2026-11-03
SQL injection in the End-of-Life SonicWall Global Management System (GMS) 9.5.2 and earlier allows an attacker who already holds high-privilege credentials on the GMS management interface to read or modify data held in the GMS database. The vendor restricts practical exploitation to unspecified 'specific conditions', and the exact vulnerable parameter or feature is not described in the available sources; no public exploit is identified at time of analysis and the issue is not reported as actively exploited. With CVSS 6.8 and a this_month prioritization label, the practical exposure is concentrated in organizations still running the unsupported 9.5.x branch rather than in the general internet-facing population.
Malformed CoAP messages parsed by the Qt CoAP module's QCoapInternalReply::createFromFrame() can crash a CoAP-enabled application or leave it operating on incorrect data, an out-of-bounds read rated 6.7 in CVSS 4.0 (assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:N/I:L/A:H). Exploitation requires that the application link Qt CoAP and decode incoming CoAP frames through QCoapInternalReply::createFromFrame(); once such traffic reaches the parser, the CVSS vector PR:N/UI:N indicates no authentication or user interaction is needed. Impact is primarily availability (crash) with low integrity impact and no confidentiality loss claimed; a vendor fix is available, and no public exploit was identified at time of analysis.
An out-of-bounds write in the Zephyr Bluetooth host's GATT client allows a malicious, spoofed or compromised GATT server within radio range to hand a subscribed client more than the 512-octet maximum attribute length defined by the Core Specification, corrupting memory in subscribers that size their receive buffers to that documented limit. Affected releases are Zephyr 3.4.0 through 4.3.1 and 4.4.0 through 4.4.x (fixed in 4.3.2 and 4.5.0), specifically the in-tree LE Audio unicast client and BAP Broadcast Assistant as well as any out-of-tree subscriber that assumes the 512-octet ceiling. Practical exploitation is heavily conditional: the device must already be connected and subscribed to the attacker's handle, and the build must negotiate an ATT MTU above 515 octets, which the shipped defaults (27/69/70/200/265) never reach; the assessed vector (PR:L) reflects that established subscription relationship rather than classic credential authentication, and no public exploit has been identified at time of analysis.
Queue-pointer corruption in libslirp's if_output() lets a guest on a libslirp user-mode network crash the host-side networking process. When burst traffic forces a session to migrate from the fast queue to the batch queue, the code unlinks and reinserts an arbitrary packet via ifm->m_nextpkt instead of the session queue head, leaving the queue pointers inconsistent; the result is an availability-only denial of service (CVSS 6.5, AV:A/AC:L/PR:N/UI:N, C:N/I:N/A:H) with no confidentiality or integrity impact and no demonstrated code execution. Affected deployments are those actually running the slirp/slirp4netns backend - QEMU user networking and rootless Podman/OpenShift container networking among Red Hat Enterprise Linux 8, 9 and 10 and OpenShift Container Platform 4 and 5 - while bridge, tap or passt setups are out of scope. Exploitation requires the attacker to already control a guest attached to that virtual network; no public exploit code has been identified at time of analysis, and this is a medium-severity, availability-only issue rather than a top-priority emergency.
Stored cross-site scripting in the WPVibes AnyWhere Elementor WordPress plugin, affecting all versions through 1.3.0, lets a holder of a low-privileged authenticated WordPress account persist a script payload that later executes in the browser of any user viewing the affected page - potentially including site administrators. The CVSS 3.1 score is 6.5 with a scope change (S:C), reflecting that the injected script runs outside the plugin's own security boundary; the assessed vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, so exploitation needs valid credentials plus victim interaction rather than a fully unauthenticated attack. No public exploit code or CISA KEV entry was identified at time of analysis, and the specific plugin field or parameter that fails to neutralize input is not described in the available sources.
Stored cross-site scripting in the Barn2 Posts Table with Search & Sort WordPress plugin through 1.4.14 lets an authenticated low-privilege user inject persistent script that executes when a victim loads the affected table page. The medium-severity flaw (CVSS 6.5) requires a foothold account and victim interaction, which limits real-world exploitation; no public exploit was identified at time of analysis.
