Alo Suite's user-invitation workflow can assign administrative privileges to a newly invited account because the '/Requests/userInvitation' endpoint does not enforce privilege-assignment checks server-side. An attacker who can intercept and alter invitation parameters may escalate privileges; the supplied CVSS vector requires low privileges (PR:L), while the description says unauthenticated, so the precise prerequisite remains unresolved and should be verified against the INCIBE advisory. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated command injection in ZohoCorp ManageEngine Key Manager Plus builds before 7151 allows a logged-in user to run arbitrary operating-system commands by supplying malicious input while configuring a Microsoft Certificate Authority integration. The vendor's CVSS vector rates confidentiality and integrity impact High with availability impact None (8.1), while our independent assessment also scores availability as High. There is no KEV entry and no public exploit identified at time of analysis, so this is a prioritised fix for exposed, internet-reachable deployments rather than an emergency, but the practical barrier is only a valid low-privileged session plus reachability of the CA-configuration feature (PR:L, UI:N), and no fixed build other than 7151 is documented.
Deserialization of untrusted data in labbench before 0.46.1 allows arbitrary code execution when a user loads a crafted .p or .pickle file through read() or read_relational(). The library's auto-format dispatch selected pandas.read_pickle on the file extension alone, so a malicious pickle file - or a relational data archive containing one - runs attacker-controlled code with the permissions of the loading user. Exploitation requires user interaction (the victim must open the supplied file), the vector is local rather than network-facing, and no public exploit has been identified at time of analysis; the vendor fixed the behavior in 0.46.1 by refusing pickle auto-loading unless the LABBENCH_AUTOLOAD_PICKLE environment variable is explicitly set.
Privilege escalation in the Eclipse ThreadX Module Manager (versions 6.0.1 through 6.5.2.202603) lets a user-mode, memory-protected module post a forged callback request into another module's callback request queue, and the receiving module's callback thread invokes the attacker-supplied function pointer without verifying that the Module Manager sent the request. Where the targeted receiving module runs in privileged mode, a user-mode module therefore achieves execution at kernel privilege, defeating the isolation the Module Manager is meant to enforce; against a user-mode receiving module the attacker can still run code in that module's context or fault and drain its callback thread. The flaw is local-only and requires the attacker to already be able to load or control a memory-protected module (CVSS 4.0 base 8.5, PR:L), and no public exploit code was identified at the time of analysis, although the reporter reproduced the escalation on a Cortex-M3 target under QEMU. A vendor fix is available in ThreadX 6.5.2.202603b.
Memory corruption in Solanum IRCd's server-to-server KILL handler (ms_kill) lets an attacker who controls a linked peer server crash the ircd and potentially execute code by sending a kill reason longer than KILLLEN, which overflows a static 512-byte buffer. Only builds prior to commit 2ea1382 are affected, and the flaw is not reachable by ordinary IRC clients - the attacker must already hold an established, trusted server-to-server link (the CVSS 4.0 vector rates PR:H for this reason). A vendor patch exists via PR #550 / commit 2ea1382, and no public exploit code was identified at the time of analysis.
Heap-based memory corruption in the Solanum IRC daemon (builds from before commit 2ce64de) lets a malicious linked server corrupt process memory by sending JOIN or SJOIN messages whose channel names exceed CHANNELLEN, crashing the ircd and potentially yielding remote code execution. The flaw sits on the server-to-server path of a federated network: the attacker must already control a server that is peered into the target Solanum network, so ordinary unauthenticated IRC clients cannot reach it, and the assessed CVSS 3.1 vector (PR:H) reflects that gating. No public exploit identified at time of analysis; the upstream fix is available as a commit and pull request rather than a confirmed tagged release, and the priority signal places it in this_week rather than an emergency tier.
Arbitrary physical-memory read and write is reachable through an exposed IOCTL in the ALCPU Core Temp Windows kernel driver, which performs insufficient access control on that control path (CWE-782). The attack is local: an attacker needs an existing session on a Windows host where the Core Temp driver is installed and loaded, after which invoking the affected IOCTL can yield physical-memory read/write and, in practice, kernel/SYSTEM-level compromise. Severity is moderate on paper (vendor CVSS 6.7, assessed 6.7) but the impact is total once the interface is reached; the vendor vector marks PR:H while the independent assessment scores PR:L based on the insufficient-access-control description, and that privilege discrepancy is not resolved by the available sources. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the trigger conditions are only partially described in the available sources.
