N A
Monthly
Reachable assertion in GPAC MP4Box's scenegraph node unregistration function allows a local attacker to crash the application by supplying a crafted MP4 file. The vulnerability exists in `gf_node_unregister()` within `scenegraph/base_scenegraph.c`, where a hard `gf_assert(pNode->sgprivate->num_instances)` fires when processing scene graph structures with zero instance counts - a state reachable through malformed MPEG-4 BIFS scene data. No confidentiality or integrity impact exists; impact is limited to availability of the MP4Box process. A public proof-of-concept and a vendor-released patch are both available.
GPAC's MP4Box media packager crashes on a crafted MP4 file due to a reachable assertion in stbl_GetSampleInfos() (src/isomedia/stbl_read.c), which fires when a malformed sample-to-chunk table causes firstSampleInCurrentChunk to exceed the current sampleNumber. All GPAC releases up to commit f1219cde are affected. A public exploit writeup exists; however, exploitation is limited to local denial-of-service-crashing the MP4Box process-with no confidentiality or integrity impact. The vendor has released a patch in tag abi-16.23 replacing the bare gf_assert with a graceful error-return path.
Reachable assertion in GPAC's MP4Box tool (up to commit f1219cde) causes process abort when processing a crafted MPEG-4 scene file: `gf_sm_dump_command_list()` in `scene_manager/scene_dump.c` fires `gf_assert(!sdump->current_com_list)` if the command-list pointer is already populated at dump time, crashing MP4Box. A local attacker with standard user privileges who can supply input to the MP4Box binary can trigger this denial of service. No public exploit confirmed in CISA KEV, but a publicly available proof-of-concept exists; vendor-released patch abi-16.23 is available.
Denial of service in GPAC MP4Box (up to commit f1219cde) triggers a process abort via an unconditional reachable assertion (`gf_assert(0)`) inside `xmt_parse_element` in `scene_manager/loader_xmt.c` when parsing a crafted XMT scene file. Local, low-privilege users can crash the process by feeding malformed input to the MP4Box command-line tool; no code execution or data leakage is possible. A public proof-of-concept is documented and the vendor has released a fix in version abi-16.23.
Heap buffer over-read in GPAC's MP4Box component allows a local attacker to crash the process by supplying a crafted media file with malformed SVG attributes. The flaw resides in `gf_svg_attributes_copy` (scenegraph/svg_attributes.c) and manifests when MP4Box parses SVG attribute data without adequate bounds enforcement. A publicly available proof-of-concept exists; no active exploitation has been confirmed. The impact is limited to availability - denial of service via process crash - with no confidentiality or integrity consequence.
Null pointer dereference in GPAC MP4Box up to commit f1219cde causes a local denial-of-service when processing crafted VRML/MPEG-4 scenegraph content via the MP4Box tool. The crash originates in scenegraph/vrml_tools.c, specifically in the cyclic traversal flag logic where a node pointer is dereferenced without a NULL guard. A publicly available proof-of-concept exploit exists, and the patch was merged in release abi-16.23. No public exploitation activity (KEV) has been observed; this is a low-severity, locally-exploitable tool crash with no confidentiality or integrity impact.
Integer overflow in the embedded-graphics Rust library (versions through 0.8.2) affects the bytes_per_row calculation inside ImageRaw::new on 32-bit compilation targets, causing incorrect buffer stride values that can lead to out-of-bounds memory access when processing crafted image data. The flaw was disclosed through GitHub issue #820, but the project had not responded with a fix at time of reporting. No public exploit code or active exploitation has been identified at time of analysis; remote reachability depends entirely on whether the consuming application ingests network-sourced image data.
Integer overflow in embedded-graphics ≤0.8.2 allows remote attackers to trigger memory corruption or denial-of-service by supplying a crafted `width` argument to `ImageRaw::draw_sub_image` in `src/image/image_raw.rs`. Rust's release-mode silent integer wraparound means the overflow propagates into buffer size calculations or slice indexing, potentially causing out-of-bounds memory access on the target embedded device. No vendor patch exists; the project was notified via GitHub issue #821 but has not responded. No public exploit or CISA KEV listing identified at time of analysis.
Use-after-free in GPAC's MP4Box multimedia tool (all versions through commit f1219cde) allows a local low-privileged attacker to corrupt heap memory via the gf_list_count function in utils/list.c, resulting in application crashes and potentially limited code execution within the process. The fix released in abi-16.23 (commit 49dee5cad329) addresses multiple interrelated UAF and null-dereference conditions across the scenegraph manager, BIFS memory decoder, and AV1 reframer subsystems. A public proof-of-concept exploit exists; no active exploitation has been confirmed via CISA KEV.
Heap buffer overflow in GPAC MP4Box's `gf_node_get_field()` function (scenegraph/base_scenegraph.c) allows local low-privilege attackers to corrupt heap memory by supplying a crafted MP4 file containing malformed MPEG-4 scenegraph data. The root cause, visible in the fix commit, is misaligned field entries across multiple MPEG-4 node struct definitions in nodes_mpeg4.h - specifically `GF_ChildNodeItem` fields misassigned between struct pairs (OctreeImage/XXParticles, SolidRep/SubdivisionSurface, PointTextureV2/SBVCAnimationV2) - causing `gf_node_get_field` to compute incorrect byte offsets and write outside intended heap allocations. A public proof-of-concept exists; no active exploitation (CISA KEV) has been confirmed.
Null pointer dereference in GPAC's MP4Box scenegraph engine crashes the application when processing malformed MPEG-4 BIFS scene data. The flaw resides in gf_node_list_add_child within base_scenegraph.c, reachable when node registration encounters a zero instance count or a null node pointer in gf_node_unregister() and gf_node_get_name_and_id(). A public proof-of-concept exploit exists and a vendor-released patch (abi-16.23) is available; no active exploitation is recorded in CISA KEV.
Null pointer dereference in GPAC's MP4Box tool crashes the process when parsing crafted MPEG-4/VRML scene graph data containing a malformed MFURL field, triggering the flaw inside gf_sg_mfurl_del() during scene graph cleanup. Local, low-privileged users can cause a denial of service by feeding MP4Box a specially crafted file; there is no confidentiality or integrity impact. A public proof-of-concept is available and the CVSS 4.0 vector confirms Exploit maturity of Proof-of-concept (E:P), making this straightforward for local attackers to reproduce, though impact remains limited to application crash.
Stored cross-site scripting in DataEase up to version 2.10.26 allows an authenticated attacker to inject arbitrary JavaScript through the `tooltip.backgroundColor` parameter of the Symbolic Map chart component, executing in the browser of any user who views the affected visualization. The injection point is the `buildTooltip` function in `symbolic-map.ts`, where user-controlled chart styling attributes are rendered without sanitization. No patch has been released; the vendor had not responded to the responsible disclosure issue at time of reporting, and no public exploit code has been identified.
Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files.
Certain Woltlab products are affected by RCE via Cache Poisoning. WCF >= 6.1.0 until < 6.1.23 and WCF >= 6.2.0 until < 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject arbitrary PHP Code.
An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the EGOReplanFSM::checkCollisionCallback()
mruby 4.0.0's Prism-based compiler front end (mrbgems/mruby-compiler) passes NULL pointers returned by zero-length allocations into memcpy() and memcmp(), so parsing a crafted Ruby source file such as an operator assignment whose write name is exactly "=" (for example eval('[.m M:+=')) causes undefined behavior and a possible interpreter crash. The impact is availability-only: an attacker who can get the target to compile or eval untrusted mruby source can interrupt the hosting process. No public exploit code or CISA KEV listing is known, EPSS is only 0.15% (5th percentile), and an upstream fix commit (c6866eed) exists, but the description's claim of a practical crash conflicts with the commit's own note that only sanitizer builds actually report the condition.
