability impact. The flaw is CWE-78 and carries a CVSS 4.0 score of 9.3; the vuln.today priority decision label is act_now. A public PoC reference exists; it is not verified as working exploit code.
OS command injection in the WAVLINK WN551X3-A WireGuard CLI group handler lets remote attackers inject shell metacharacters through the group_name argument processed by the system function in /bin/ioos, potentially executing arbitrary commands on the router. The CVSS 4.0 score is 9.3 and the vector rates network reachability with no privileges or user interaction, though the provided sources do not explicitly confirm whether the handler is reachable pre-authentication; an admin session is a plausible limiting factor. A public PoC reference exists but is not verified as working exploit code; the issue is labeled act_now, and no CISA KEV active exploitation is indicated.
Remote, unauthenticated stack-based buffer overflow in the OpenVPN handler of the WAVLINK WN536AX6-A router (firmware V260507) lets an attacker who can reach the /protocol.csp endpoint corrupt stack memory by supplying an overlong openvpn_ip value to an unsafe strcpy, with high confidentiality, integrity and availability impact. Only this model and firmware build are identified in the affected CPE, and a public PoC reference exists at github.com/F-yyjy/cve (WN536AX6-A_openvpn_ip.md) but is not verified as working exploit code; no KEV listing is reported. Real-world exposure hinges on reachability - the available sources do not confirm whether OpenVPN must be enabled or whether the management web interface is exposed to the WAN, so LAN-only deployments are materially less exposed, and the current triage label is act_now.
OS command injection in the WAVLINK WN536AX6-A router running firmware V260507 allows remote attackers to run arbitrary shell commands on the device through the WireGuard group configuration handler, with no authentication or user interaction required per the assessed vector (PR:N/UI:N) and a CVSS 4.0 base score of 9.3 reflecting high confidentiality, integrity and availability impact on both the vulnerable system and downstream dependent systems. Exploitation is gated by reachability rather than by credentials: the web management service that exposes /protocol.csp is typically LAN-facing by default, so Internet-side attacks depend on remote administration being enabled or the router being directly exposed. A public proof-of-concept reference targets the group_id and group_name parameters; it is not verified as working exploit code, and no confirmed active exploitation is recorded. vuln.today prioritisation labels this act_now.
OS command injection in WAVLINK WN536AX6-A firmware V260507 allows remote unauthenticated attackers to execute arbitrary operating-system commands through the /protocol.csp endpoint's openvpn_cli handler by manipulating the file_id argument. Exploitation requires network reachability to the device's web management service; on consumer routers that interface is typically LAN-bound, so internet-wide attacks depend on WAN-side remote management being enabled or an existing LAN foothold. A public PoC reference exists but is not verified as working exploit code, no CISA KEV entry is supplied, and the assigned priority is act_now.
Account takeover in HotGo through 2.15.1 is possible because the /admin/sms/send handler honours a client-supplied Code field instead of always generating a server-side SMS verification code, letting an attacker pin a code they already know and replay it against /admin/site/mobileLogin. Unauthenticated remote attackers who know a victim's registered mobile number can sign in as that user, including administrators, with high confidentiality, integrity and availability impact. A public PoC reference exists but is not verified as working exploit code; there is no CISA KEV entry, exploitation is gated by the need to know the target's mobile number and by the SMS/mobile login flow being enabled, and the vendor has published an upstream fix - priority is act_now.
Remote code execution in the s2Member WordPress plugin, affecting all versions up to and including 260927, allows an authenticated user holding the plugin's custom-level capability or above to inject and execute PHP on the hosting server through the 'item_name' parameter of the plugin's PayPal notification handling paths. The Wordfence-reported flaw (CWE-94) is rated 9.8 and carries a vuln.today 'act_now' decision label, though the prerequisites are real: the attacker must already hold a custom-level-or-above s2Member account, so the original CVSS vector's PR:N understates the bar and the independently assessed vector is PR:L. No CISA KEV entry or working public exploit was identified at time of analysis, but given the severity, the low attack complexity and the availability of the vulnerable code in the public plugin repository, verified exploitation should be assumed feasible.
