Stack-based buffer overflow in ReadyMedia (formerly MiniDLNA) 1.3.0 through 1.3.3 allows remote attackers to corrupt stack memory by dropping a crafted DFF audio file with an oversized PROP chunk size into a directory the DLNA server monitors, where an inotify watcher parses it automatically with no user interaction. The oversized value is used without validation to size a variable-length stack array and then to read file data into it, giving remote code execution on builds lacking stack protections and denial of service (crash) on hardened builds. Write access to a monitored media path is the practical prerequisite, which is why the assessed vector is PR:L rather than unauthenticated; a public PoC reference exists, but it is not verified as working exploit code, and no confirmed active exploitation has been reported.
Hard-coded production MQTT broker credentials in the Attendo (formerly Petpooja Payroll) Admin Android app through version 3.0.13 let unauthenticated attackers decompile the publicly available APK, recover the credentials from bundled Flutter assets, and authenticate to the production MQTT broker over TCP 1883 to read employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material and to publish messages to those topics. The issue requires the broker to remain network-reachable and the embedded credentials to remain valid and unrotated. A public PoC reference exists; it is not verified as working exploit code, and no CISA KEV entry is present in the provided data.
Munshi (by Petpooja) subscription billing can be activated without any real payment: the webhook at POST /api/payment/order/webhook accepts a forged payment-success notification and marks the subscription paid, because the endpoint performs no webhook authentication, no cryptographic signature check, no source validation, and no independent reconciliation with the payment provider. Any remote attacker can trigger it without credentials or user interaction (PR:N/UI:N) once they hold an order reference, which the payment-status redirect URL exposes during a checkout they can start themselves. Releases dated before 2026-06-30 are affected. There is no CISA KEV entry or EPSS data in the supplied intelligence; a public write-up describing the forgery technique exists, but it is a reference only and is not verified as working exploit code.
Local privilege escalation to root affects the Amlogic Android SDK's pppoe_wrapper daemon as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, where any unprivileged local process or app can send a crafted message to the world-writable AF_UNIX datagram socket at /dev/socket/pppoe_wrapper. A message beginning with 'pppd pty' and containing shell metacharacters is passed unfiltered to system(3) and executed by /system/bin/sh -c as root, giving full control of the device. Exploitation is local-only (CVSS 4.0 AV:L, independently assessed CVSS 3.1 AV:L/AC:L/PR:L/UI:N) and requires the attacker to already have local code execution; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV active-exploitation entry is present.
Control Web Panel (CWP) releases before webpanel_version 1.16 expose an OS command injection in the loopback /newpass/ password-change route, where the POST 'user' parameter is concatenated without escaping into a shell command that runs as root. Any party able to reach that route can execute arbitrary OS commands with root privileges; the supplied vectors indicate local/loopback access (AV:L, PR:N, UI:N), while a VulnCheck reference describes a pre-auth module-dispatch path that may bridge external requests to the loopback endpoint, making deployment-specific reachability the deciding factor. A vendor update to 1.16 is available, and a public PoC reference exists but is not verified as working exploit code; no CISA KEV confirmation is present.
Missing authentication in the Control Web Panel (CWP) loopback API service allows anyone who can reach the localhost-bound API to invoke root-privileged routes - including /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/ and /user_panel_dashboard/ - without presenting an access token, yielding high confidentiality, integrity and availability impact on the vulnerable host (CVSS 4.0 base 8.6, CWE-306, VC:H/VI:H/VA:H). CWP installations below webpanel_version 1.30 are affected, and the vendor fix is the 1.30 release. The gating factor is reachability: the vector is AV:L/PR:N/UI:N, so the attacker must be able to address the loopback listener (a local account, code execution on the host, or an SSRF/reverse-proxy path to 127.0.0.1); a public PoC reference exists but is not verified as working exploit code, and no CISA KEV entry appears in the supplied data.