SQL injection in PbootCMS versions 3.2.0 through 3.2.5 lets any authenticated backend user inject crafted parameters into the User/mod interface to rewrite arbitrary fields — including password hashes and role assignments — of other accounts, resulting in full account takeover. The flaw requires only a low-privileged login (CVSS PR:L) and no victim interaction, so a single compromised or low-privilege account can be escalated into administrative control of the CMS. Exploitation is easy (AC:L) but real-world urgency is tempered: no CISA KEV listing, an EPSS score of just 0.32% (25th percentile), and a public GitHub repository tied to the CVE identifier that suggests exploit code may be circulating.
Stored cross-site scripting in the announcement preview component of REBUILD 4.4.3 allows an authenticated user who can author announcement content to run arbitrary JavaScript in the browsers of anyone who views the affected announcement — potentially including the dashboard, activity feed, or login page depending on the announcement's visibility settings. The server correctly HTML-escapes the announcement body, but the client-side preview code reverses those escapes via jQuery's html().text() chain and then re-injects the decoded string into the DOM, defeating the server-side defense. No public exploit code has been identified and the vulnerability is not in CISA KEV; EPSS is very low at 0.15% (4th percentile), indicating limited expected mass exploitation.
Resource exhaustion in vgmstream up to revision r2117 allows a remote attacker to trigger application unresponsiveness or crash by supplying a crafted TXTP playlist file containing adversarial range_start/range_end values to the add_entry parser function in src/meta/txtp_parser.c. A public proof-of-concept exists (GitHub issue #1973) and an upstream patch has been merged (commit 4b6a02dd1aff6428255db912563d77d4cb0a143e). The CVSS 4.0 score of 2.1 and low availability impact rating reflect that no public exploit indicates active exploitation, user interaction is required, and there is no confidentiality or integrity impact.
Stack-based buffer overflow in vgmstream up to r2117 allows a remote attacker to crash or potentially execute arbitrary code by delivering a specially crafted TXTH or TXTP audio metadata file to a user. The root cause is an unbounded sscanf invocation in src/meta/txth.c that writes attacker-controlled content from a text metadata file into a fixed-size stack buffer without field-width constraints (CWE-121). Publicly available exploit code exists (GitHub issue #1972), and an upstream patch commit is available (4669d37a6af94866f6f0628678f9f90d46954e8b via PR #1956), though no formally tagged patched release has been independently confirmed.
Authenticated SQL injection in L-ONE v1.0.0 (a JFinal/JFinalOA-based office automation platform) allows an attacker with a valid low-privileged account to inject crafted SQL through the busid, id, and taskid parameters of the /attachment/getBusinessUploadList endpoint, exposing sensitive records from the backend database. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N, confidentiality-only impact) and is reported as CWE-89; there is no CISA KEV listing, EPSS is only 0.15%, and no public exploit code or vendor advisory has been confirmed in the supplied sources.
An authenticated stored cross-site scripting flaw in the Column Management component of ClassCMS 1CMS v5.6 lets an attacker with a valid low-privileged account inject a crafted payload into the title field, which is persisted and later rendered to other users. When a victim views the poisoned column listing, arbitrary script or HTML executes in their browser session, enabling session theft, credential harvesting, or actions performed as the victim. EPSS places exploitation probability at roughly 0.34% (27th percentile) and there is no CISA KEV listing, though a public proof-of-concept repository referencing this CVE has been published.
Denial of service in Bestechnic BES2300 Bluetooth audio SoC firmware v3.x and earlier, where a crafted SBC audio frame overflows a buffer in SBC_DecodeFrames() and crashes the decoder. Attackers within Bluetooth radio range who can deliver audio to the device can render it unresponsive, with no confidentiality or integrity impact per the CVSS vector (C:N/I:N/A:H). EPSS is only 0.19% (9th percentile) and there is no CISA KEV listing or public exploit code identified at time of analysis.
Integer overflow vulnerabilities in Ollama's GGUF model decoder (versions 0.31.0-0.31.1) allow a remote attacker to crash the decoder by supplying a crafted GGUF model file containing malformed string lengths, tensor dimension counts, or array sizes. The overflow triggers in readGGUFV1String and related parsing functions in fs/ggml/gguf.go, causing Ollama to abort model loading and become temporarily unavailable. A public proof-of-concept exists (GitHub issue #17033) and a patch is available in v0.31.2-rc1; exploitation requires the target to load the malicious model file.
Improper access control in BookStack ≤26.05.2 allows authenticated low-privileged users to retrieve attachment edit form data for attachments on pages they are not authorized to access, by manipulating the ID parameter in requests to AttachmentController::getUpdateForm. The missing authorization check constitutes an Insecure Direct Object Reference (IDOR), leaking attachment metadata across permission boundaries. A public proof-of-concept blog post documents the attack path, and a vendor patch commit is available.
Missing authorization in FluentCMS's permission-management layer allows network-accessible, high-privileged users to bypass access controls enforced by the `GetAccessible` function in `PermissionManager.cs`. Versions up to and including 0.0.5 are affected. A publicly available proof-of-concept exists via a GitHub issue report, and the project had not responded to the disclosure at time of analysis; no vendor-released patch is available.
Cross-site scripting in FastAdmin's User Controller (versions up to 1.2.0.20210401_beta) allows remote unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious `url` redirect parameter on the login or register endpoint. The commit diff confirms the `$url` variable was echoed unescaped into HTML attribute contexts and a JavaScript `location.href` assignment in three template files, enabling `javascript:` URI injection in addition to classic reflected XSS. A public proof-of-concept exploit exists; the vendor-released patch in version 1.2.1.20210731_beta resolves all three injection points.
Improper access control in JeecgBoot's AI-RAG module (versions up to 3.9.3) permits a low-privileged authenticated user to invoke the exportXls endpoint in AiragModelController.java and extract LLM model credentials by manipulating the credential parameter beyond their authorization level. The attack is network-accessible and requires only a valid low-privileged session with no administrative rights. A public proof-of-concept is available via GitHub issue #9600, and a vendor patch has been released in version 3.9.5.
Improper authorization in Open5GS 2.7.7 and 2.8.0 AMF (5G) and MME (4G) components allows an authenticated, network-registered gNB or eNB to send crafted NG-Reset or S1-Reset messages listing NGAP/S1AP UE IDs that belong to sessions managed by a different base station. The AMF/MME processes these resets without verifying ownership, enabling session termination for subscribers served by other base stations. A publicly available proof-of-concept exists (GitHub issue #4680), and an upstream patch commit is available, though no versioned release has been independently confirmed.
Improper access control in Dolibarr's Legacy File Manager connector allows any authenticated user - regardless of assigned module permissions - to access and interact with the medias directory. Affected versions span up to 21.0.4, 22.0.5, and 23.0.3. A public exploit exists via GitHub issue #38963, and the patch commit (ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec) confirms that the vulnerable file (htdocs/core/filemanagerdol/connectors/php/config.inc.php) entirely lacked an authorization gate, meaning even zero-privilege authenticated accounts could reach the file manager. No active exploitation (CISA KEV) has been confirmed.