Missing integrity verification in the HPE Aruba Virtual Intranet Access (VIA) client lets a low-privileged local attacker execute arbitrary code with elevated privileges on the underlying host operating system. The flaw is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, 8.4): the attacker must already hold a foothold on the machine and the VIA client must be installed, but no user interaction is needed and the scope change (S:C) means impact crosses into the host OS beyond the client itself. No public exploit code and no confirmed active exploitation were identified at time of analysis; the priority label is this_week and the practical risk is bounded by the requirement for pre-existing local access.
Remote code execution in SolarWinds Dameware can be triggered by an authenticated low-privilege user who satisfies high-complexity preconditions, through insufficient input validation that leads to a buffer overflow. The CVSS 8.4 rating reflects network reachability (AV:N), PR:L authentication, no user interaction (UI:N), and high confidentiality, integrity, and availability impact; the exact vulnerable feature and the additional AC:H preconditions are not described in available sources. Upgrade to the vendor-released Dameware 2026-3-1 build to remove exposure; no public exploit identified at time of analysis, and the this_week decision label indicates a high-priority but not drop-everything response.
Symlink following in Docker Sandboxes' `sbx cp` command allows a malicious sandbox to redirect a user-initiated copy outside the shared workspace, pulling host files into the sandbox or pushing sandbox-controlled content onto host paths with the invoking user's permissions. All releases prior to v0.51.0 are affected (CPE `docker:docker_sandboxes:*`), and exploitation is conditional: an attacker must already be running code inside a sandbox that shares a workspace with the host, plant a symlink there, and wait for the user to run `sbx cp` (UI:R, PR:N, AV:L). Impact is high for confidentiality and integrity but bounded by the invoking user's own filesystem permissions; there is no public exploit identified at time of analysis and no CISA KEV entry, and v0.51.0 strengthens workspace-copy and credential protections per the vendor release notes.
Arbitrary command execution in nnn through 5.3 (CVSS 8.4 High) occurs when the togglex plugin processes selected filenames containing a double quote and shell syntax, allowing an unauthenticated local attacker who can plant such a filename to run commands as the user invoking togglex. The victim must actively run togglex on a selection that includes the malicious file; simply opening the directory is not enough, and there is no remote or unauthenticated network path. No public exploit was identified at time of analysis, and an upstream fix commit is referenced (released patched version not independently confirmed).
Arbitrary code execution outside the Chrome sandbox can result from a race condition in the ANGLE graphics component of Google Chrome versions prior to 157.0.8103.38. A remote unauthenticated attacker can attempt to trigger the flaw by convincing a victim to open a crafted HTML page, but exploitation requires user interaction and a high-complexity timing win (CVSS 3.1: AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, score 8.3); no public exploit was identified at time of analysis, and there is no CISA KEV confirmation. Chromium's own security severity is Low, which conflicts with the higher CVSS impact and should be weighed carefully.
Sandbox escape in Google Chrome's Extensions component affects all versions prior to 157.0.8103.38 and lets a remote attacker who has already compromised the renderer process execute arbitrary code outside the browser sandbox once a victim loads a crafted HTML page. The underlying flaw is an incorrect-authorization error (CWE-863) scored 8.3 under CVSS 3.1 with a scope change, but exploitation is gated by the need for a separate renderer compromise and by user interaction, which is why attack complexity is rated high and Google assigns it Chromium severity Medium. No public exploit has been identified at time of analysis, CISA's SSVC assessment records exploitation as none, and the only complete remedy stated in the available evidence is updating to Chrome 157.0.8103.38 or later.
Sandbox escape in Google Chrome prior to 157.0.8103.38 stems from an integer overflow in the GPU component and can let an attacker who already controls the renderer process execute arbitrary code outside the browser sandbox via a crafted HTML page. The issue is rated CVSS 8.3 but requires user interaction and a separate renderer compromise, so it is a chained rather than standalone attack; no public exploit is identified at the time of analysis. Google has released Chrome 157.0.8103.38 as the fixed build.