DoraCMS through 3.1.0 accepts a full request body when updating an API key at PUT /api/v1/user/api-keys/:id, letting any authenticated low-privileged user set the userId field on a key they own to a victim's account id and thereby operate as that victim, including editing profiles and publishing or deleting content. The vendor commit shows the pre-patch service spread the entire submitted object into the database update, so default deployments are exposed to any logged-in account that holds an API key and can obtain the target user id; no availability impact or unauthenticated path was identified. Severity is high (CVSS 4.0 base 8.6; independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), no CISA KEV entry exists, but a public PoC reference is published at vul.yulun.ac.cn and is not verified as working exploit code.
Path traversal in Termix (Termix-SSH) up to 2.9.2 lets a remote attacker who holds a valid low-privilege account write files outside the intended directory by manipulating the destPath argument sent to the file-manager plugin endpoint /plugin-api/file-manager/transferToHost, with assessed impact of high confidentiality, integrity and availability loss and a scope change beyond the application. Exploitation requires an authenticated session and a reachable, installed file-manager plugin, so it is not an unauthenticated attack. A public PoC reference exists; it is not verified as working exploit code, there is no CISA KEV confirmation of active exploitation, and the issue is fixed in the standalone File Manager plugin v1.0.0 and in core v26.10.0.
OS command injection in the WAVLINK WN536AX6-A Wi-Fi router (firmware V260507) allows an attacker who can reach the device's web management interface to execute arbitrary operating-system commands through the mac argument handled by the host_black function of /protocol.csp. The CVSS v4.0 vector reports PR:L, so exploitation requires a low-privileged authenticated management session (or reachable credentialed/default-login state) rather than being unauthenticated against a default configuration, and it additionally requires network reachability to the router's web UI, which on properly segmented networks is LAN-side only. A public PoC reference has been published on GitHub; it is not verified as working exploit code, there is no CISA KEV entry, and the vendor was contacted prior to disclosure. Priority guidance places remediation in the current week.
Munshi, the Petpooja business/company management platform, fails to enforce authorization on its company deletion workflow at DELETE /api/companies/{company_id}, allowing an authenticated invited sub-user who merely has access to a company to hard-delete that company record and irreversibly destroy its invoices, configurations, and chat sessions. The flaw is a missing-authorization condition (CWE-862) affecting releases prior to 2026-07-07: no elevated role is needed because the dedicated company_delete permission and company-ownership check are simply not applied, and no victim interaction is required (CVSS:4.0 PR:L/UI:N with high integrity and availability impact, no confidentiality impact). Exposure is bounded by the prerequisite that the attacker must already hold a valid sub-user invitation to the target company, so this is an insider-adjacent or compromised-account risk for multi-user tenants rather than an anonymous mass-exploitation event; a public PoC write-up reference exists but is not verified as working exploit code, and no CISA KEV entry is associated with this CVE. Priority is assessed as remediation this week rather than emergency response.
Unauthenticated path traversal in GoFound through 1.4.1 allows remote attackers to delete arbitrary directories by supplying ../ sequences in the 'database' parameter of GET requests to /api/db/create and /api/db/drop, which reaches os.RemoveAll with an attacker-controlled path. The assigned CVSS 4.0 vector (7.2, High) rates it AV:N/AC:L/PR:N, so a network-reachable instance is directly attackable without credentials; because the endpoints accept GET, the same action can also be triggered from a victim's browser, which is what the UI:P metric captures. There is no KEV entry indicating active exploitation, and the available exploit reference is a public PoC write-up that has not been verified as working exploit code; no EPSS score was supplied, and the vuln.today decision label is 'this_week'.
Physical access to a Nexbox A95X TV box built on the Amlogic S905X platform lets an attacker attach a USB-to-TTL adapter to an internal UART header and obtain a passwordless uid 2000 (system) shell; from there the pppoe_wrapper vendor daemon's OS command injection can be used to gain root, resulting in full device compromise. The issue is rated CVSS 4.0 7.0 (High) and independently assessed as CVSS 3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with physical access as the dominant limiting factor rather than exploitation complexity. No CISA KEV listing is present, a public PoC reference exists but is not verified as working exploit code, and vuln.today prioritizes the issue as this_week.