Let me synthesize. Product: pfSense (Netgate pfSense Plus / pfSense CE). Product name: "pfSense". Key facts: XSS in captive_portal_status.widget.php, affects pfSense Plus <= 26.03 and pfSense CE <= 2.8.1. CVSS 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. CWE-79. EPSS 0.26% (17th percentile). No KEV. Tags mention RCE — likely mislabeled/stretch (XSS → limited code exec in browser context). "N A" tag is noise. CPE is n/a — data quality flag possible: CPE missing. Hmm, the flag types are mislabeled_tag/wrong_vendor/wrong_product/missing_tag. Not "missing_cpe". I could flag "RCE" as mislabeled tag? The description says "execute arbitrary code" but it's XSS — the CWE is CWE-79, so "RCE" tag is arguably mislabeled. Hmm — but description itself says allows arbitrary code execution. I'd be careful. Maybe flag "RCE" mislabeled with medium/low confidence... Actually the rules say only emit flags when clearly wrong and verifiable. XSS in a captive portal widget page = script execution in victim's browser, not server RCE. CVSS vector C:L/I:L/A:N with S:U strongly implies no RCE. I think flagging "RCE" as mislabeled is defensible with medium confidence. Also "N A" tag — that's clearly a bad tag (from "n/a" vendor parsing). Could flag as mislabeled_tag target "N A" — but suggested? It's not a real tag. Hmm, "wrong_vendor"? The tag "N A" is a garbage placeholder. I'd flag it as mislabeled_tag with suggested null. Actually maybe better: type "mislabeled_tag", target "N A", suggested null, confidence high, reason "Placeholder 'N A' is an artifact of missing CPE vendor/product data, not a real tag." Also missing tags: "pfsense" would be a clearly applicable vendor/product tag. Suggested "pfsense". That seems high confidence and unambiguous. Also "netgate"? I'd emit missing_tag target "pfSense", suggested "pfsense". Hmm, but the instruction says emit missing_tag only when unambiguously implied — pfSense is the product; the tag list lacks it. Yes. Should I flag "PHP"? captive_portal_
Broken access control in the web management interface (wwwugw.cgi) of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote attacker holding only the low-privileged Standard role to change the password of arbitrary accounts, including administrative ones. Successful exploitation yields account takeover and, by resetting an administrator's credentials, effective full control of the gateway. No public exploit identified at time of analysis and EPSS probability is low (0.24%, 15th percentile); the flaw is not listed in CISA KEV, so real-world exploitation is not confirmed.
SQL injection in OASYS sysoa 1.0 lets remote attackers inject arbitrary SQL through the unsanitized 'outtype' parameter of the /outaddresspaging endpoint. The CVSS 3.1 vector (PR:N) indicates no authentication is required, and the advisory claims the flaw can be escalated to arbitrary code execution. A public write-up with proof-of-concept details exists on GitHub, though EPSS estimates only a 0.20% exploitation probability and the CVE is not on CISA KEV - no public exploit is confirmed weaponized in the wild.
SQL injection in SeaCMS's WeChat integration module allows remote unauthenticated attackers to manipulate database queries through the `Content` parameter processed in `weixin/index.php`. Versions up to and including 13.6 are confirmed affected, and a public proof-of-concept exploit has been published on GitHub. The root cause is reliance on PHP's `addslashes()` for SQL sanitization - a known-insufficient defense that fails to prevent injection in many charset and connector configurations.
Code injection in SeaCMS's Locoy Collector module (versions up to 13.6) allows remote unauthenticated attackers to execute arbitrary PHP code by manipulating the `pwd` argument to the `parseIf` function in `seacms_locoy_news.php`. A publicly available proof-of-concept exploit exists, documented in a GitHub security advisory, elevating practical risk above the conservative 6.9 base score. The provided CVSS 4.0 impact metrics (VC:L/VI:L/VA:L) conflict with the 'RCE' tag - PHP code injection in a CMS context typically yields full server-side code execution, suggesting the vendor scoring may significantly understate actual impact.
Unrestricted file upload via ZIP extraction in ILIAS MediaPool allows authenticated low-privilege users to bypass extension controls through the subtitle bulk-upload endpoint (`uploadMultipleSubtitleFileObject` backed by `ZipAdapter`), placing arbitrary file types - including PHP scripts - into server directories. Versions 9.x through 9.21, 10.x through 10.9, and 11.x through 11.2 across all active release branches are affected. No public exploit has been identified at time of analysis, but the CWE-434 primitive in a PHP application is a well-understood RCE precursor if extracted files land in a web-executable path.
Path traversal in Piwigo's Image Derivative Handler (i.php) exposes arbitrary server-side files to remote unauthenticated attackers on installations up to version 16.3.0. The CVSS 4.0 vector confirms network-accessible, zero-authentication exploitation with low confidentiality and integrity impact, consistent with a traversal primitive that can both read and potentially write files in unanticipated filesystem locations. A public proof-of-concept titled 'unauthenticated_derivative_path_traversal' is available on GitHub, materially lowering the bar for exploitation; no active exploitation has been confirmed in CISA KEV at time of analysis.
Stored cross-site scripting in OpenCart 4.1.0.3 and 4.1.0.4 allows an authenticated low-privilege user (e.g., a customer account) to inject malicious script into the address_1 field via the Autocomplete Workflow in catalog/controller/account/address.php, which then executes in the browser of any user who subsequently views the stored address data. A public proof-of-concept exploit is available on GitHub. The vendor did not respond to the coordinated disclosure, so no official patch has been issued.
Unauthenticated arbitrary file upload in Casdoor's /api/upload-resource endpoint (controllers/resource.go) exposes all versions through 4.0.0 to remote file-write with no authentication required. The CWE-306 flaw means any network-reachable attacker can deposit attacker-controlled content into the platform's resource storage without credentials or user interaction. A public proof-of-concept has been disclosed by researcher geo-chen; the vendor deleted the GitHub issue without comment and did not respond to coordinated disclosure email, leaving patch status unconfirmed.
Null pointer dereference in FLVMeta up to 1.2.2 causes a process crash when parsing a malformed AMF object from a crafted FLV file, resulting in denial of service. The flaw resides in `amf_object_get` (and the parallel `amf_object_set`) in `src/amf.c`, where a chained double dereference `node->next->next` executes without first confirming `node->next` is non-NULL. A public SEGV proof-of-concept exists, though the project maintainer disputes the security relevance, stating no exploitation path beyond a crash has been demonstrated. No CISA KEV listing; no public exploit identified at time of analysis beyond the crash reproducer.
Heap-based buffer overflow in FLVMeta versions up to 1.2.2 allows remote attackers to trigger a crash via a crafted FLV file that manipulates the length argument passed to amf_string_new() during AMF string processing. A public proof-of-concept exists, but the CVSS 4.0 score of 2.1 reflects the strictly limited impact - low-severity availability disruption only, with no confidentiality or integrity consequences. The project maintainer has publicly disputed that the reported bugs are practically exploitable, further tempering the real-world risk assessment.
Cross-site scripting in Typora's embedded Mermaid rendering engine allows remote attackers to inject and execute arbitrary JavaScript by manipulating the `classDef` or `style` arguments within Mermaid diagram syntax. Affected versions include all Typora releases up to 1.13.8 and 1.14.6; a publicly available proof-of-concept exploit exists on GitHub. Exploitation requires passive user interaction (opening or previewing a crafted file), and no authentication is needed from the attacker, making social-engineering delivery via shared documents or email a realistic threat vector. No active exploitation is confirmed in CISA KEV at time of analysis.