A use-after-release flaw in Chrome's GPU component (CWE-672) lets an attacker who has already compromised the renderer process potentially execute code outside the sandbox by getting the victim to load a crafted HTML page, affecting Chrome versions below 157.0.8103.38. It is a chained second-stage sandbox escape rather than standalone remote code execution: a prior renderer compromise is a hard prerequisite, user navigation to attacker content is required (UI:R), and the released-resource reuse must be won reliably, giving high attack complexity (AC:H) despite the 8.3 score and scope change. No public exploit or active exploitation is indicated - SSVC records Exploitation: none and Automatable: no - and vendor patches are available.
Google Chrome before 157.0.8103.38 contains an out-of-bounds read in the Skia graphics library that can serve as a sandbox-escape primitive once the renderer process is already compromised. A remote attacker must first achieve renderer compromise and persuade the victim to load a crafted HTML page; successful chaining can execute arbitrary code outside the sandbox. No public exploit was identified at time of analysis, and the vendor has released Chrome 157.0.8103.38 as the fix; the available signals indicate a genuine but non-emergency this_week priority.
Sandbox escape via a use-after-free in Google Chrome's Aura component affects builds prior to 157.0.8103.38 and can let a remote attacker who has already compromised the renderer process potentially execute arbitrary code outside the sandbox when a victim loads a crafted HTML page. The CVSS vector is 8.3 with PR:N but AC:H and UI:R, and the independent assessment emphasizes that this is a second-stage, multi-bug-chain risk rather than a standalone drive-by. No public exploit was identified at time of analysis, and SSVC records exploitation as none; the vendor-released fix is Chrome 157.0.8103.38 or later.
Chrome on iOS before 157.0.8103.38 contains an improper privilege management flaw in the Navigation component that lets an attacker who already holds a compromised renderer process escape the renderer sandbox and execute arbitrary code outside it. The attack path is not standalone: it requires a separate renderer compromise as a precondition plus victim navigation to a crafted HTML page (UI:R), and the resulting code execution remains inside the iOS application sandbox rather than the host. No CISA KEV listing and no public exploit code were reported; vendor patches are available and CISA's SSVC assessment marks exploitation as none with automatable set to no, while technical impact is rated total and Chromium rates the issue High severity.
An out-of-bounds read in Chrome's Internals component (CWE-125) lets a remote attacker who has already compromised the renderer process escape the sandbox and potentially execute arbitrary code outside it, triggered when the victim loads or interacts with a crafted HTML page. All Chrome builds prior to 157.0.8103.38 are affected; the vendor has released a fix in 157.0.8103.38. The flaw is not a standalone remote bug - it must be chained with a separate initial renderer compromise, requires user interaction, and carries high attack complexity; CISA SSVC records no observed exploitation and non-automatable status, and no public exploit code was identified at time of analysis.
Sandbox escape in Google Chrome's GPU component (all versions prior to 157.0.8103.38) lets an attacker who has already compromised the renderer process execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. The flaw is improper state validation in GPU handling (CWE-754); the trigger mechanism beyond 'crafted HTML page' is not described in the available sources. There is no public exploit identified at time of analysis, the issue is not in CISA KEV, and SSVC records Exploitation: none with Automatable: no - the 8.3 score is driven by the total technical impact of a successful sandbox escape, not by observed activity, and realistic risk is lowered by the mandatory prior renderer compromise, required user interaction, and high attack complexity.
An out-of-bounds read in Chrome's Permissions subsystem (CWE-125) lets an attacker who already controls the renderer process pivot to code execution outside the sandbox when a victim loads crafted HTML, affecting Chrome builds prior to 157.0.8103.38. The bug is a second-stage sandbox-escape primitive rather than a standalone entry point: exploitation requires a pre-existing renderer compromise (AC:H) plus user interaction (UI:R), which the authoritative assessment weights heavily against real-world risk despite a CVSS of 8.3 and scope change to Confidentiality/Integrity/Availability High. There is no confirmed active exploitation (SSVC Exploitation: none) and no public exploit identified at time of analysis, and a vendor patch is available.
Improper certificate validation in an affected interface of HPE Networking Fabric Composer could allow an unauthenticated, network-adjacent attacker to intercept sensitive information when preconditions outside the attacker's control are satisfied. The supplied data does not identify specific affected versions or the exact interface, and no public exploit was identified at time of analysis; there is no CISA KEV confirmation. The assessed impact is high confidentiality loss with low integrity impact and no availability impact, while high attack complexity and attacker-uncontrolled preconditions temper practical risk.