Sensitive information exposure in the WordPress plugin AnyWhere Elementor through version 1.3.0 lets low-privilege authenticated users retrieve embedded sensitive data that should not be sent to the client. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N, 6.5) means a logged-in account at low privilege on an affected site can remotely read data on the confidentiality side with no interaction and no integrity or availability impact. No public exploit code or CISA KEV entry is part of the available data, and the trigger mechanism is not described in the available sources; risk is moderate and depends on how readily low-privilege accounts exist or can be obtained on a target site.
Memory exhaustion in Elastic APM Server's OpenTelemetry (OTLP/HTTP) intake lets an attacker who can submit OTLP data drive the server out of memory and terminate it, halting all APM and OpenTelemetry ingestion until the service restarts. The flaw is a resource-allocation-without-limits weakness (CWE-770, CAPEC-231 oversized serialized payloads) rated CVSS 6.5 with availability-only impact (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so it is a moderate-severity denial of service rather than a confidentiality or integrity risk, and only deployments that expose the OTLP/HTTP endpoint are reachable by this path. No public exploit code identified at time of analysis and no CISA KEV listing; vuln.today priority is this_month, and vendor fixes are published as APM Server 8.19.24, 9.4.9 and 9.5.6 under ESA-2026-236.
Heap exhaustion in Elasticsearch's optional analysis-phonetic plugin allows an authenticated user who can write documents to, or run searches against, an index configured with an affected phonetic encoder to drive a node out of memory until it becomes unresponsive or terminates. The flaw is CWE-770 (allocation of resources without limits or throttling) and is reachable remotely with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5), but only when the non-default plugin is installed and a target index actually uses a vulnerable encoder - prerequisites that substantially narrow the exposed population. Availability is the only impacted property; no public exploit code was identified at time of analysis, and the issue is not on the CISA KEV list, consistent with a this_month remediation priority rather than an emergency response.
A single crafted AMQP packet can crash Elastic Packetbeat by triggering a null pointer dereference in its AMQP protocol parser, producing an unrecovered Go runtime panic that terminates the process and halts network telemetry collection. The flaw is rated CVSS 6.5 (availability-only) and requires no AMQP authentication, but exploitation is constrained to attackers who can inject traffic onto a network segment the sensor actually monitors and only where AMQP protocol analysis is enabled - the CVSS vector is Adjacent (AV:A), so this is not reachable against an internet-exposed service. There is no CISA KEV listing and no public exploit identified at time of analysis; the vendor has published fixed releases (8.19.24, 9.4.9, 9.5.6) under ESA-2026-208, and vuln.today prioritizes it as a this-month item rather than an emergency.
Kibana can disclose the Elasticsearch credentials it uses as a service account to any authenticated user who holds privileges to onboard Observability data, because those credentials are inserted into data sent back to the client during the onboarding flow. The exposure is conditional: it occurs when the Elasticsearch connection credentials are embedded inside the Elasticsearch host URLs in the Kibana configuration, so deployments that keep credentials in separate username/password settings do not appear to expose them through this path. Fixed versions 8.19.24, 9.4.9 and 9.5.6 are published in Elastic security advisory ESA-2026-204; no public exploit has been identified at time of analysis, and the issue is rated moderate with a 'this month' remediation priority rather than an emergency.
Stored cross-site scripting in Cozmoslabs Paid Member Subscriptions through version 3.1.3 allows an authenticated user with low-level privileges to inject script that executes when another user or administrator views the affected page. The plugin does not properly neutralize input during web page generation (CWE-79), and exploitation requires victim interaction with the stored payload, which limits reliability. No public exploit was identified at time of analysis.
A denial-of-service flaw in the GStreamer JPEG 2000 decimator shipped in gst-plugins-bad allows crafted JPEG 2000 media to crash applications that decode it, via integer overflows or division by zero during tile processing. Per the assessed vector (AV:N/AC:L/PR:N/UI:R, C:N/I:N/A:H), the attack is remote but requires the user to open or play the malicious file, and impact is limited to availability - no code execution or data exposure. This is a moderate-severity issue rather than a high-priority emergency; no public exploit is identified in the supplied data, and Red Hat tracks the flaw across Red Hat Enterprise Linux 7, 8, 9 and 10. The only complete fix stated in the sources is updating to GStreamer 1.28.