Use-after-free in open62541 up to version 1.5.5 allows remote unauthenticated attackers to crash the OPC UA server's History Backend by sending crafted requests targeting the `UA_DataValue_backend_copyRange` function in the in-memory history data plugin. The impact is availability loss only - no confidentiality or integrity compromise. A public proof-of-concept exists via a GitHub issue, and the project closed the disclosure report on procedural grounds rather than issuing a formal security advisory.
Out-of-bounds read in Kamailio's IMS AVP handler exposes telecom infrastructure to remote memory disclosure and potential service disruption. The `get_4bytes()` function across five IMS modules - `ims_auth`, `ims_icscf`, `ims_registrar_scscf`, `ims_charging`, and `ims_ocs` - fails to validate that Diameter AVP data buffers contain at least 4 bytes before reading, allowing a remote attacker with low-privilege Diameter interface access to trigger the flaw via a crafted malformed message. Publicly available exploit code exists per GitHub issue #4816, and the vendor has confirmed that the 5.5.0 branch is end-of-life and will receive no further security updates, compounding risk for operators running that release.
Path traversal in SeaCMS up to version 13.6 enables authenticated remote attackers to delete arbitrary files by injecting directory traversal sequences into the `itype` or `vid` parameters of the Comment Cache deletion endpoint `/member.php?action=del_pl`. A public proof-of-concept exploit is documented in a GitHub security advisory, lowering the barrier to exploitation. While not confirmed in CISA KEV, the combination of network reachability, low privilege requirement, and public POC elevates practical risk for exposed SeaCMS deployments beyond what the medium CVSS score alone suggests.
Unauthenticated remote attackers can bypass authorization controls in SeaCMS 13.6 via the `/ass.php` endpoint, disclosing premium or paywalled content URLs without valid subscription credentials. The vulnerability exploits CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class flaw where a user-supplied parameter determines access rights without server-side validation. A publicly available proof-of-concept is referenced in a GitHub security advisory; no active exploitation has been confirmed by CISA KEV, and impact is confined to information disclosure with no integrity or availability consequences.
Reflected cross-site scripting in SeaCMS up to version 13.6 allows remote unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session via the `errtxt` parameter of `/err.php`. Exploitation requires social engineering to deliver a crafted URL to a target user; no privileges or prior authentication are needed. A public proof-of-concept exploit exists on GitHub, raising the likelihood of opportunistic abuse against sites running unpatched SeaCMS installations.
Unauthenticated remote SQL injection in SeaCMS 13.6 and earlier exposes database contents and integrity via the `/zyapi.php?ac=videolist` API endpoint. An attacker with network access can manipulate the `ids` parameter to inject arbitrary SQL, enabling read, write, or deletion of backend database records. A public proof-of-concept exploit has been released, meaning exploitation requires minimal skill and no authentication.
Arbitrary file deletion in SeaCMS up to version 13.6 is achievable by authenticated remote users through the Avatar Upload component's password-change handler, where the `oldpic` parameter is passed unsanitized to PHP's `unlink()` function. A publicly available proof-of-concept exploit hosted on GitHub demonstrates the technique against the `/member.php?action=chgpwdsubmit` endpoint, lowering the barrier for exploitation to any account holder. While the CVSS 4.0 score of 2.1 reflects limited impact - file deletion only, no data exfiltration - deletion of configuration, credential, or application files could cascade into more severe outcomes than the base score implies; no public exploit identified at time of analysis has been confirmed as actively exploited (CISA KEV).
Remote code injection in SeaCMS 13.6 and earlier allows unauthenticated network attackers to execute arbitrary code by passing malicious input through the `searchtype` parameter, which flows into the `parseIf` function of the template engine in `search.php` without adequate sanitization. A public proof-of-concept exploit has been disclosed on GitHub under the title 'cascade-template-rce,' materially lowering the attack threshold for any internet-exposed instance. No vendor-released patch has been identified at time of analysis; publicly available exploit code exists.
Memory corruption in LatencyUtils 2.0.3 and earlier allows a local low-privileged user to cause availability disruption by manipulating input to the `LatencyStats.recordDetectedPause` function in the PauseDetector component. A public proof-of-concept has been disclosed via a GitHub issue, and the project maintainers have not responded to the disclosure, leaving the library without an upstream fix. The CVSS 4.0 score of 1.9 and availability-only impact (VA:L) reflect a tightly scoped, low-severity flaw with no confidentiality or integrity consequences and no confirmed active exploitation.
Reachable assertion (CWE-617) in Open5GS through 2.7.7 allows remote authenticated attackers to abort the SMF (Session Management Function) process by supplying an invalid ARP preemption capability or vulnerability enum value via the Nudm SDM interface, disrupting all active PDU sessions managed by that instance. The root cause is the use of ogs_assert() for enum validation in smf_nudm_sdm_handle_get() - when preemptCap or preemptVuln holds an unexpected value, the assertion fires unconditionally and kills the process. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; vendor-confirmed fix is available in version 2.8.0.
Denial of service in Open5GS AMF (Access and Mobility Management Function) versions up to 2.7.7 allows a remote low-privileged attacker to crash the AMF process by submitting a crafted N1N2MessageTransfer request containing an unrecognized ngapIeType value, triggering an unchecked assertion termination. The AMF is a singleton or small-cluster critical component of 5G core infrastructure; its crash disconnects all user equipment registered through that instance until service restarts. A public exploit exists (GitHub issue #4396) and the fix is available in version 2.8.0, making patching the clear immediate action.
Server-side request forgery in Forgejo up to 15.0.4 allows authenticated users to bypass the repository migration IP allowlist by manipulating `net.LookupIP` in the migration handler, causing the Forgejo server to issue requests to internal network resources that should be unreachable. The CVSS 4.0 vector confirms network-exploitable, low-privilege access with limited but real impact across confidentiality and integrity. Publicly available exploit code exists via Codeberg issue #13433, and the project maintainer has explicitly declined to backport the fix to v15 or v16, leaving those release lines permanently exposed absent a self-applied patch.
Path traversal in flutter_file_picker's Android implementation (all versions through 10.3.10) allows a malicious Android app on the same device to write arbitrary files into the victim app's internal storage directories. The openFileStream() method in FileUtils.kt constructs file paths using the DISPLAY_NAME value returned by ContentResolver.query() without sanitization, making it trivially exploitable by a crafted ContentProvider that returns filenames containing ../ sequences. No public exploit has been identified at time of analysis; SSVC classifies exploitation as none and the attack is not automatable, keeping real-world risk constrained despite the clear code-level flaw.
Stored Cross-Site Scripting in xipblog v2.0.1 and earlier for PrestaShop allows unauthenticated remote attackers to inject persistent JavaScript payloads through the name and content parameters of ajax.php, which are written to the database without sanitization and rendered unsafely in Smarty templates. When a store administrator subsequently reviews submitted comments in the PrestaShop back office, the payload executes within the admin's authenticated browser session, enabling full store compromise including session hijacking, unauthorized admin actions, and potential exfiltration of customer and payment data. A publicly available proof-of-concept exists per SSVC data and a GitHub Gist reference; exploitation is not currently confirmed in CISA KEV.
Cross-site scripting via `javascript:` URI injection in Omeka S 4.2.0 allows an attacker who controls site navigation configuration to plant a malicious custom URL that executes arbitrary JavaScript in any visitor's browser when the navigation link is clicked. The flaw resides in the `Url.php` navigation link handler, which failed to reject URLs using the `javascript:` scheme. A researcher-published writeup exists, but no confirmed active exploitation or CISA KEV listing is present at time of analysis.