Server-side request forgery in the Tapo Cloud MQTT proxy allows remote attackers to make TP-Link's cloud backend issue requests to a host they control, because the proxy accepts a user-controlled host value without sufficient input validation. The exposure sits in the vendor-operated Tapo Cloud service rather than in customer firmware, and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) indicates no privileges or user interaction are needed while confidentiality impact and scope change carry the most weight; TP-Link itself reported the flaw. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and vuln.today tracks it as a 'this_week' priority rather than an emergency, with the vendor's high attack-complexity rating whose cause is not described in the available sources acting as the main limiting factor.
Tapo Cloud's MQTT broker fails to bind a proxy token request to the authenticated device, so an attacker who owns an authenticated Tapo device and knows another device's ID can obtain a token scoped to that victim and upload content into the victim's Tapo Cloud storage, where it may appear as a legitimate Tapo event. The flaw is in the cloud service itself (CWE-862), and the independent assessment rates it CVSS 3.1 8.3 with an authenticated attacker-owned device as a prerequisite. No public exploit was identified at time of analysis.
Authenticated path traversal in Yeti (YETI threat-intelligence platform) prior to 2.5.1 lets a low-privileged, non-admin user read and write arbitrary files as the service account. The ExportTask 'name' field is converted into a storage file name without stripping path separators or '..' segments, so a task named with traversal sequences is joined straight onto the configured local export directory; retrieving the export content returns the traversed file, and running the export writes attacker-controlled output to an attacker-chosen writable path. Exploitation requires a valid account (no admin role), the default local file storage backend, and service-account filesystem permissions on the target paths; universal code execution is not established, and no public exploit code or active exploitation is reported at time of analysis.
bbs-go through 4.4.6 disables TLS certificate verification when sending SMTP email, so a network-positioned attacker who can intercept the connection between the bbs-go server and its configured mail server can present any certificate and be trusted. Interception exposes SMTP PLAIN authentication credentials and lets the attacker read or tamper with outgoing password-reset and account-verification messages. The flaw requires an active man-in-the-middle position plus a bbs-go deployment that sends mail over a TLS/STARTTLS SMTP connection; no authentication or user interaction against bbs-go itself is needed once that position exists, and no public exploit code was identified at the time of analysis.
Nodemailer 3.0.0 through 10.1.3 misparses angle-addresses in its addressparser, letting a crafted recipient value such as `<"a@evil.com>"@good.com>` validate as an allowed domain but be delivered to an attacker-chosen domain. The flaw crosses the application's recipient allow-list boundary, disclosing whatever message content the application sends, and also affects standalone parser consumers such as mailparser. Exploitation additionally requires an application that both passes attacker-influenced address text to Nodemailer and enforces a domain allow list validated with a conformant parser; no application access or user interaction is needed, and a public proof-of-concept reference exists but is not verified as working exploit code. No public exploit has been identified at time of analysis, EPSS is unavailable in the provided data, and the reported severity is 8.3 (CVSS 4.0).
Nodemailer 3.0.0 through 10.1.3 contains a recipient-injection flaw in its bundled addressparser: a semicolon inside a quoted display name or comment inside an RFC 5322 group terminates the group early, so text a conformant parser treats as display text is re-parsed as a live recipient address. An application that validates user-supplied recipient lists with a conformant parser and then hands the same text to Nodemailer can be made to deliver mail to an attacker-chosen address outside its allow list - for example `G: (a; <evil@evil.com>) <v@victim.com>;` is approved as v@victim.com but resolved by Nodemailer to evil@evil.com, disclosing message content and suppressing delivery to the intended recipient. The vendor fixed this in 10.1.4; a public proof-of-concept reference is documented in the GitHub advisory, and no confirmed active exploitation or public working exploit code was identified at time of analysis.
Nodemailer's addressparser (versions 3.0.0 through 10.1.3) terminates a nested RFC 5322 comment at the first closing parenthesis instead of the one that closes the outermost comment, so a value such as `Victim (x(y) <evil@evil.com>) <v@victim.com>` - which conformant parsers read as the address v@victim.com - is parsed by Nodemailer as evil@evil.com. Unauthenticated remote attackers who can influence address text handed to sendMail, or the From/To header of an inbound message parsed with mailparser, can therefore redirect mail intended for an approved recipient to an attacker-chosen domain or make a mailparser-based layer disagree with a conformant DMARC/display check about the author of the same message, crossing recipient allow-list and sender/author boundaries. The vendor advisory publishes a PoC reference (a code snippet demonstrating the mis-parse); it is not verified as working exploit code, no active exploitation is confirmed, and the practical impact is bounded to deployments that actually enforce conformant validation plus an allow list or author check. Fixed in 10.1.4.