SQL injection in runZero's search feature lets authenticated low-privileged users retrieve search results belonging to other organizations, breaking tenant-level data isolation. The flaw affects deployments prior to 5.1.261013.1 and has a medium CVSS score of 6.5 with confidentiality-only impact; runZero's hosted-environment logs showed testing but no adversary traffic. No public exploit code or proof-of-concept was identified at time of analysis, and exploitation requires a valid low-privileged account.
GStreamer's gst-plugins-good FLV demuxer can be driven into an assertion failure or process crash by malformed or truncated FLV streams carrying enhanced audio/video tags, producing a denial of service in applications that open or stream the file. The assessed CVSS score is 6.5 with availability-only impact and UI:R, and affected deployments include gst-plugins-good plus Red Hat Enterprise Linux 7, 8, 9, and 10. No CISA KEV entry or public exploit code was identified in the supplied data, and the vuln.today priority label is this_month.
Stored cross-site scripting in the Photo Engine (Media Organizer & Lightroom) WordPress plugin, known in the plugin directory as wplr-sync, affects every version up to and including 6.5.7 and allows an authenticated attacker with only subscriber-level access to plant arbitrary script in the 'hierarchy[].name' field. The subscriber barrier is unusually low here because the plugin's /?wplr-sync-api endpoint authenticates solely on the wplr_auth_token usermeta with no capability check, and that token is exposed in localized script data on every admin page due to a commented-out screen-condition guard, so any registered user can reach the vulnerable write path. The injected script then executes when a victim - potentially an administrator - later views the poisoned page; the issue is rated 6.4 (Medium) on the CVSS 3.1 scale with a scope change, is tracked for remediation this month rather than as an emergency, is fixed in 6.5.8, and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the SEO Engine - Smart SEO with AI, Schema & Redirection for WordPress plugin (all versions through 0.9.9) lets authenticated users with Contributor-level access or higher store entity-encoded script payloads through the REST API 'title' field; those payloads execute when a victim views the affected page. The issue is scored CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and requires a pre-existing content-authoring role, so it is not unauthenticated or self-triggering. No KEV listing or public exploit reference appears in the supplied intelligence, and the referenced changeset compares 0.9.9 with 1.0.0, identifying 1.0.0 as the release to validate for the fix.
Stored cross-site scripting in the News Kit Addons For Elementor WordPress plugin (all versions up to and including 1.4.8) lets an authenticated attacker with subscriber-level access or above plant arbitrary script inside a post's Elementor data, which executes for any user - typically an administrator or site visitor - who later opens the injected page. This is a genuine but mid-tier priority: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4) is not unauthenticated, so practical exposure is concentrated on sites that permit self-registration or otherwise hand out low-privileged accounts, and the stored payload only fires when a second party views the affected page. No public exploit identified at time of analysis, and the issue is not in CISA KEV; the decision label from the priority feed is this_month.
Parsing untrusted BSON binary vector data in 32-bit builds of the MongoDB C Driver's BSON library can trigger an arithmetic element-count wraparound, causing the operation to report success after processing only a fraction of the attacker-supplied elements. The result is a silent data-integrity divergence from byte-oriented accessors and from 64-bit builds, which are unaffected; there is no memory corruption or information disclosure. No authentication or user interaction is required beyond inducing the application to parse the data, and no public exploit was identified at time of analysis.
GNU Gatekeeper (gnugk) before 5.16 can be crashed by a deliberately short application-defined RTCP probe packet delivered to the H.460.24 media port, because H46024Socket::ReceivedProbePacket() copies 20 bytes from offset 12 of the frame without first checking that the frame is long enough, producing a heap over-read. Only gatekeepers that have H.460.24 NAT traversal in use and have an H.460.24 probing exchange in progress are reachable by the flaw, so realistic impact is limited to process termination on a network-reachable, unauthenticated but timing-constrained path rather than data disclosure or code execution. No public exploit has been identified at time of analysis, and version 5.16 contains the vendor fix.