Integer overflow in FFmpeg's libavfilter/vf_scale.c video scaling filter allows a remote attacker to crash the FFmpeg process by delivering a crafted video file that a user then opens or processes. Affected is FFmpeg development build N-122528-gdd2976b9e1, a git-snapshot identifier rather than a stable release. No public exploit and no active exploitation are identified at time of analysis; EPSS sits at 0.15% (4th percentile), confirming low observed exploitation probability despite the ubiquitous deployment footprint of FFmpeg.
Unauthenticated log extraction in Veno File Manager 4.4.9 exposes all application log data to any network-reachable attacker via a missing access control check on a PHP admin endpoint. The `/vfm-admin/admin-panel/view/save-cvs.php` script performs no authentication or authorization before processing POST requests, allowing arbitrary retrieval of log records from any specified date onward. A public proof-of-concept repository exists on GitHub (jfs-jfs/CVE-2026-37067); EPSS sits at 0.16% (6th percentile), indicating no widespread exploitation has been observed at time of analysis.
Remote code execution in Cohere North AI v1.1.5 arises from an arbitrary file upload flaw in the /v1/my_drive/batch_upload endpoint, where insufficient validation of uploaded file type/content lets an attacker place a malicious file that the server subsequently executes. The affected component is part of Cohere's North enterprise AI knowledge platform, and successful exploitation yields full compromise of confidentiality, integrity, and availability. No public exploit is identified in the intelligence feeds, though a third-party technical write-up exists on GitHub; EPSS is low (0.15%, 5th percentile), indicating limited observed exploitation activity to date.
Privilege escalation in Unraid OS 6.12.14 and earlier is enabled by a CSRF vulnerability rooted in the authentication cookie's lax SameSite policy, allowing a remote attacker to forge authenticated requests on behalf of a logged-in victim. When an authenticated Unraid user visits an attacker-controlled page, the browser's permissive cookie policy causes the session credential to accompany the cross-site request, potentially granting the attacker elevated access to the NAS management interface. No active exploitation is confirmed by CISA KEV; EPSS sits at 0.28% (20th percentile), though public security research at alittleinsecure.com documents the vulnerability in detail.
Unauthenticated integrity compromise in Cohere North AI v1.1.5 exposes an internal user-management API endpoint with no effective access control, allowing any remote attacker to overwrite arbitrary user account data via crafted HTTP requests to /api/internal/v1/users/{USER_ID}. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and the 'Authentication Bypass' tag both confirm exploitation requires no credentials and no user interaction. A researcher-published PoC exists on GitHub, though EPSS remains low (0.14%, 4th percentile) and no CISA KEV listing has been issued.
Man-in-the-middle interception in CTFd v3.7.6, a widely-used Capture The Flag competition platform, exposes high-confidentiality data to adjacent-network attackers with no authentication required. Rooted in CWE-300 (Channel Accessible by Non-Endpoint), the flaw allows an attacker sharing the same network segment to intercept communications, capturing sensitive data such as session tokens or credentials, with limited integrity modification also possible. No active exploitation is confirmed - EPSS sits at 0.15% (4th percentile) and no CISA KEV listing exists - but the attack surface is acutely relevant in live CTF event environments where competitors and organizers routinely share the same LAN or Wi-Fi.
Sensitive-data exposure in Cohere North AI v1.1.5 stems from the server accepting cross-origin requests without validating the Origin header, letting any untrusted website read authenticated API responses in a victim's browser. Affects the North enterprise AI platform; tagged as CORS misconfiguration / information disclosure. No public exploit or active exploitation is identified, and EPSS is low (0.14%, 4th percentile), though the NVD-published CVSS of 9.8 likely overstates real-world impact.
Unauthenticated information disclosure in Cohere North AI v1.1.5 exposes sensitive data through an improperly secured WebSocket endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms high confidentiality impact accessible without credentials or user interaction over a network. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% at the 4th percentile indicates negligible observed exploitation activity across the threat landscape.
OS command injection in Comfast CF-WR630AX firmware v.2.7.0.2 allows an adjacent-network attacker with administrator-level credentials to execute arbitrary OS commands through the device's web management interface and CGI endpoint via unsanitized parameters. A public proof-of-concept exploit is available on GitHub, though EPSS probability remains very low (0.19%, 9th percentile), indicating minimal observed exploitation activity. No active exploitation has been confirmed by CISA KEV, and the AV:A/PR:H CVSS vector materially constrains the realistic attacker population.
Cross-site scripting across three components of Cockpit CMS (item.php, field-select.js, and tags.js) enables remote attackers to inject and execute malicious JavaScript within authenticated users' browser sessions in versions 2.13.5 and prior. The CVSS Scope:Changed metric signals that impact extends beyond the vulnerable component - successful exploitation against an authenticated administrator can result in session hijacking, credential theft, or persistent content manipulation within the CMS. No active exploitation is confirmed (no CISA KEV listing; EPSS 0.30% / 23rd percentile), though a researcher repository at github.com/Securify-AI/CVE-2026-39275 exists as a potential POC reference.
Command injection in Wgcloud 3.6.4 exposes the server to remote code execution: the `content` parameter is unsanitized and directly concatenated into a Java `ProcessBuilder` call, allowing an adjacent-network attacker to inject arbitrary OS commands. The CWE-77 classification and the researcher's own proof-of-concept - titled RCE.md - confirm arbitrary code execution capability, making the submitted CVSS of 4.3 (C:L only) a significant understatement of real impact. No public exploit in CISA KEV, but publicly available exploit code exists per the researcher's GitHub disclosure.
Replay attack vulnerability in the Acre Security (formerly Vanderbilt Industries) SPC5300.000 access-control panel allows a physically proximate attacker to cause a denial of service by injecting replayed application-layer payloads into an active TCP session handled by SPC Connect Pro software. Affected firmware is version 3.14.1 of the SPC5300.000 Main Board. No public exploit code has been identified at time of analysis, and EPSS probability is extremely low at 0.14% (4th percentile), but the target is life-safety physical security infrastructure where availability impacts carry elevated real-world consequences.
Stored XSS via unrestricted file upload in tamguo 1.5.3 allows authenticated network attackers to execute arbitrary JavaScript in victims' browsers. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java accept arbitrary HTML and JavaScript files without content-type or extension validation, enabling persistent script injection. No public exploit identified at time of analysis and EPSS probability is 0.14% (3rd percentile), indicating low current exploitation pressure.
libjpeg-turbo 3.2.0's PNG loader triggers an integer division-by-zero crash when tj3LoadImage12() or tj3LoadImage16() processes a valid indexed-color PNG image bearing a non-gray palette under the default pixel format. The fault occurs inside alloc_sarray(), generating a SIGFPE that terminates any application relying on those APIs to handle externally supplied images. No public exploit code has been identified and EPSS sits at 0.14% (4th percentile), but the crash is reproducible with a standards-compliant PNG file, making any network-facing image-ingestion service a realistic denial-of-service target.
Memory corruption in Das U-Boot's ZFS filesystem driver (all releases before 2026.04) lets an attacker who controls the on-disk ZFS metadata trigger an integer overflow (CWE-190) that leads to undersized allocation and out-of-bounds access, enabling a boot-time crash or arbitrary code execution in the pre-OS bootloader context. Rated CVSS 9.8 by the reporter, but the flaw is reached only when U-Boot parses attacker-supplied ZFS storage during boot, so realistic exploitation is local/physical rather than network-borne. EPSS is low (0.17%, 7th percentile) and there is no confirmed active exploitation.