Response mispairing in the MongoDB Node.js driver can return one request's database reply to a different request, potentially disclosing other users' records and producing incorrect results or failed legitimate requests when an application enables the optional client-side operation timeout. An unauthenticated remote party able to send ordinary requests through such an application can trigger the condition, but exploitation is opportunistic and timing-dependent because an earlier operation must time out and leave data outstanding on a pooled connection. No public exploit or active exploitation is identified in the available data, and the decision label is this_week rather than emergency.
Local privilege escalation in HPE Networking Fabric Composer (CVSS 8.2) lets an attacker who already holds high privileges in the product elevate to higher privileges on the underlying host operating system. Exploitation requires local access and no user interaction, but the pre-existing high-privilege requirement is a significant gate; no public exploit identified at time of analysis, and the HPE advisory is the authoritative source for affected builds.
PII exposure in loggingredactor before 0.0.7 allows sensitive values returned by custom __str__ or __repr__ methods to appear unmasked in logs that are expected to redact them. This affects Python applications that use the library's logging filter and that log non-primitive/custom objects whose string representations contain PII; a party able to read the resulting logs can obtain the exposed data. Vendor-released patch: 0.0.7; no public exploit identified at time of analysis.
DLL hijacking in SolarWinds Dameware installers lets a local attacker who can write a malicious DLL into a location searched by setup execute code in the installer's context when a victim runs the installation. The issue is limited to installation time and is not exploitable against an already-installed or running Dameware instance; the CVSS 8.2 score reflects high confidentiality, integrity, and availability impact plus a scope change, not remote reachability. The vector requires local access and user action to launch the installer, and the description additionally cites admin privileges; no public exploit was identified at time of analysis.
WPPConnect Server through 2.10.74 allows unauthenticated remote attackers to send arbitrary WhatsApp text or file messages from a connected session by POSTing crafted Chatwoot webhook payloads to /api/:session/chatwoot, a route registered without the verifyToken middleware. Exploitation is constrained: the endpoint must be reachable and the attacker must know or guess a session name whose client is in CONNECTED status; random or secret session names reduce risk, while default or disclosed names make abuse straightforward. No public exploit was identified at time of analysis, and the vendor references an upstream fix in PR #2702.
cordova-plugin-advanced-http 1.5.0 through 3.3.1 on native iOS and Android can leak cookies to a third-party host when a request to an origin with stored cookies is redirected and the plugin's native HTTP stack follows the redirect. The JavaScript layer builds Cookie headers from the plugin cookie jar and passes them as ordinary request headers, so an open or attacker-influenced redirect can forward them across origins; the upstream fix tests also show Authorization and Proxy-Authorization being dropped on cross-origin hops. No public exploit identified at time of analysis; unauthenticated attackers need the app to hold cookies for the original origin and to follow a redirect to an attacker-influenced host.
CPU exhaustion in enshrined/svg-sanitize 1.0.0 occurs when removeRemoteReferences(true) is enabled: crafted SVG CSS containing many unclosed -webkit-image-set( tokens drives super-linear regex matching in stripRemoteCssTokens(), holding a PHP worker for tens of seconds. If PCRE hits its backtrack or JIT limits, preg_replace() returns null and sanitize() throws a TypeError instead of failing closed, so an application that stores the upload before sanitizing in place may retain unsanitized content. The vendor advisory includes a proof-of-concept harness; no CISA KEV entry is indicated, and impact is availability-focused with conditional integrity exposure.
Denial of service in Parse Server (npm package parse-server) lets a remote client terminate the Node.js process by sending an object update whose dot-notation key targets the object identifier of a pointer field on a class that has an afterSave trigger registered. All clients lose service until the server is restarted. The request is unauthenticated (CVSS PR:N) only when the targeted object is writable without a session; otherwise the attacker needs whatever write access the object's ACL/CLP grants, and classes without an afterSave trigger or without pointer fields complete the identical request normally, which bounds the set of exposed deployments. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has released fixes in 8.6.110 and 9.10.6-alpha.2.