Unauthenticated arbitrary file deletion in Ultra Addons for Contact Form 7, affecting all versions up to and including 3.5.54, lets remote attackers delete files such as wp-config.php when the PDF Generator add-on is active and a Contact Form 7 form is configured for PDF generation, creating a path to remote code execution. The flaw is rated CVSS 9.8 and priority signals are strongly aligned toward high priority, but exploitation depends on that non-default add-on configuration. No CISA KEV entry or public exploit was identified in the supplied data, and installations without the PDF generator enabled are not exposed.
A stack-based buffer overflow in the ims_registrar_pcscf module of Kamailio 6.1.3 and 6.1.4 allows unauthenticated remote attackers to crash the P-CSCF process by sending a crafted application/reginfo+xml NOTIFY message whose alias parameter carries an over-long port value. The assessed impact is availability only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): process_contact() copies the port string into a fixed 5-byte stack buffer with no length validation, corrupting the stack and terminating the SIP process. Exposure is limited to IMS/VoLTE deployments that actually run this module in a P-CSCF role and accept reginfo+xml NOTIFY traffic on an attacker-reachable SIP interface; no public exploit is confirmed - a community gist is linked from the NVD entry but is not verified as working exploit code - and the vulnerability is not listed in CISA KEV.
Unauthenticated arbitrary file upload in the Joomla Custom Tables extension before 3.7.8 allows an attacker to place a polyglot file with an attacker-controlled extension in the site's web-accessible tmp directory when a public Custom Tables submission form is exposed, and the response discloses the stored path. Because uploaded files are served as static content by default, the assessed impact is integrity only: hosting attacker-controlled content such as phishing or malware pages under the victim domain, not confirmed code execution. No public exploit was identified in the supplied data, and the supplied priority label is act_now.
Improper neutralization of template-engine syntax in the publishing component of Amazon Virtual Engineering Workbench (VEW) lets a remote low-privileged authenticated third party run arbitrary code under the publishing Lambda's IAM role by submitting a crafted CloudFormation template body through the product versioning API. Because that role can reach resources across tenant projects, successful exploitation ranges from code execution to cross-tenant data and resource access, and AWS rates the issue at CVSS 9.4 (CWE-1336). No public exploit code has been identified at time of analysis; the vendor has published an upstream fix and directs users to redeploy from the latest awslabs/virtual-engineering-workbench release.
A cross-site request forgery flaw in the Secure Access server, version 14.60, lets unauthenticated remote attackers bypass an anti-CSRF security control on the account-creation function and induce a logged-in administrator to create an account the attacker controls - effectively handing over administrative access to the management plane (CVSS v4.0 9.4; assessed CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R). Exploitation is not autonomous: it requires an administrator with a live authenticated session to be tricked into triggering an attacker-crafted request, so a human must be in the loop for each attempt and the flaw is scoped to the affected build. No public exploit code or PoC reference was identified at time of analysis, no EPSS score or KEV listing is associated with the CVE, and the vuln.today decision signal is act_now based on the severity of the administrative takeover path rather than on observed exploitation.
Authenticated arbitrary file upload in the DJ-Classifieds extension for Joomla before 3.11.3 lets a low-privileged account (PR:L) place files of a dangerous type on the web server and escalate to full remote code execution. The vendor-reported severity is high - CVSS 9.4 as published, with an assessed 3.1 vector of AV:N/AC:L/PR:L/UI:N and high confidentiality, integrity and availability impact - and the current priority label is act_now, so sites running the component should be updated promptly. No CISA KEV entry and no public exploit code were identified at time of analysis; the exact upload parameter and the validation-bypass technique are not described in the available sources.
Broken access control in WSO2 API Manager's System REST APIs lets a low-privilege authenticated user invoke administrative operations that should be restricted, and the same authorization gap is listed for WSO2 Identity Server as Key Manager, Open Banking AM/IAM, API Control Plane, Universal Gateway, Traffic Manager, and related Carbon REST API components. The vendor states that APIs exposed through the API Manager API Gateway are not affected, confining exposure to the management/System REST API surface. Priority is act_now because of the high impact, although no CISA KEV entry or public exploit code is identified in the supplied intelligence; the assessed vector requires PR:L while the vendor-published vector lists PR:N, a discrepancy that should be confirmed with WSO2.