Denial of service in the openRISC OR1200 soft-core processor (commit 83ac6b) stems from inaccurate program counter updates when Special Purpose Registers are modified, causing the processor to enter an invalid execution state. The flaw, classified under CWE-691 (Insufficient Control Flow Management), was discovered through hardware synthesis fuzzing (SynFuzz) at George Mason University. No public exploit code or active exploitation has been identified, and EPSS places the exploitation probability at 0.14% (4th percentile), consistent with a niche research-grade hardware target.
Information disclosure in the OpenRISC OR1200 processor soft-core (commit 83ac6b) arises from a mismatch between the RTL source and the synthesized netlist, meaning the fabricated/synthesized hardware behaves differently than the verified design and can leak confidential state or misbehave. The flaw was surfaced by the academic SynFuzz RTL-vs-netlist fuzzing research (arXiv:2504.18812) rather than by field exploitation; no public exploit identified at time of analysis and EPSS is low (0.15%, 5th percentile). The NVD CVSS of 9.1 (C:H/A:H) is far more alarming than the vague one-line description supports, so the score should be treated skeptically.
TCP connection teardown handling in the Vanderbilt/Acre Security SPC5300.000 Main Board firmware v.3.14.1 accepts spoofed TCP FIN packets without validating sequence or acknowledgment numbers, enabling an attacker in physical or network proximity to forcibly terminate active TCP sessions and cause a denial of service. The affected device is a physical access control security panel, meaning exploitation could disrupt building access control operations. No public exploit code has been identified at time of analysis, and EPSS remains at the 4th percentile, reflecting minimal observed exploitation activity.
Denial of service in the Vanderbilt Industries / Acre Security SPC5300.000 Main Board running firmware v.3.14.1 allows a physically proximate attacker to crash the device by sending spoofed SYN packets, exploiting the panel's failure to bound resource consumption from crafted TCP traffic. The NVD-assigned CVSS vector uses AV:N (network), but the CVE description explicitly qualifies the attacker as physically proximate - a material, unresolved discrepancy that defenders must clarify with the vendor before assessing remote exploitability. No public exploit code and no active KEV-listed exploitation have been identified; EPSS probability is negligible at 0.14%.
Reflected cross-site scripting in Piwigo 16.3.0 public authentication pages allows a remote attacker to inject arbitrary JavaScript into a victim's browser by planting a malicious `lang` cookie value that is reflected unencoded through the application's fatal error handler. The vulnerability spans four public-facing PHP files (identification.php, password.php, register.php, profile.php) and is exploitable without authentication. A publicly available proof-of-concept exists; vendor-released patch 16.4.0 is available and exploitation is not confirmed in CISA KEV, though the AC:H complexity requirement meaningfully constrains real-world risk.
Remote denial-of-service in Open5GS HSS up to version 2.8.0 allows a low-privilege Diameter Cx peer to crash the Home Subscriber Server process by sending a UAR, MAR, SAR, or LIR request containing an empty User-Name or Public-Identity AVP, triggering a reachable assertion (CWE-617) in src/hss/hss-cx-path.c. A proof-of-concept is publicly available via GitHub issue #4675, and the upstream fix exists as commit c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4; no formally tagged patched release version has been independently confirmed. No CISA KEV listing is present, constraining the assessed threat primarily to actors with internal Diameter network access.
Prototype pollution in jQWidgets up to version 24.0.1 allows remote unauthenticated attackers to manipulate JavaScript object prototypes via the `JQXLite.extend` and `jqxBaseFramework.extend` functions in `jqwidgets/jqx-all.js`. Successful exploitation can affect the confidentiality, integrity, and availability of any web application embedding this library. Critically, the vendor closed the tracking GitHub issue as 'not planned,' meaning no official patch exists or is expected, leaving all consumers permanently exposed without mitigation.
Improper authorization in Open5GS 2.8.0's AMF UEContextReleaseRequest path handler allows remote low-privileged attackers to trigger unauthorized UE context release operations in the 5G core network. The flaw, tagged as an authentication bypass (CWE-285), affects the Access and Mobility Management Function - a security-critical component governing device connectivity and session management in 5G deployments. A proof-of-concept exploit exists (E:P in CVSS 4.0 supplemental), and no CISA KEV listing was identified at time of analysis.
Out-of-bounds read in Open5GS 2.8.0 PCRF Rx AA-Request handler allows remote low-privileged attackers with Diameter Rx interface access to send crafted AA-Request messages containing null or incorrectly-sized Framed-IP-Address or Framed-IPv6-Prefix AVPs, triggering memory reads beyond allocated boundaries. The patch commit c18dc6938bf63cc7374315d3dca303d92066e746 adds missing null and length validation for both AVP types; a tagged release incorporating it has not been independently confirmed. No active exploitation is recorded in CISA KEV, though the CVSS 4.0 E:P flag indicates proof-of-concept code is known to exist.
Divide-by-zero in Aria2's BitTorrent helper module (src/bittorrent_helper.cc) crashes the download utility when processing malformed BitTorrent data, resulting in denial of service. Aria2 1.37.0 and all prior versions are affected. No public exploit code and no CISA KEV listing have been identified; EPSS places exploitation probability at the 4th percentile, indicating negligible real-world exploitation pressure at time of analysis.
Command injection in the D-Link DI-7001 MINI_5G router (firmware 19.10.31A1) allows unauthenticated attackers on the adjacent network to execute arbitrary OS commands via the `flag` parameter of the `msp_info` endpoint. The vulnerability is rooted in CWE-77 (improper neutralization of command-special elements), and a public proof-of-concept writeup has been published on GitHub, lowering the exploitation bar. No active exploitation has been confirmed by CISA KEV, and EPSS sits at 0.17% (6th percentile), indicating limited observed exploitation activity at time of analysis.
Out-of-bounds memory corruption in SpaceDot AcubeSAT On-Board Computer software's CAN message parsing crashes the system when processing malformed ECSS telecommand packet headers. The vulnerable component MessageParser::parseECSSTCHeader at commit eaf90ec performs insufficient bounds checking, enabling denial-of-service against the spacecraft's onboard computer via a crafted CAN message. No active exploitation has been confirmed; an EPSS of 0.15% (4th percentile) is consistent with the highly specialized and niche deployment context of this aerospace platform.
Remote code execution in D-Link DI-8100G firmware 17.12.20A1 is achievable by unauthenticated attackers positioned on the adjacent network via a crafted `flag` parameter in the `msp_info` CGI handler. The flaw (CWE-94, Code Injection) permits full compromise of device confidentiality and integrity with no privileges or user interaction required, yielding a CVSS 8.1 (High) rating. A researcher-published proof-of-concept exists on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.17% reflects low observed exploitation probability at the time of analysis.
Open redirect via safe-URL validator bypass in CTFd versions 3.8.0 through 3.8.3 allows remote unauthenticated attackers to craft login URLs that redirect victims to attacker-controlled sites, enabling phishing of competition participants. The vulnerability lies in the _is_safe_url() function within CTFd/utils/validators/__init__.py, which fails to correctly reject malformed or protocol-relative values supplied via the 'Next' query parameter. The vendor CHANGELOG for the patched release (3.8.4) further notes that attacker-controlled links could serve as a vector for arbitrary JavaScript execution if clicked, suggesting the integrity impact may exceed the open-redirect framing; a public exploit writeup exists and no active KEV listing is present at time of analysis.