FreeRDP clients and freerdp-proxy instances running releases before 3.32.2 can be aborted by an oversized X.224 routing token, which drives the one-byte X.224 length indicator past UINT8_MAX and trips a reachable assertion in tpdu_write_header; with the default eight-byte RDP_NEG_REQ the threshold is a 240-byte token (a 239-byte control does not abort). Impact is availability only and limited to assertion-enabled builds, and the two routes differ in prerequisites: the direct-client path needs the client to connect to a malicious or compromised RDP server that returns a Server Redirection PDU carrying an oversized LoadBalanceInfo which is then reused as a routing token on reconnect, while the proxy path needs freerdp-proxy configured with FixedTarget=true (false by default) and a front peer that negotiates RDP security without RDP_NEG_REQ. This CVE is not in CISA KEV, and the advisory ships a public reproduction harness that is a PoC reference, not verified working exploit code.
Denial of service in FreeRDP before 3.32.2 affects freerdp-proxy deployments that use the dyn-channel-dump module: a malicious or compromised backend RDP target can send dynamic channel data while the front client is disconnecting, triggering a cross-thread use-after-free that crashes the proxy process. The issue is availability-only, with no confidentiality or integrity impact and no indication of code execution, and the timing-dependent race is reflected in the high attack complexity and attack-requirements-present metrics. No CISA KEV entry or public exploit was identified at time of analysis.
Unauthenticated account takeover affects WordPress sites running the SureCart plugin through version 4.9.5, where the passwordless one-time-code login REST route resolves an attacker-supplied login to any WordPress user - including administrators - and issues a valid authenticated session cookie once a six-digit code is guessed. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1), but exploitation depends on knowing or enumerating a target login and sustaining enough request volume to brute-force a roughly one-million-value code space, since the affected code path has no per-account attempt counter and no persistent email/IP lockout, and the upstream CDN throttle is reported to be bypassable through IP rotation. This is assessed as a credible, high-priority issue rather than a CVSS-inflated one, though the practical bar is non-trivial; no public exploit code and no confirmed active exploitation were identified in the available data at time of analysis.
HPE Networking Fabric Composer's API does not adequately limit repeated authentication attempts, so a remote, unauthenticated attacker (CVSS PR:N, UI:N) who can reach the API can hammer user accounts with brute-force guesses and, on success, obtain administrative access to the system (C:H/I:H/A:H). HPE conditions exploitability on 'certain preconditions outside of the attacker's control' that are not described in the available sources, which is the sole reason the vector carries AC:H and the base score lands at 8.1 (High) rather than higher. No public exploit code or PoC reference was identified at time of analysis and the issue is not in CISA KEV, so the practical risk depends entirely on whether those environmental preconditions happen to hold in a given deployment; priority is this_week.
Authentication bypass in HPE Networking Fabric Composer allows an unauthenticated remote attacker to gain administrative access if vendor-stated preconditions outside the attacker's control are met. HPE has not enumerated those preconditions, so the specific configuration or deployment state required is not described in the available sources. No confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Improper certificate validation in the HPE Networking Virtual Intranet Access (VIA) VPN client lets an unauthenticated attacker who can intercept client traffic present a fraudulent certificate, bypass authentication and reach sensitive information, with confidentiality and integrity both rated high. Exploitation is constrained rather than trivial: the attacker needs a man-in-the-middle position between client and VPN gateway, and the victim must initiate the connection (UI:R), which is why our assessment raises attack complexity to AC:H versus the published AC:L. There is no CISA KEV listing and no public exploit identified at time of analysis, making this a this-week priority rather than an emergency on current signals.
OPNsense core before 26.1.11 and 26.4.1p1 allows authenticated Web UI or API users with delegated access to affected settings to inject CR/LF characters into fields expected to hold a single line, causing generated privileged service configuration files to contain extra attacker-controlled directives or policy lines. The confirmed Dnsmasq path can add arbitrary dnsmasq directives through dhcp_boot.filename, dhcp_boot.servername, dhcp_boot.address, and dhcp_options.value, while related fields span OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP/MPD, Monit, firewall, sudo, WebGUI and System General settings, with impact varying by component; Monit mail password and adjacent text fields were demonstrated to reach root command execution, but arbitrary shell execution was not confirmed for Dnsmasq. The GitHub advisory includes a public proof-of-concept reference and lab reproduction steps for the Dnsmasq path, and no CISA KEV entry is present in the supplied intelligence.
