2026-11-03
Command injection in SolarWinds Dameware lets an authenticated attacker with low-privilege credentials execute arbitrary commands on a remotely controlled host, with scope change and high confidentiality, integrity, and availability impact. The network-reachable flaw requires no user interaction, but valid Dameware authentication is the main limiting prerequisite; no public exploit identified at time of analysis, and no CISA KEV entry is present in the supplied data. The vuln.today decision label is act_now.
Authentication bypass in WSO2 API Manager allows a self-registered user to gain access to the product's System REST APIs when WSO2 Identity Server is configured as a Resident Key Manager with a shared database. The vendor rates this 9.8 critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the assessed vector is PR:L because the described flow starts from a self-registered account; a token obtained from the Identity Server token endpoint is improperly honored by API Manager. Affected deployments are limited to that Resident Key Manager plus database-sharing architecture; no public exploit identified at time of analysis.
Unauthenticated attackers can invoke arbitrary WordPress functions with attacker-controlled arguments through the render_field method in the Advanced Custom Fields: Extended PRO plugin for WordPress, affecting all versions up to and including 0.9.2.6. Exploitation is not unconditional: it requires either the non-default 'shortcode_preview' setting to be enabled on the targeted form, or a server environment lacking OpenSSL functions so that ACF Pro's acf_decrypt falls back to unverified base64 decoding - default installations with shortcode_preview disabled and OpenSSL present are not exploitable. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the vendor-reported severity is critical and the priority decision is act_now, so exposed sites running the PRO plugin should be triaged promptly.
Missing access-control enforcement in Zoho ManageEngine Log360 and EventLog Analyzer 13062 and below lets remote attackers reach product functionality without authorization, with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicating no credentials, privileges, or user interaction are needed against an exposed instance, and high confidentiality and integrity impact but no availability impact. Both the SIEM/log-management products share the affected build range, so internet-facing or otherwise reachable management interfaces are the exposure that matters. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the priority decision for this CVE is act_now given the unauthenticated network vector and the sensitivity of the data these products aggregate.
Eclipse Mnestix Browser 1.6.0 through releases before 2.3.0 allows unauthenticated remote attackers to exfiltrate the MNESTIX_BACKEND_API_KEY for every configured Infrastructure. The issue is classified as CWE-918 (SSRF) with a CVSS 4.0 base score of 9.2 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N), and the independent CVSS 3.1 vector confirms network reachability, no privileges, no user interaction, and high confidentiality impact. No public exploit code or CISA KEV entry is identified at time of analysis, but the priority label is act_now and exploitation requires only that the affected instance be reachable and have at least one Infrastructure configured with such a key.
Remote login as the built-in Axxon One administrator is possible through the web client on newly installed systems running versions before 3.0.0, because the default credential is not forced to change at first sign-in. An unauthenticated network attacker who knows the default password can gain high-impact administrative access on Windows or Linux deployments that have not been remediated. No public exploit code was identified at time of analysis, and the vuln.today priority is act_now.
FreeRDP clients through 3.32.1 silently accept a server certificate whose identity does not match the RDP target, letting an on-path attacker impersonate the RDP server and read or alter the session - keystrokes, clipboard, screen content, and injected input - without any client-side prompt. The defect is an incomplete fix for GHSA-43hh-p3vw-hfx3: tls_verify_certificate() still consults the Common Name via an unconditional OR even when non-matching dNSName SAN entries are present, and still matches IP-literal targets as plain strings against CN/DNS entries because true iPAddress SANs are never parsed. FreeRDP 3.32.2 is the vendor-fixed release; a detailed public proof-of-concept reproduction exists at function level with isolating control cases (not demonstrated end-to-end over a live RDP handshake), no confirmed active exploitation (not in CISA KEV), and the issue carries an act_now priority label - but exploitation is gated on both an on-path position and a certificate chaining to a CA the client already trusts (misissuance, or a rogue/private CA).
Unauthenticated arbitrary file deletion in the BuddyPress XProfile Image Field plugin through 3.1.0 allows remote attackers to remove server files, including wp-config.php, when web-server filesystem permissions permit the deletion, potentially leading to remote code execution. The vulnerable path is built from visitor-supplied signup metadata and passed to unlink() without realpath() resolution or containment checks; exploitation requires open registration and an image-type XProfile field on the signup form. No public exploit is identified in the available data, and the vuln.today decision label is act_now.