Broken object-level authorization in Petpooja Munshi before the 2026-06-17 fix lets any authenticated user read another user's purchase-inquiry thread by altering the thread identifier in GET /purchase-inquiry/thread/{thread-id}, exposing supplier communications and quotation content. Exploitation requires a valid Munshi account and a guessable or enumerable thread ID; impact is read-only confidentiality loss with no integrity or availability effect. A public PoC reference (Medium write-up) exists but is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation; vuln.today prioritizes it as this_week.
Authenticated sub-users of Petpooja Munshi can permanently delete invoices owned by the tenant owner - individually or in bulk - by calling the invoice deletion APIs with arbitrary invoice identifiers. Both DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete verify only that the caller belongs to the tenant and never check object-level ownership or per-object permissions (CWE-639), so any valid low-privileged sub-user account is sufficient to cause unauthorized data loss; confidentiality and availability of other data are not affected, but the integrity impact on invoice records is high (VC:N/VI:H/VA:N, PR:L, UI:N). There is no confirmation of active exploitation, and the publicly referenced Medium write-up is a PoC reference that is not verified as working exploit code; the issue is scoped to Munshi versions before the 2026-07-28 fix and has been prioritized for remediation this week.
Authenticated cPanel/WHM users can cause a privileged panel operation to write an arbitrary root-owned file, escalating a low-privilege hosting or reseller account to root on unpatched builds (below 11.138.0.19, 11.136.0.51, 11.134.0.67, or 11.110.0.154 on their respective branches). Exploitation requires valid panel credentials reached over the network (CVSS PR:L) with no user interaction, so anonymous internet attackers are not in scope. The vendor has released fixes, CISA SSVC records exploitation as none and automatable as no, and no public exploit has been identified at time of analysis; this is a genuine but not emergency-level priority to schedule within the current patch window.
Code injection in Regular Labs Sourcerer before 17.0.1, when used with Articles Anywhere before 20.1.1, allows an authenticated article author to have PHP-bearing Sourcerer content from a low-trust article evaluated under the identity of a more-trusted enclosing article. The vulnerable path requires Articles Anywhere to include that article, inclusion to be processed before Sourcerer, and Force Content Triggers to be off; ordinary Articles Anywhere output is not affected. No confirmed active exploitation or public exploit was identified in the provided intelligence, and updates to Sourcerer 17.0.1 and Articles Anywhere 20.1.1 address the flaw.
Madong Admin SaaS through 5.1.4 exposes its platform tenant-management API without authentication because the shipped middleware configuration registers the platform access-token middleware under the key 'platformapi' instead of the webman application key 'platform', so calls to /platformapi/tenant/account, /platformapi/tenant/bind-plan and /platformapi/tenant/sync-data reach controller actions with no identity check. Remote unauthenticated attackers who can reach the platform API can therefore list, create, modify, disable or delete tenants and bind subscription plans. The vendor has published an upstream fix, the issue is high severity (CVSS 8.8), and no public exploit was identified at time of analysis.
Authenticated remote code execution in ManageEngine Password Manager Pro builds before 13236 and ManageEngine PAM360 builds before 8601 allows a low-privileged user who can reach the web interface to execute operating-system commands, with high confidentiality, integrity, and availability impact. The flaw is CWE-78 command injection and requires a valid authenticated session (CVSS PR:L); the specific vulnerable feature, endpoint, and trigger are not described in the available sources. No public exploit identified at time of analysis, and the priority is this_week rather than an emergency.
Authenticated command injection in Temporal Server 1.31.0 through 1.31.2 allows a caller holding only a read role in a single namespace to execute commands of their choosing on the Worker Service host under the account the server process runs as. The bundled auto-scaled-workers module's k8s compute provider builds its Kubernetes client from client configuration supplied in the caller's request, and the reachable route (ValidateWorkerDeploymentVersionComputeConfig, registered as a read-only namespace operation) exercises that code during configuration validation, so no worker deployment, scaling decision, or unusual request sequence is required. Vendor fixes are available in v1.31.5 and v1.32.2; no public exploit identified at time of analysis, and the priority comes from stock 1.31.0-1.31.2 deployments permitting every registered compute provider by default when workercontroller.compute_providers.enabled is unset, not from observed exploitation.