Unauthenticated remote attackers can alter client security settings through affected Absolute Secure Access servers running version 13.0 up to but not including 14.61, an authentication bypass rated 9.3 critical with a vuln.today priority of act_now. The affected component is a VPN/secure-access gateway that is commonly internet-facing, so exposure is highest where the server is reachable over the network; upgrading to 14.61 removes the affected code path. No public exploit was identified at time of analysis.
Unauthenticated SQL injection in the frontend search of the DJ-Classifieds extension for Joomla (versions before 3.11.3) lets remote attackers reach the site's database without logging in, with high confidentiality, integrity and availability impact (CVSS 9.3, CWE-89). Affected are Joomla sites running the third-party classifieds component from dj-extensions.com; exploitation requires only that the extension be installed and its frontend search be publicly reachable, which is the normal deployment mode for an anonymous-visitor listings component. No CISA KEV entry exists and no public exploit identified at time of analysis, but the vendor-reported severity and the lack of any authentication or interaction prerequisite make this an act_now priority.
kaniko builds before v1.25.20 can leak the build's Microsoft Entra ID (Azure AD) access token to an attacker-controlled registry host, because the bundled ACR credential helper github.com/chrismellard/docker-credential-acr-env matches ACR hosts with an unanchored regular expression and therefore accepts any name that merely contains '.azurecr.io', '.azurecr.cn', '.azurecr.de' or '.azurecr.us'. A Dockerfile the operator does not fully control needs only a FROM or COPY --from=<image> pointing at a lookalike host such as x.azurecr.io.attacker.com - no RUN instruction and no push - for kaniko to fetch a token from the build's Azure identity (service principal variables, a federated workload identity token, or a managed identity via IMDS/MSI_ENDPOINT) and POST it to https://<host>/oauth2/exchange, where the attacker can reuse it against Azure Resource Manager and exchange it for credentials to any ACR registry the identity can reach. The vector is AV:N/AC:L/PR:N/UI:R/S:C with high confidentiality and integrity impact and no availability impact; exploitation is only possible where an Azure identity is actually reachable from the build environment, and no public exploit code was identified at time of analysis. Vendor-released patch: kaniko v1.25.20.
Authentication bypass in Control Web Panel (CWP) builds before webpanel_version 1.12 lets remote attackers who know a single valid hosting username reach user-panel module code paths without supplying a password, and the advisory describes this bypass as a step in a pre-authentication chain to root access. The root cause is an execution-after-redirect flaw (CWE-698): the user-panel authentication flow's unauthenticatedFlow() calls toLoginWithIntendedUri(), which emits a redirect header but never calls exit(), so PHP execution continues into the module dispatcher include unauthenticated. No public exploit was identified at time of analysis, but a vendor patch exists in 1.12 and the issue carries a 9.3 CVSS 4.0 score with PR:N, making it an act-now priority; the practical gating factor is that an attacker must first know or guess a valid tenant username, which is not a credential but is not anonymous either.
Authentication bypass in ape-volo-admin before 3.6.1 lets unauthenticated, network-reachable attackers forge administrator JWTs because the application ships a hardcoded JWT signing key in Ape.Volo.Api/appsettings.json. Because that key is published in the project's public source, an attacker can sign a token offline with the jti claim set to the seeded administrator id and obtain full API control over users, roles, permissions and data; the flaw is rated 9.3 (CVSS 4.0) and prioritised act_now. Default deployments are the exposed population, while instances whose operators replaced the signing key with a unique secret are not forgeable this way, and upgrading to 3.6.1 resolves the issue completely. No confirmed active exploitation or verified working exploit code is documented in the available data, though a public PoC reference exists.
Unauthenticated remote attackers can bypass authentication in Barracuda Email Security Gateway (ESG) deployments earlier than 9.4.0.030 and reach the configuration-import function, where restoring a crafted but compatible backup archive modifies the appliance's global configuration. The flaw is rated CVSS 9.3 and an independent assessment scores it CVSS:3.1 9.8 with network-only, no-credential access; the only stated prerequisite is a backup archive compatible with the target firmware. No public exploit code was identified in the available sources at time of analysis, but the act_now priority and Mandiant reporting make prompt upgrade to 9.4.0.030 the appropriate response.