Unrestricted file upload in DeDeCMS 3 exposes the `/include/dialog/select_media_post.php` endpoint to abuse via the `uploadfile` parameter, enabling low-privileged authenticated users to upload arbitrary file types - including executable PHP scripts - to the server. Successful exploitation can culminate in remote code execution via a server-side webshell if the upload directory is web-accessible and script execution is permitted. No public KEV listing exists, but a proof-of-concept exploit is publicly available, materially lowering the skill threshold for exploitation.
SQL injection in DeDeCMS 53_1_UTF8 exposes the `/plus/advancedsearch.php` endpoint to remote unauthenticated database manipulation via an unsanitized `sql` argument. The flaw (CWE-89) allows attackers to craft malicious SQL statements that interact directly with the backend database, yielding limited but real confidentiality, integrity, and availability impact. A public exploit has been disclosed (CVSS 4.0 E:P), lowering the skill barrier for exploitation; no CISA KEV listing has been identified at time of analysis.
Unauthenticated information disclosure in The Library Corporation LS2 Admin (versions 5.7 through 5.8.0) exposes sensitive administrative export endpoints - including location configuration data - to any remote attacker without credentials. The root cause is CWE-306 (Missing Authentication for Critical Function), confirmed by a CVSS vector of AV:N/AC:L/PR:N/UI:N and the 'Authentication Bypass' tag. A GitHub gist reference may document the technique publicly, though confirmed active exploitation is absent from CISA KEV and EPSS sits at a low 0.17% (6th percentile).
Reachable assertion in GPAC MP4Box's scenegraph node unregistration function allows a local attacker to crash the application by supplying a crafted MP4 file. The vulnerability exists in `gf_node_unregister()` within `scenegraph/base_scenegraph.c`, where a hard `gf_assert(pNode->sgprivate->num_instances)` fires when processing scene graph structures with zero instance counts - a state reachable through malformed MPEG-4 BIFS scene data. No confidentiality or integrity impact exists; impact is limited to availability of the MP4Box process. A public proof-of-concept and a vendor-released patch are both available.
GPAC's MP4Box media packager crashes on a crafted MP4 file due to a reachable assertion in stbl_GetSampleInfos() (src/isomedia/stbl_read.c), which fires when a malformed sample-to-chunk table causes firstSampleInCurrentChunk to exceed the current sampleNumber. All GPAC releases up to commit f1219cde are affected. A public exploit writeup exists; however, exploitation is limited to local denial-of-service-crashing the MP4Box process-with no confidentiality or integrity impact. The vendor has released a patch in tag abi-16.23 replacing the bare gf_assert with a graceful error-return path.
Reachable assertion in GPAC's MP4Box tool (up to commit f1219cde) causes process abort when processing a crafted MPEG-4 scene file: `gf_sm_dump_command_list()` in `scene_manager/scene_dump.c` fires `gf_assert(!sdump->current_com_list)` if the command-list pointer is already populated at dump time, crashing MP4Box. A local attacker with standard user privileges who can supply input to the MP4Box binary can trigger this denial of service. No public exploit confirmed in CISA KEV, but a publicly available proof-of-concept exists; vendor-released patch abi-16.23 is available.
Denial of service in GPAC MP4Box (up to commit f1219cde) triggers a process abort via an unconditional reachable assertion (`gf_assert(0)`) inside `xmt_parse_element` in `scene_manager/loader_xmt.c` when parsing a crafted XMT scene file. Local, low-privilege users can crash the process by feeding malformed input to the MP4Box command-line tool; no code execution or data leakage is possible. A public proof-of-concept is documented and the vendor has released a fix in version abi-16.23.
Heap buffer over-read in GPAC's MP4Box component allows a local attacker to crash the process by supplying a crafted media file with malformed SVG attributes. The flaw resides in `gf_svg_attributes_copy` (scenegraph/svg_attributes.c) and manifests when MP4Box parses SVG attribute data without adequate bounds enforcement. A publicly available proof-of-concept exists; no active exploitation has been confirmed. The impact is limited to availability - denial of service via process crash - with no confidentiality or integrity consequence.
Null pointer dereference in GPAC MP4Box up to commit f1219cde causes a local denial-of-service when processing crafted VRML/MPEG-4 scenegraph content via the MP4Box tool. The crash originates in scenegraph/vrml_tools.c, specifically in the cyclic traversal flag logic where a node pointer is dereferenced without a NULL guard. A publicly available proof-of-concept exploit exists, and the patch was merged in release abi-16.23. No public exploitation activity (KEV) has been observed; this is a low-severity, locally-exploitable tool crash with no confidentiality or integrity impact.
Integer overflow in the embedded-graphics Rust library (versions through 0.8.2) affects the bytes_per_row calculation inside ImageRaw::new on 32-bit compilation targets, causing incorrect buffer stride values that can lead to out-of-bounds memory access when processing crafted image data. The flaw was disclosed through GitHub issue #820, but the project had not responded with a fix at time of reporting. No public exploit code or active exploitation has been identified at time of analysis; remote reachability depends entirely on whether the consuming application ingests network-sourced image data.
Integer overflow in embedded-graphics ≤0.8.2 allows remote attackers to trigger memory corruption or denial-of-service by supplying a crafted `width` argument to `ImageRaw::draw_sub_image` in `src/image/image_raw.rs`. Rust's release-mode silent integer wraparound means the overflow propagates into buffer size calculations or slice indexing, potentially causing out-of-bounds memory access on the target embedded device. No vendor patch exists; the project was notified via GitHub issue #821 but has not responded. No public exploit or CISA KEV listing identified at time of analysis.
Use-after-free in GPAC's MP4Box multimedia tool (all versions through commit f1219cde) allows a local low-privileged attacker to corrupt heap memory via the gf_list_count function in utils/list.c, resulting in application crashes and potentially limited code execution within the process. The fix released in abi-16.23 (commit 49dee5cad329) addresses multiple interrelated UAF and null-dereference conditions across the scenegraph manager, BIFS memory decoder, and AV1 reframer subsystems. A public proof-of-concept exploit exists; no active exploitation has been confirmed via CISA KEV.
Heap buffer overflow in GPAC MP4Box's `gf_node_get_field()` function (scenegraph/base_scenegraph.c) allows local low-privilege attackers to corrupt heap memory by supplying a crafted MP4 file containing malformed MPEG-4 scenegraph data. The root cause, visible in the fix commit, is misaligned field entries across multiple MPEG-4 node struct definitions in nodes_mpeg4.h - specifically `GF_ChildNodeItem` fields misassigned between struct pairs (OctreeImage/XXParticles, SolidRep/SubdivisionSurface, PointTextureV2/SBVCAnimationV2) - causing `gf_node_get_field` to compute incorrect byte offsets and write outside intended heap allocations. A public proof-of-concept exists; no active exploitation (CISA KEV) has been confirmed.
Null pointer dereference in GPAC's MP4Box scenegraph engine crashes the application when processing malformed MPEG-4 BIFS scene data. The flaw resides in gf_node_list_add_child within base_scenegraph.c, reachable when node registration encounters a zero instance count or a null node pointer in gf_node_unregister() and gf_node_get_name_and_id(). A public proof-of-concept exploit exists and a vendor-released patch (abi-16.23) is available; no active exploitation is recorded in CISA KEV.
Null pointer dereference in GPAC's MP4Box tool crashes the process when parsing crafted MPEG-4/VRML scene graph data containing a malformed MFURL field, triggering the flaw inside gf_sg_mfurl_del() during scene graph cleanup. Local, low-privileged users can cause a denial of service by feeding MP4Box a specially crafted file; there is no confidentiality or integrity impact. A public proof-of-concept is available and the CVSS 4.0 vector confirms Exploit maturity of Proof-of-concept (E:P), making this straightforward for local attackers to reproduce, though impact remains limited to application crash.