Denial of service in the Eclipse ThreadX NetX Duo NetX Secure DTLS server (versions 6.0 through 6.5.2.202603a) lets remote, unauthenticated attackers exhaust the application-configured session pool by sending one spoofed datagram per forged source address or port, locking legitimate DTLS clients out of service. Sessions are allocated before the HelloVerifyRequest cookie exchange and are never reclaimed by the library when a handshake stalls or times out, so the denial persists until the application resets the affected sessions and can last indefinitely if it never does. Confidentiality and integrity are unaffected; no public exploit code was identified at time of analysis, though the low session counts typical of embedded targets mean only a handful of forged datagrams are needed.
Unauthenticated access to calendar and contact data in cPanel/WHM lets remote attackers read the calendar and contact data of any mail account by supplying a crafted NUL byte that bypasses input neutralization. Affected deployments are cPanel/WHM servers exposing the calendar and contact (CalDAV/CardDAV) functionality, and exploitation requires only network reachability to the service, with high confidentiality impact but no modification or disruption. No public exploit code or confirmed active exploitation appears in the supplied sources, all of which are vendor and NVD references; the referenced vendor advisory is dated October 20th, 2026, and the vulnerability is tagged as an information disclosure issue.
Authentication bypass in Johnson Controls EasyIO Neo EC (firmware EC 3.3b62 through EC 3.3b63) and CW Edge Controller (CW 3.3b24 through CW 3.3b25) can let an attacker reach functionality through a channel that does not enforce the same authentication checks as the normal path, with high confidentiality, integrity and availability impact on the controller. The vendor rates it 8.7 under CVSS 4.0 but also scores high attack complexity, a required attack precondition, high privileges and active user interaction, prerequisites that sit awkwardly with the 'authentication bypass' label; the independent assessment instead models it as network-reachable with no privileges and no user interaction, so the true privilege and precondition requirements should be confirmed with Johnson Controls. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; priority is this_week.
A NULL pointer dereference in the Eclipse ThreadX NetX Duo IPv6 stack lets an unauthenticated sender on the network crash the IP helper thread and stop all packet processing. The ICMPv6 Packet Too Big handler stores the entry returned by _nx_icmpv6_dest_table_add without checking the status, so once a sender fills the destination table with messages quoting distinct destinations, the next message dereferences NULL; measured on the ThreadX Linux port this is the 9th such message with the default table of 8 (the 33rd with a table of 32). Only builds that enable both FEATURE_NX_IPV6 and NX_ENABLE_IPV6_PATH_MTU_DISCOVERY contain the vulnerable code, and path MTU discovery is off by default; no public exploit code was identified at time of analysis, and the vendor shipped a fix in 6.5.2.202603b, making this a conditional availability risk that should be patched this week rather than an emergency.
Remote code execution in Control Web Panel (CWP) installations running a webpanel_version earlier than 1.16 allows an authenticated user-panel account with access to the phpini_editor module to execute arbitrary OS commands and write files to attacker-chosen paths. Both abused actions are standard module functionality: acc=update feeds an attacker-supplied path into file_put_contents without confinement, and acc=addlabelphpiniadv passes unsanitized input into shell_exec without escaping. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity and availability impact with PR:L, meaning a valid low-privileged panel credential is the gating prerequisite; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, but a vendor patch exists and the finding is triaged as a this-week priority.
An authenticated low-privileged Control Web Panel (CWP) user can abuse path traversal in the module parameter handled by services/users/index.php to include arbitrary local .php files on installations running webpanel_version before 1.16. The module name is concatenated directly into a PHP include path with no allowlist, basename() call, or traversal filtering, so whether the flaw escalates to code execution depends on a local .php file whose contents the attacker can influence; no public exploit was identified at time of analysis. Exploitation requires a valid CWP session (PR:L) rather than being fully unauthenticated, and the vendor has released version 1.16 to close the issue, making this a genuine priority for the week rather than an emergency.