An out-of-bounds heap read in GNU Gatekeeper (gnugk) before 5.16 lets a remote RTP peer crash the gatekeeper by sending a crafted RTCP SDES packet on the media proxy port of an in-progress proxied H.323 call. The vulnerable ParseRTCP() code in ProxyChannel.cxx treats the SDES item payload as a NUL-terminated string, so an item that lacks a terminating NUL causes a length-based read past the received packet when EnableRTCPStats is enabled - a non-default option - and the only demonstrated impact is denial of service (A:H, no confidentiality or integrity impact). The vendor addressed it in release 5.16 via commit e8939d0, and no public exploit code or in-the-wild activity was identified at the time of analysis; severity is medium (vendor CVSS 4.0 base 6.3) because exploitation requires a live, media-proxied call plus RTCP statistics processing.
AshAuthentication 5.0.0-rc.4 through rc.15 can be brute-forced without limit against password sign-in, password-reset requests, magic-link requests and one-time-password flows, because a configured brute_force_strategy only attaches its preparation to the actions the strategy generates itself and never verifies that resource-defined actions carry it. Projects scaffolded with mix ash_authentication.install followed by mix ash_authentication.upgrade, or with mix ash_authentication.add_strategy.otp, end up in precisely that unprotected state, and OTP sign-in under registration_enabled? true escapes protection entirely because preparations do not run on create actions. The unauthenticated attack is a guessing campaign, not a single-shot exploit, so the practical outcome is account takeover by password or OTP guessing plus unlimited password-reset and magic-link email generation; the vendor-released fix is 5.0.0-rc.16 and no public exploit code or active exploitation has been identified at time of analysis.
Authenticated users of Label Studio can turn the export converter into a full-read SSRF primitive: importing a task whose data.image points at an internal service and then requesting an export in YOLO_WITH_IMAGES, YOLO_OBB_WITH_IMAGES or COCO_WITH_IMAGES makes the server issue an HTTP GET to the attacker-chosen URL and write the response bytes into the ZIP the same user downloads, giving back the body rather than a blind probe. The same request can additionally leak the organization owner's long-lived API token to an attacker-controlled host when the Host header is spoofed so its netloc matches the task URL (ALLOWED_HOSTS defaults to '*'), though on a stock instance that token is inert while legacy_api_tokens_enabled stays off. Affected are Label Studio before 1.23.2 and label-studio-sdk before 2.1.2; the GitHub advisory contains a step-by-step proof-of-concept reproduction, and the issue is not listed in CISA KEV, so this is a genuine but mid-tier, this-month priority rather than an emergency.
Predictable email-ownership verification tokens in Cotonti through 1.0.0 let unauthenticated remote attackers activate accounts or confirm email addresses they do not control. Because tokens are generated as md5(microtime()), an attacker who reads the server's HTTP Date header can pin the whole-second portion of the timestamp, brute-force the sub-second component offline (roughly one million candidates per targeted second), and replay any matching 32-character token to the users.register.php validate handler. Severity is rated CVSS 4.0 6.3 with AC:H reflecting the microsecond-guessing requirement that limits reliability and scale; no public exploit identified at time of analysis, and priority is this_month per vulnerability intelligence scoring.
Unauthenticated SCIM directory read in Padloc through 4.3.0 lets remote attackers retrieve provisioned user and group records - usernames, emails, names, externalIds and group memberships - from the SCIM endpoints of any organization that has directory provisioning configured, simply by supplying any non-empty bearer token. The attacker must know the target organization id, which is embedded in the SCIM request URL path, and the flaw is read-only: it exposes directory metadata but does not permit modification of directory data and is inert where SCIM provisioning is not enabled. Severity is moderate (CVSS 4.0 base 6.3; assessed CVSS 3.1 6.3, confidentiality-only) with priority 'this_month'; no public exploit code or active exploitation has been identified at time of analysis.