Stack-based buffer overflow in Linksys E8450 firmware 1.2.00.360516 allows remote, unauthenticated attackers to overwrite stack memory by sending an overlong hidden_timezone value to /www/cgi-bin/portal.cgi, with high confidentiality, integrity, and availability impact scored. The vuln.today decision is act_now, but exposure depends on reachability of the router's HTTP management interface and is bounded to the named firmware. No vendor patch or CISA KEV listing is provided, and no public exploit identified at time of analysis; the CVSS 4.0 vector nevertheless records E:P.
Credential leakage in the SUSE Rancher Manager meta proxy causes the caller's own Rancher credentials - either the browser session cookie of a signed-in user or a Rancher API token - to be forwarded to third-party cloud provider hosts when the proxy relays a request. Any party that operates or can observe the receiving allow-listed host, including its request logs or a TLS-terminating intermediary in front of it, obtains a live Rancher credential that may carry administrative control over the Rancher Manager control plane and its managed clusters; long-lived API tokens extend the exposure window. Affected are Rancher 2.15.0 through 2.15.2, 2.14.0 through 2.14.6, 2.13.0 through 2.13.10, 2.12.0 through 2.12.14 and 2.11.0 through 2.11.18, and default installations are exposed as soon as a user opens an affected provisioning form; no public exploit code was identified at time of analysis, and the vuln.today decision label is act_now with a 9.1 CVSS score.
Privilege escalation in SUSE Rancher Fleet's agent-management (import) controller lets an authenticated Rancher user holding only the default 'user' global role obtain full cluster-admin on the Rancher management (local) cluster, and from there reach the credentials of every downstream cluster managed by that installation. The controller runs with cluster-administrator privileges and did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object could reference, so a Cluster defined in a namespace the user controls could be pointed at management-cluster administrative credentials; the impact extends to all secrets, RBAC and workloads on the management server. Affected ranges are Fleet 0.13.0 through 0.13.17, 0.14.0 through 0.14.12, 0.15.0 through 0.15.8 and 0.16.0 through 0.16.3 (possibly older releases too), and no public exploit identified at time of analysis, but the priority decision is act_now because Fleet workspace self-service is default behaviour and no non-default configuration is required for exposure.
Authentication bypass in python-jose through 3.5.0 allows a remote unauthenticated attacker (CVSS vector PR:N) to forge HS256/HS384/HS512 JSON Web Tokens with arbitrary claims that jwt.decode will accept, because the library's HMACKey and CryptographyHMACKey classes accept zero-length HMAC secrets. The flaw is only reachable in deployments where the application's HS-family verification key actually resolves to an empty value, such as an oct JWK whose 'k' member is empty - the AT:P attack-requirement in the CVSS 4.0 vector and the AC:H rating in the independently assessed CVSS 3.1 vector. Correctly configured applications that supply a non-empty, properly sourced HMAC secret are not exploitable; no public exploit code was identified at time of analysis, and the vendor issue tracker (mpdavis/python-jose#398) is the coordination point.
Path-restriction bypass in @fastify/http-proxy 9.0.0 through 11.6.5 lets unauthenticated remote attackers escape an intended upstream prefix by supplying a route parameter that decodes into path separators and fragment or query delimiters, potentially enabling SSRF or authorization bypass in the upstream service. Exploitation requires the application to use both parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path; deployments without that configuration are not affected. The vendor-priority decision is act_now, the fix is version 11.6.6, there is no workaround other than upgrading, and no public exploit was identified at time of analysis.
Denial of service in Apache jclouds, across all versions, can result from XML external entity and entity-expansion handling when the library parses provider-supplied XML responses, allowing attacker-influenced DTD definitions to consume parser resources. The project is retired and no fixed release will be issued, so exposure is limited to applications still embedding jclouds and parsing XML from a provider endpoint that an attacker can influence. No CISA KEV confirmation appears in the supplied data, no public exploit was identified at time of analysis, and EPSS was not provided; the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.