Cross-workspace authorization bypass in Jpom through 2.11.12 allows an authenticated user holding SSH command execute permission in one workspace to run commands on SSH hosts in other workspaces by submitting foreign command-template and SSH-node IDs to POST /node/ssh_command/batch. The endpoint resolves both IDs without workspace ownership filtering, so the request executes using the target hosts' stored SSH credentials; practical impact depends on a multi-workspace deployment that has command templates and SSH nodes configured elsewhere. CVSS 8.7; no public exploit identified at time of analysis; a vendor fix is available.
Cross-workspace authorization bypass in Jpom through 2.11.12 allows an authenticated user who holds Docker permission in any one workspace to manage Docker hosts registered in other workspaces by supplying a foreign Docker asset id. Successful abuse gives control of containers, images, volumes and networks on the targeted host, including the ability to create privileged containers with host bind mounts. Exploitation requires a multi-workspace (multi-tenant) deployment with at least one Docker host registered in another workspace; no public exploit code was identified at time of analysis, and the issue is rated this_week priority rather than an emergency.
Incorrect authorization in madong-admin-saas through 5.1.4 lets a tenant user replay their login JWT against /platformapi controllers in multi-tenant deployments, where the middleware's platform-admin type check was skipped, allowing creation of platform administrator accounts, reading of tenant database settings, and control over every tenant. Only instances running with multi-tenant mode enabled (config('tenant.enable') true) are exposed; single-tenant deployments reject non-platform tokens correctly. Exploitation requires a valid low-privilege tenant account (PR:L per the assessed vector), and no public exploit code has been identified at time of analysis; the vendor patch is available as an upstream commit.
OpenCSG CSGHub through v2.6.0-ce allows unauthenticated remote attackers to read files from private model, code, and space repositories by abusing the public file resolve route. The flaw is an authorization bypass (CWE-639) in which a percent-encoded current_user parameter injected into the file path is forwarded by the portal to the backend with the portal's server API key, causing the backend authorization check to trust the attacker-controlled identity. Published severity is CVSS 8.7 (CVSS 4.0), with assessed impact limited to high confidentiality loss; no CISA KEV entry is provided, a public technical write-up exists but working exploit code is not confirmed, and no fixed version is identified in the supplied sources.
Authenticated remote code execution affects Zoho ManageEngine EventLog Analyzer and ManageEngine Log360 in all builds before 13062, where a user holding high privileges can inject operating system commands through the Log Forward configuration option. Because the flaw is network-reachable and requires no user interaction, an attacker who already holds admin-level credentials or a privileged session can turn log-forwarding configuration into arbitrary command execution on the host, with high confidentiality and integrity impact across a scope change. Priority is assessed as this_week rather than an emergency: no public exploit code has been identified at time of analysis, and exploitation depends on first obtaining privileged access to the product's management interface. The precise injectable input within Log Forward is not described in the available sources.
Blind SQL injection in the WSO2 API Manager Admin REST API allows an authenticated administrator to inject insufficiently sanitized input into the structure of executed SQL statements, letting the attacker infer database contents and potentially degrade or take down the database service. Tracked as CVSS 3.1 8.7 High (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H, CWE-89), the flaw affects WSO2 API Manager together with the related WSO2 API management components listed in the CPE data - Traffic Manager, API Control Plane, Universal Gateway and the Carbon API Management Implementation. The high-privilege prerequisite (PR:H) is the dominant limiting factor: exposure is confined to holders of administrator credentials on the Admin REST API, so realistic risk centers on compromised or abused admin accounts and malicious insiders rather than broad remote attack; no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV.
Path traversal in LobeHub Chat (npm @lobehub/chat, versions 1.84.26 through 2.1.48) lets any authenticated user write arbitrary files with attacker-controlled content: the file.createFile tRPC procedure stores an unsanitized name containing '../' sequences in the files.name database column, and a later document-parse call feeds that value into path.join() inside writeTempFile(). Because the write primitive is unrestricted within the application user's permissions, an attacker can overwrite an executed file such as startServer.js and gain code execution after a container restart, or corrupt critical application files to cause persistent crash loops and denial of service; multi-tenant deployments are the highest risk since any tenant user reaches this path, and self-registration turns it into an effectively unauthenticated attack. A detailed public proof-of-concept, including a demonstration video, is published in the project's GitHub security advisory; the issue is not listed in CISA KEV and no confirmed active exploitation has been reported, and the vendor shipped a fix in 2.1.49.