Request smuggling in Wasmtime's wasi-http component allows a malicious WebAssembly guest to make the host forward HTTP requests carrying multiple conflicting content-length headers, potentially causing a downstream server or intermediary that does not reject such messages to interpret request boundaries incorrectly and enabling limited integrity impact. Affected releases are before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4; fixed versions are 36.0.19, 48.0.7, and 49.0.4. This is a moderate, conditionally exploitable issue rather than a top-priority emergency, and no public exploit was identified at time of analysis.
Wasmtime's wasi-http p3 (WASIp3) implementation does not pass forwarded body trailers through the embedder's WasiHttpHooks::is_forbidden_header check, so a WASIp3 guest that forwards an existing request or response body can attach trailers that escape embedder-customized forbidden-header restrictions. Versions 46.0.0 through 48.0.6 and 49.0.0 through 49.0.3 of the rust/wasmtime-wasi-http crate are affected; the issue is network-reachable and unauthenticated per the CVSS v4.0 vector (6.3), but impact is limited to integrity of trailer filtering with no confidentiality or availability effect, and it only matters to embedders that customized the hook beyond DEFAULT_FORBIDDEN_HEADERS. There is no CISA KEV entry and no public exploit identified at time of analysis, and the vendor advisory states there is no known attack this enables even though it can undermine a property the embedder intended to enforce.
Parse Server deployments backed by MongoDB can have stored field values corrupted by a write that uses a dot notation key with a null value beneath a field that is not an object or array, such as a Pointer, Number, String, Date or Boolean field, or an internal field like createdAt or the ACL. The flaw is an input-validation gap (CWE-20): the same key with a non-null value was already rejected, but the null case bypassed field type validation and MongoDB then wrote a sub-document beneath the scalar field, which can make reads return a sub-document instead of the expected value, render an object entirely unreadable when an internal date field is hit, or break later atomic operations on a number field. The CVSS 4.0 score is 6.3 and the independently assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L: an unauthenticated remote caller can trigger it where class-level permissions or ACLs permit public writes, otherwise the attacker must already hold write access to the affected object, and PostgreSQL deployments are not affected because they reject such writes. No public exploit code and no confirmed active exploitation were identified at time of analysis (not in CISA KEV), and vendor patches are released in 8.6.111 and 9.10.6-alpha.3.
Reflected cross-site scripting (CWE-79) in the authentication endpoint of WSO2 API Manager, WSO2 Identity Server and WSO2 API Control Plane lets an unauthenticated remote attacker inject JavaScript that executes in a victim's browser when the victim follows an attacker-crafted request or link (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Successful exploitation requires user interaction and social engineering, and the vendor states that session-related sensitive cookies carry the httpOnly flag, so session hijacking and cookie theft are not achievable; realistic outcomes are browser redirection to attacker-controlled sites, modification of page content shown to the user, and exfiltration of non-httpOnly browser-accessible data. No public exploit code has been identified at time of analysis, and the issue is not listed as actively exploited; priority is 'this_month' rather than immediate.
Session fixation in the CloudClassroom-PHP-Project login handler (loginlinkadmin.php) allows a remote, unauthenticated attacker to influence the PHPSESSID value and then have a victim complete authentication under that session identifier, taking over the resulting authenticated session. The code path around session_regenerate_id does not prevent the attacker-supplied identifier from persisting, so impact is limited to Low confidentiality and integrity with no scope change. A public PoC reference exists; it is not verified as working exploit code, and there is no CISA KEV entry or other confirmation of active exploitation. The product is unversioned, the vendor did not respond to the disclosure, and no vendor-released patch was identified at time of analysis.
Path traversal in the zt-zip Java library's Zips fluent unpack API lets a malicious archive entry such as '../escape/poc.txt' (or a trailing-slash directory entry like '../escape/') be written outside the configured destination directory, affecting versions 1.17 and earlier and covering both the normal copy branch and the ZipEntryTransformer branch. Only applications that extract untrusted archives through Zips.get(zip).unpack().destination(dir).process() are exposed; code that uses ZipUtil.unpack(...) is unaffected because that path already performs a destination-boundary check. Rated 6.1 Medium (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L) with integrity impact only and no direct network trigger, it requires the victim application to process an attacker-supplied archive; a public PoC reference exists in the upstream advisory, and no active exploitation has been confirmed.