Use-after-free in the Linux kernel TCP request-socket path (reqsk_timer_handler) can corrupt kernel memory, giving a remote attacker a possible route to code execution or sensitive-data disclosure on affected kernels. Per the assessed vector (AV:N/AC:H/PR:N/UI:N) no authentication is needed, but the flaw is reachable only when TCP request-socket migration is enabled through the non-default net.ipv4.tcp_migrate_req sysctl and a reuseport/BPF migration attempt fails at inet_ehash_insert(), which narrows the exposed population considerably. A vendor patch is available as upstream stable commit 97c8a3c1f73d828de43a5a88e8a9a143efb2b661; no public exploit identified at time of analysis and no CISA KEV listing is present, so this is a genuine but non-urgent kernel memory-safety issue rather than an active-exploitation emergency.
Use-after-free in the Linux kernel TIPC subsystem: the tipc_node_reset_links trace event calls tipc_node_dump() to walk the node's link array without holding the node lock, so concurrent bearer teardown (tipc_node_link_down/delete=true) can free a link and null the array entry while the dump is in progress, after which tipc_link_dump() dereferences the stale pointer - KASAN reports a slab-use-after-free of size 4. Practical exploitation requires two non-default preconditions, namely that TIPC is enabled and actually in use on the target (it is not loaded by default on typical distributions) and that the tipc_node_reset_links tracepoint is armed, which normally implies privileged tracefs access or an active tracing/monitoring configuration; on top of that the attacker must win a genuine race, so the realistic impact is a locally-buffered memory disclosure and potential denial of service rather than data returned to the remote sender. No public exploit was identified at time of analysis, and vendor patches have been released across the listed stable branches.
Unauthenticated remote attackers can obtain a logged-in WordPress administrator session on sites running the Easy Digital Downloads plugin up to and including 3.7.2 by entering an administrator's email address into a PayPal guest checkout and completing the payment flow, resulting in full account takeover. The plugin trusts the guest-supplied email as proof of identity, rebinds the resulting order to the matching WordPress user, and the PayPal capture handler then issues an authenticated session cookie for that user via wp_set_auth_cookie(). The assessed vector is AV:N/AC:H/PR:N/UI:N, so no authentication or victim interaction is needed, but exploitation requires the EDD PayPal gateway to be configured and usable and the targeted administrator to have no existing EDD customer record; no public exploit was identified at time of analysis.
Authenticated users holding a FluentCart custom-level role or higher can delete arbitrary files on a WordPress server running the FluentCart eCommerce plugin through version 1.6.2, because the plugin's deleteFile routine in LocalDriver.php does not properly validate the supplied file path. The flaw is reachable over the network through the plugin's file-upload controller and its REST route, requires no user interaction, and carries high integrity and availability impact; deleting a critical file such as wp-config.php can force a WordPress reinstall flow or knock the site offline, which the advisory cites as the realistic path toward code execution. The primary limiting factor is that the attacker must already hold a qualifying FluentCart account, so anonymous visitors cannot exploit it. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, and it is assessed as a genuine, prioritizable problem that should be handled in this week's maintenance cycle rather than an emergency.
HPE Fabric Composer's API lacks an integrity verification check, allowing an attacker with an existing low-privileged account to use a user-interaction step to elevate privileges and affect confidentiality, integrity, and availability. The issue is rated CVSS 8.0 (High) and is specific to HPE Networking Fabric Composer fabric-management deployments; no public exploit has been identified at time of analysis, and exploitation requires the low-privileged account plus user interaction.
Improper certificate validation in HPE Networking Fabric Composer lets an unauthenticated attacker positioned on the adjacent network intercept traffic between the affected system and remote servers, which could expose sensitive information and, per the assessed vector, also compromise integrity on the connected systems. Exploitation is not automatic: HPE states it depends on preconditions outside the attacker's control that the available sources do not enumerate, which is why the issue carries high attack complexity despite a CVSS base score of 8.0. There is no CISA KEV listing and no public exploit identified at time of analysis; the vulnerability is tracked as a this-week priority rather than an emergency, and the HPE advisory (hpesbnw05172en_us) is the authoritative source for affected versions and fixes.