Path traversal in Network-AI through 5.15.4 lets an attacker who controls the path passed to InputSanitizer.sanitizePath() escape the intended sandbox by supplying a sibling directory whose name shares the base directory's string prefix, enabling file read or directory listing outside the base; the advisory argues write outside the base is also possible, but that primitive is not demonstrated. The flaw requires a consuming application to use this helper as its terminal path validation with attacker-influenced inputPath and a basePath set to the sandbox root, and it is limited to prefix-sharing sibling layouts because classic ../../../ traversal is still rejected. The advisory includes a public proof-of-concept reproduction script, not verified as working exploit code; no CISA KEV active-exploitation status is indicated in the supplied data, and the independent assessment scores confidentiality impact as high with no integrity or availability impact.
Path traversal in Network-AI's AgentVCR component lets a caller who controls the cassette name passed to load() or save() read arbitrary .json files or overwrite them anywhere the Node.js process has filesystem permissions. Versions 5.13.4 through 5.15.4 of the npm package network-ai are affected; 5.15.5 is the first release containing the fix. The impact is a confidentiality and integrity breach confined to paths ending in .json: an attacker can disclose secrets held in JSON configuration and, per the upstream advisory, overwrite AuthGuardian trust-level configuration to obtain a grant an operator's policy had denied, or corrupt the active-grant store to invalidate legitimate agents' tokens - no code execution path was demonstrated. Exploitation depends on the consuming application deriving cassette names from an untrusted source, requires some privilege within the orchestration (CVSS PR:L), and the upstream advisory itself publishes a reproducible proof-of-concept script demonstrating the file-read primitive; no confirmed active exploitation is reported.
Path traversal in Network-AI's FileJobStore lets a low-privilege authenticated attacker who controls a job id read or delete arbitrary .json files under the process's filesystem permissions in network-ai 5.13.4 through 5.15.4. The advisory shows how traversal sequences such as ../../some-config reach readFile or unlink through FileJobStore.get(), FileJobStore.delete(), JobQueue.getJob(), or JobQueue.cancel(), exposing credentials, grant tokens, and configuration that can weaken AuthGuardian authorization; no remote code execution was demonstrated. This is a credible this-week priority when job management is exposed to untrusted requests, but active exploitation is not confirmed (not in CISA KEV) and the advisory includes a proof-of-concept script.
OS command injection in Control Web Panel (CWP) versions before 1.30 lets attackers who can reach the loopback-bound /valid_token/ API route run arbitrary commands as root by placing shell metacharacters in the unvalidated 'user' parameter, which is passed unescaped to shell_exec(). Reachability is the gating factor: the route is bound to the loopback interface, so exploitation requires local host access or an intermediary such as an SSRF primitive, a misconfigured reverse proxy, or a co-tenant process that can reach 127.0.0.1 - no authentication or user interaction is enforced once the endpoint is reachable. No public exploit code or CISA KEV entry is present in the available data; the vendor has published a fix in the 1.30 changelog and the vulnerability is tagged for remediation this week.
OS command injection in Control Web Panel (CWP) versions before webpanel_version 1.30 lets an attacker who can reach the loopback-bound database restore API route /v1/restoredatabase/ run arbitrary operating system commands as root. The restoreDBBackup() handler takes an attacker-supplied file path from the POST body and passes it into a shell command without escaping, so shell metacharacters in that path are executed with the panel's root privileges. Exploitation is unauthenticated and requires no user interaction, but per the assessed vector (AV:L) the route is reachable only from the CWP host itself - a local account or process, or a chained path such as SSRF to 127.0.0.1 - rather than directly from the internet; no public exploit code was identified at time of analysis, and a vendor fix is available in version 1.30.