Path traversal in phpMyAdmin's MoTranslator library through version 6.0.1 lets an attacker who can influence the 'locale' argument reaching Loader::getTranslator in src/Loader.php cause translation files to be resolved from outside the intended directory, exposing local files (low confidentiality impact, per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The CVSS vector requires low-privileged authenticated access (PR:L), and real-world reachability depends on the consuming application wiring remote request data into the 'locale' parameter, since MoTranslator is a library rather than a standalone network service. No CISA KEV entry exists, but a public PoC reference has been disclosed (not verified as working exploit code), the vendor was contacted and did not respond, and no fixed version is listed in the available data.
An infinite loop in the ShapeRecord::loadFromFile parser of phpMyAdmin ShapeFile (versions up to and including 4.0.1) allows remote attackers to stall or hang the importing process by supplying a crafted ESRI .shp file, consuming CPU until the process is killed or times out. No authentication is required, but the crafted shapefile must actually be fed into the SHP import/parse path for the condition to fire, so exposure is limited to deployments that accept externally supplied shapefiles. Impact is confined to availability (VA:L) with no confidentiality or integrity effect; a public PoC reference exists, but it is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing).
Uninitialized-memory disclosure in the MongoDB C Driver's legacy GridFS file handling allows an authenticated database user with ordinary write access to a shared GridFS storage area to set up conditions under which a separate application later appends to the affected file, causing bytes left over in the application's process memory - potentially including credentials - to be written into records that same user is permitted to read. Because the trigger depends on that second application's append behavior and on the legacy code path being in use, the leak is opportunistic rather than guaranteed and the issue is a moderate, authenticated information-disclosure risk rather than an urgent widespread threat. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor tracks the defect as CDRIVER-6508.
Path traversal in the datadir plugin of ruTorrent before 5.3.20 lets an authenticated user escape the configured topDirectory jail and have the web server create directories and move torrent data to locations outside it. The root cause is that correctDirectory() compares the submitted datadir as written and does not resolve symbolic links, while the downstream mkdir/rename/copy operations do follow them; an attacker who can place a symlink under their own top directory and then submit a datadir path through it can redirect torrent data to any path writable by the web server or rtorrent, such as the web root. Exploitation requires a valid ruTorrent account with datadir plugin access and the ability to create that symlink; no public exploit code was identified at time of analysis, and the vendor fix is in 5.3.20.
Client-side use-after-free in FreeRDP's urbdrc USB redirection channel lets a malicious RDP server crash a connecting client that runs with /usb enabled while a matching local USB device is being announced. FindChannelById returns a raw channel pointer without taking a reference, and the control-channel CLOSE_REQUEST path frees that channel without holding the device manager's loading_lock, so the libusb announcement thread can read channel->Write from freed memory. Triggering requires the victim to initiate the connection with USB redirection active and to win a narrow timing window (AC:H/AT:P); a PoC harness shipped with the vendor advisory demonstrates the use-after-free under AddressSanitizer, but it is not an end-to-end RDP reproduction and is not verified as working exploit code, and no active exploitation has been reported.
Information disclosure in MongoDB Database Tools versions 3.1.4 through before 100.20.1 allows an authenticated user who can modify GridFS file metadata to set the stored filename to '-' and cause a later authorized mongofiles get_id retrieval without --local to write the file contents to standard output instead of a local file. The attacker only gains access to content they cannot read directly if a higher-privileged operator performs that retrieval and the captured standard output is readable by the attacker, making exploitation highly conditional; no public exploit was identified at time of analysis.
Denial of service in the Eclipse Vert.x Redis client (io.vertx:vertx-redis-client) 4.0.0 through 4.5.35 and 5.0.0 through 5.2.2 lets a malicious, compromised or man-in-the-middle Redis server exhaust the client's heap and crash the JVM. Two triggers are documented: a server that streams bytes on an EOL-terminated line (such as a simple string) without ever sending the terminating CRLF, which grows the read buffer without bounds because no configurable line limit exists, and a crafted RESP bulk string with a missing or corrupt CRLF trailer (for example `$3\r\nfooXX`) that drives the parser into an infinite loop, re-parsing the same buffer and re-emitting the same response to the consumer until memory is exhausted. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.9) and affects only availability - confidentiality and integrity are not impacted - with the significant precondition that the client must be talking to an attacker-controlled or compromised endpoint; a public proof-of-concept reference exists, but it is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation. Fixed versions are 4.5.36 on the 4.x branch and 5.2.3 on the 5.x branch.
µD3TN daemon crashes and denial of service can result from a use-after-free in the Bundle Protocol version 6 (BPv6) fragmenter cleanup path. The flaw is reachable by remote, unauthenticated attackers per the CVSS vector, but triggering it requires the node to be processing BPv6 bundles and a memory allocation to fail during cleanup, so reliable exploitation depends on memory pressure or resource constraints. No public exploit code has been identified at the time of analysis and active exploitation has not been confirmed; the CVSS 5.9 score reflects availability-only impact with high attack complexity.
Denial of service in µD3TN allows an unauthenticated, remote sender of BPv6 (Bundle Protocol version 6) traffic to crash the bundle node by driving the fragmenter's block-duplication code path into a double free, but only if a heap memory allocation fails at that exact point (CVSS 5.9, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, availability-only). Because that allocation-failure precondition is not attacker-controlled, practical exploitation generally requires first inducing memory pressure or exhaustion on the target node, which is why the vector carries AC:H. No public exploit code and no CISA KEV entry were identified at time of analysis, and the vuln.today priority is this-month remediation rather than emergency response.
WP Fastest Cache, a WordPress caching plugin, writes the full response of Core's wp-activate.php to a publicly readable cache file in versions up to and including 1.5.3, ignoring that endpoint's no-store/no-cache headers, its wp-activate-* cookie, and the WP_INSTALLING state. Because WordPress prints the new account's plaintext username and twelve-character password on that activation screen, unauthenticated attackers who can request the cached file can read the credentials of the most recently activated Multisite registrant. The exposure is heavily gated: the site must be a Multisite subdirectory installation with both public user and site registration enabled, and a real registrant must have just followed their activation link; the vulnerability is not known to be actively exploited (no CISA KEV entry) and no public exploit code was identified at time of analysis.
A divide-by-zero in NVIDIA nvJPEG (CWE-369) lets an attacker crash applications that decode a crafted JPEG image through the library, producing a denial of service with no code execution or data exposure. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R, A:H) requires the malformed image to reach a locally running nvJPEG consumer and a user or application to actively process it, so exposure is limited to environments that feed untrusted images into nvJPEG-based decoding such as image services and ML preprocessing pipelines. No CISA KEV entry, no confirmed public exploit, and no patch version are present in the supplied intelligence; the NVIDIA product-security advisory for 2026 (5910) is the root reference, and this is a moderate-severity availability issue rather than a top-priority emergency.
Opening and traversing a crafted HDF5 file can crash the application because H5HL_unprotect() in HDF5 through 2.2.0 may pass a NULL local-heap pointer to H5AC_unpin_entry(). The bug is a CWE-476 NULL pointer dereference: if the metadata cache destroys a corrupted local heap entry and H5HL__prfx_dest() clears heap->prfx or heap->dblk, the final unprotect has nothing to unpin, causing an assertion failure in debug builds and a crash in release builds. Impact is limited to local denial of service with user interaction and no confidentiality or integrity loss; the supplied CVSS 4.0 vector has E:P (proof-of-concept maturity), but no CISA KEV listing or confirmed working exploit code was provided.
Open redirect in the TYPO3 'mail' extension's click tracking middleware allows an unauthenticated remote attacker to craft a tracking link on a trusted TYPO3 site that forwards victims to an arbitrary external destination, turning the site's own domain into a phishing lure. It is rated CVSS 5.3 (medium) by the vendor and CVSS 4.0 5.3 by the reporting source, with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - the practical impact is limited to integrity of the redirected-to context, so risk is social engineering rather than direct compromise. No public exploit code or PoC is referenced in the available intelligence and the issue is not in CISA KEV; the vendor priority label places it in the this-month remediation window.