LaraDashboard through 1.4.2 lets any administrator holding the ordinary settings.edit permission - which the default Admin role carries - reach Superadmin-only core-upgrade functionality, so a low-privileged admin can create and download full backups that include the application source and database/backup.sql with password hashes, and can trigger restore, delete-backup or core-upgrade operations against the site. The root cause is an incorrect authorization check in SettingPolicy, not an unauthenticated weakness: exploitation requires a pre-existing non-Superadmin Admin account, needs no user interaction, and has low attack complexity against default deployments. The vendor fixed the issue in v1.4.5, and the GitHub advisory includes a public proof-of-concept reproduction script that has not been independently verified as working exploit code; the supplied intelligence contains no CISA KEV listing or other confirmed active-exploitation signal.
Missing authorization in the Codestar backup AJAX handlers (csf-export, csf-import, csf-reset) of the Product Gallery Slider & Additional Variation Images for WooCommerce plugin, versions 2.3.23 up to but not including 2.3.26, lets a user holding the Shop Manager role read, overwrite or delete arbitrary WordPress options by supplying an attacker-chosen option name through the 'unique' parameter. Because wp_user_roles is itself an option, a Shop Manager can rewrite role capabilities and elevate to full administrator. Exploitation requires an authenticated Shop Manager (or higher) account that can view the plugin settings page to harvest the csf_backup_nonce, so anonymous visitors, subscribers and customers cannot reach it; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, placing practical risk on stores that delegate Shop Manager to semi-trusted staff. A vendor patch is available in 2.3.26.
Stored cross-site scripting in the Helix Ultimate template framework for Joomla (all versions below 2.2.11) lets an authenticated, low-privileged backend user persist script through the Media Picker that then executes in the browser of another user who views the affected page. The reporter (Joomla) rates it CVSS 4.0 8.6 High, while our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) scores it lower because exploitation needs a backend foothold plus victim interaction, and the practical impact scales with the privilege of whoever renders the payload - an administrator viewing the poisoned page is the worst case, equal- or lower-privileged users are far less damaging. It is prioritized for remediation this week; no public exploit code and no CISA KEV entry were identified at time of analysis.
Code injection (CWE-94) in the StageIt extension for Joomla, published by php-web-design.com, allows an attacker who already holds high-privilege access to the Joomla administrator back end to have attacker-controlled configuration 'setting string' values interpreted as code, yielding high impact to confidentiality, integrity and availability (CVSS 8.6; CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Affected builds are StageIt 1.0 through 5.7.5 and 6.0 through 6.3.5; sites on other versions are out of scope. The flaw is not reachable by an unauthenticated remote user and requires no victim interaction once administrative access exists - the dominant limiting factor is the PR:H privilege prerequisite, and no public exploit code or CISA KEV entry is associated with this CVE at time of analysis (priority label: this_week).
Stored cross-site scripting in the Mega Menu Badge Text field of the Helix Ultimate template/framework for Joomla before version 2.2.11 lets an authenticated Joomla user with menu or template management privileges plant script that executes when another user - typically an administrator or editor - views a page or admin screen rendering the affected badge. The flaw is CWE-79 and applies only where the Mega Menu feature is actually in use with a badge configured on a menu item; our assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, meaning privileged authoring access plus victim interaction rather than unauthenticated remote exploitation. No public exploit code or confirmed active exploitation was identified in the available sources; the vendor has released version 2.2.11 as the fixed release.
Authenticated OS command injection in the timezone configuration field of Barracuda Email Security Gateway, Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver and WAF Control Center allows an administrator-level user to run arbitrary commands as root once the crafted timezone value is processed. The flaw is scored 8.6 under CVSS 4.0 (AV:N/AC:L/PR:H/UI:N with high confidentiality, integrity and availability impact) and was reported by Mandiant, with priority guidance placing remediation in the current week. No public exploit code has been identified at time of analysis, but the companion Barracuda advisory also documents a pre-authentication authorization bypass, so the administrator prerequisite may be removable by chaining and should not be treated as a reliable mitigation.