Saving the backend module configuration of the third-party TYPO3 extension "mail" writes the submitted settings into page TSconfig without restricting them to the module's own configuration keys, allowing arbitrary page TSconfig injection. The flaw affects installations running the extension (CPE cpe:2.3:a:typo3:extension_"mail" with no version bound) and is reachable by a backend user who holds a valid account and has been granted access to the mail module - no victim interaction is required and attack complexity is low, but permissions are required, so it is not unauthenticated. Impact is integrity-only and low (assessed CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N); no public exploit code has been identified at time of analysis, no EPSS score or CISA KEV entry was supplied, and the vuln.today priority decision is this_month rather than an emergency.
The TYPO3 extension "mail" (EXT:mail) performs server-side fetches of content referenced by an "external URL" mail - the message body, its stylesheets and its embedded images - without validating the destination host, allowing server-side request forgery against internal network services. Exploitation requires a valid TYPO3 backend account that holds access to the mail module, so the attacker is an authenticated operator/insider rather than an anonymous outsider; no user interaction is needed and the behaviour is the extension's default. Impact is limited to low-confidentiality disclosure of what internal hosts return, with no integrity or availability effect, and an independent assessment rates the issue moderate with a this-month priority; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
HTTP 500 responses generated by RESTEasy's default exception mapper embed the unhandled exception's localized message, so a remote unauthenticated client that can induce such an exception receives whatever text that message carries (CWE-209). The behavior was reproduced on RESTEasy 7.0.2.Final and, per the CPE data, flows into a wide set of Red Hat products that bundle RESTEasy, including Red Hat Build of Quarkus and Keycloak, JBoss EAP 8 and its expansion pack, Fuse 7, Satellite 6, Red Hat Build of Apache Camel 4 for Quarkus 3, Red Hat Build of Apicurio Registry 3 and Red Hat Build of Debezium 3; complete affected and fixed version ranges remain unconfirmed. No public exploit was identified at time of analysis, and the confidentiality impact is capped by the actual content of the leaked message rather than by arbitrary memory or file exposure. Priority is 'this_month' rather than immediate.
Error messages returned by the Exchange RPC in Octo STS 0.11.1 and earlier disclose the contents of trust policies to callers whose OIDC token does not satisfy them. Remote, unauthenticated callers who hold any validly signed OIDC token from an accepted issuer (for example a GitHub Actions token from a repository they own) and who know or guess a target owner/repo plus identity name can read the policy's issuer, subject and audience patterns, claim_pattern regexes, and app pin details - information that frequently names internal repositories, branches, environments or cloud account identifiers, even when the policy lives in a private repository. The flaw is confidentiality-only: no token minting or trust-policy bypass is possible; the vendor issued a fix in v0.11.2 (commit 88c6432), and no public exploit was identified at time of analysis.
Axxon One deployments before version 3.2.0 on Windows and Linux expose their full user and role inventory to any authenticated low-privilege account: the security configuration API's user configuration request returns the complete lists of users and roles regardless of the caller's permissions. Because the flaw only requires valid credentials for an ordinary account and no user interaction, it lowers the barrier to privilege mapping and follow-on targeting, though it grants no modification or disruption capability. There is no public exploit code or confirmed active exploitation, and the available signals rate this as a low-urgency, non-emergency information disclosure to be scheduled for this month's patch cycle; upgrading to 3.2.0 removes the exposure.
Incorrect authorization in the Health Monitoring service of AxxonSoft AxxonNet on Linux (versions before 3.28.0) lets a remote attacker who already holds a shared report token - a credential intended only for read-only report access - create, modify, or delete monitoring alerts through the monitoring API. The flaw is a scope-enforcement failure rather than an authentication bypass in the strict sense: a valid low-privilege token is a hard prerequisite (PR:L, AV:N), and the resulting impact is limited to alert integrity and availability, with no confidentiality loss and no path to code execution. Severity is medium (CVSS 4.0 base 5.3; independently assessed CVSS 3.1 5.3, S:U/C:N/I:L/A:L); there is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is suppression or forgery of health alerts by someone who already has report-level access.