Unauthenticated SQL injection in Control Web Panel (CWP) before webpanel_version 1.16 allows attackers who can reach the loopback API authentication gate access_token() to read arbitrary MySQL database contents and forge authentication results, bypassing the API's authentication check. The flaw is rated CVSS 8.5 (CVSS 4.0 AV:L/AC:L/PR:N/UI:N) and requires reaching the loopback/localhost interface, so local access or a pivot such as SSRF is needed; no public exploit identified at time of analysis.
Heap buffer overflow in QuickJS-NG releases before 0.16.0 gives JavaScript code a path to memory corruption on 32-bit hosts: a Proxy whose ownKeys trap reports an array-like result with a length near 2^32 wraps a 32-bit property count in js_proxy_get_own_property_names(), so the buffer allocated for enumerated keys is far smaller than the number of entries later copied into it. Only 32-bit deployments are affected - the GHSA states explicitly that on 64-bit platforms the allocation size is correct and the overflow does not occur - and the attacker must already be able to execute JavaScript inside the embedding host (CVSS 4.0 AV:L/PR:L), with no user interaction required once script runs. Successful exploitation corrupts heap metadata and can crash the host or potentially lead to code execution; there is no CISA KEV listing and no public exploit identified at time of analysis, though the upstream fix commit includes regression tests that demonstrate the trigger. Vendor-released patch: 0.16.0.
Heap buffer overflow in Netpbm's jbigtopnm converter allows a crafted multi-plane JBIG file with large header dimensions to trigger an integer overflow while calculating the output buffer size, after which jbg_dec_merge_planes() overruns the undersized heap allocation, causing crashes or potentially code execution. Affected releases are Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08. The issue is local with user interaction required to process the file, CVSS 4.0 rates it 8.5, no public exploit was identified at time of analysis, and vendor patches are available.
Heap buffer overflow in Netpbm's xpmtoppm converter allows an attacker who supplies a crafted XPM file with a characters-per-pixel value greater than 3 to overwrite fixed 3-byte colorName hash entries, causing crashes or potentially code execution. Affected versions are Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08; the assessed vector is local with no privileges and requires the victim or an automated workflow to run xpmtoppm on the hostile file. No public exploit was identified at time of analysis, and vendor patches are available for all three branches.
Stack-based buffer overflow in Netpbm's picttoppm converter allows a crafted PICT file to overflow the fixed-size coord stack array in scanPoly() once polygon edges produce more than 5000 coordinate points, crashing the converter or potentially allowing code execution in the context of the process that parses the image. The flaw affects Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08, is rated 8.5 under CVSS 4.0 (CWE-121), and is a local-vector issue with passive user interaction because the victim must deliberately run picttoppm on the attacker-supplied file; no public exploit has been identified at time of analysis. The vendor has shipped fixes and the priority decision places remediation in this week, but the exposure is a locally exploitable file-parsing memory-corruption bug rather than a remotely reachable one, since picttoppm is a specific conversion utility rather than a listening service.
Stack-based buffer overflow in Netpbm's picttoppm PICT-to-PPM converter lets an attacker who supplies a crafted PICT file containing a polygon with more than 100 points overwrite the fixed-size pts array in paintPoly(), crashing the converter and potentially achieving code execution in the context of the converting process. Only Netpbm builds before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 are affected, and exploitation requires picttoppm to actually be run on the malicious file (CVSS AV:L with UI:P), so exposure is limited to users and automated image-conversion pipelines that process untrusted PICT input. Vendor fixes are published for all three branches; no public exploit code was identified at time of analysis, and the case is triaged as this_week rather than an emergency.
Heap memory corruption in Netpbm's winicontopam converter affects releases before 10.86.51, 11.02.30, and 11.15.08, where a crafted ICO/CUR file declaring a width or height above 32767 wraps the signed int16_t row/column loop counters negative and drives writes through negative row buffer indices. The assessed vector is local (AV:L) with passive user interaction (UI:P) and no privileges required, so exploitation only occurs when a user, or a server-side or batch pipeline, runs winicontopam on attacker-supplied icon input; the confirmed outcome is a crash, with arbitrary code execution described only as a potential, non-demonstrated consequence. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available in all three maintained branches.