Stored cross-site scripting in DataEase up to version 2.10.26 allows an authenticated attacker to inject arbitrary JavaScript through the `tooltip.backgroundColor` parameter of the Symbolic Map chart component, executing in the browser of any user who views the affected visualization. The injection point is the `buildTooltip` function in `symbolic-map.ts`, where user-controlled chart styling attributes are rendered without sanitization. No patch has been released; the vendor had not responded to the responsible disclosure issue at time of reporting, and no public exploit code has been identified.
Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files.
Certain Woltlab products are affected by RCE via Cache Poisoning. WCF >= 6.1.0 until < 6.1.23 and WCF >= 6.2.0 until < 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject arbitrary PHP Code.
An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the EGOReplanFSM::checkCollisionCallback()
mruby 4.0.0's Prism-based compiler front end (mrbgems/mruby-compiler) passes NULL pointers returned by zero-length allocations into memcpy() and memcmp(), so parsing a crafted Ruby source file such as an operator assignment whose write name is exactly "=" (for example eval('[.m M:+=')) causes undefined behavior and a possible interpreter crash. The impact is availability-only: an attacker who can get the target to compile or eval untrusted mruby source can interrupt the hosting process. No public exploit code or CISA KEV listing is known, EPSS is only 0.15% (5th percentile), and an upstream fix commit (c6866eed) exists, but the description's claim of a practical crash conflicts with the commit's own note that only sanitizer builds actually report the condition.
SQL injection in PbootCMS versions 3.2.0 through 3.2.5 lets any authenticated backend user inject crafted parameters into the User/mod interface to rewrite arbitrary fields — including password hashes and role assignments — of other accounts, resulting in full account takeover. The flaw requires only a low-privileged login (CVSS PR:L) and no victim interaction, so a single compromised or low-privilege account can be escalated into administrative control of the CMS. Exploitation is easy (AC:L) but real-world urgency is tempered: no CISA KEV listing, an EPSS score of just 0.32% (25th percentile), and a public GitHub repository tied to the CVE identifier that suggests exploit code may be circulating.
Stored cross-site scripting in the announcement preview component of REBUILD 4.4.3 allows an authenticated user who can author announcement content to run arbitrary JavaScript in the browsers of anyone who views the affected announcement — potentially including the dashboard, activity feed, or login page depending on the announcement's visibility settings. The server correctly HTML-escapes the announcement body, but the client-side preview code reverses those escapes via jQuery's html().text() chain and then re-injects the decoded string into the DOM, defeating the server-side defense. No public exploit code has been identified and the vulnerability is not in CISA KEV; EPSS is very low at 0.15% (4th percentile), indicating limited expected mass exploitation.
Resource exhaustion in vgmstream up to revision r2117 allows a remote attacker to trigger application unresponsiveness or crash by supplying a crafted TXTP playlist file containing adversarial range_start/range_end values to the add_entry parser function in src/meta/txtp_parser.c. A public proof-of-concept exists (GitHub issue #1973) and an upstream patch has been merged (commit 4b6a02dd1aff6428255db912563d77d4cb0a143e). The CVSS 4.0 score of 2.1 and low availability impact rating reflect that no public exploit indicates active exploitation, user interaction is required, and there is no confidentiality or integrity impact.
Stack-based buffer overflow in vgmstream up to r2117 allows a remote attacker to crash or potentially execute arbitrary code by delivering a specially crafted TXTH or TXTP audio metadata file to a user. The root cause is an unbounded sscanf invocation in src/meta/txth.c that writes attacker-controlled content from a text metadata file into a fixed-size stack buffer without field-width constraints (CWE-121). Publicly available exploit code exists (GitHub issue #1972), and an upstream patch commit is available (4669d37a6af94866f6f0628678f9f90d46954e8b via PR #1956), though no formally tagged patched release has been independently confirmed.
Authenticated SQL injection in L-ONE v1.0.0 (a JFinal/JFinalOA-based office automation platform) allows an attacker with a valid low-privileged account to inject crafted SQL through the busid, id, and taskid parameters of the /attachment/getBusinessUploadList endpoint, exposing sensitive records from the backend database. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N, confidentiality-only impact) and is reported as CWE-89; there is no CISA KEV listing, EPSS is only 0.15%, and no public exploit code or vendor advisory has been confirmed in the supplied sources.
An authenticated stored cross-site scripting flaw in the Column Management component of ClassCMS 1CMS v5.6 lets an attacker with a valid low-privileged account inject a crafted payload into the title field, which is persisted and later rendered to other users. When a victim views the poisoned column listing, arbitrary script or HTML executes in their browser session, enabling session theft, credential harvesting, or actions performed as the victim. EPSS places exploitation probability at roughly 0.34% (27th percentile) and there is no CISA KEV listing, though a public proof-of-concept repository referencing this CVE has been published.
Denial of service in Bestechnic BES2300 Bluetooth audio SoC firmware v3.x and earlier, where a crafted SBC audio frame overflows a buffer in SBC_DecodeFrames() and crashes the decoder. Attackers within Bluetooth radio range who can deliver audio to the device can render it unresponsive, with no confidentiality or integrity impact per the CVSS vector (C:N/I:N/A:H). EPSS is only 0.19% (9th percentile) and there is no CISA KEV listing or public exploit code identified at time of analysis.
Integer overflow vulnerabilities in Ollama's GGUF model decoder (versions 0.31.0-0.31.1) allow a remote attacker to crash the decoder by supplying a crafted GGUF model file containing malformed string lengths, tensor dimension counts, or array sizes. The overflow triggers in readGGUFV1String and related parsing functions in fs/ggml/gguf.go, causing Ollama to abort model loading and become temporarily unavailable. A public proof-of-concept exists (GitHub issue #17033) and a patch is available in v0.31.2-rc1; exploitation requires the target to load the malicious model file.
Improper access control in BookStack ≤26.05.2 allows authenticated low-privileged users to retrieve attachment edit form data for attachments on pages they are not authorized to access, by manipulating the ID parameter in requests to AttachmentController::getUpdateForm. The missing authorization check constitutes an Insecure Direct Object Reference (IDOR), leaking attachment metadata across permission boundaries. A public proof-of-concept blog post documents the attack path, and a vendor patch commit is available.
Missing authorization in FluentCMS's permission-management layer allows network-accessible, high-privileged users to bypass access controls enforced by the `GetAccessible` function in `PermissionManager.cs`. Versions up to and including 0.0.5 are affected. A publicly available proof-of-concept exists via a GitHub issue report, and the project had not responded to the disclosure at time of analysis; no vendor-released patch is available.
Cross-site scripting in FastAdmin's User Controller (versions up to 1.2.0.20210401_beta) allows remote unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious `url` redirect parameter on the login or register endpoint. The commit diff confirms the `$url` variable was echoed unescaped into HTML attribute contexts and a JavaScript `location.href` assignment in three template files, enabling `javascript:` URI injection in addition to classic reflected XSS. A public proof-of-concept exploit exists; the vendor-released patch in version 1.2.1.20210731_beta resolves all three injection points.
Improper access control in JeecgBoot's AI-RAG module (versions up to 3.9.3) permits a low-privileged authenticated user to invoke the exportXls endpoint in AiragModelController.java and extract LLM model credentials by manipulating the credential parameter beyond their authorization level. The attack is network-accessible and requires only a valid low-privileged session with no administrative rights. A public proof-of-concept is available via GitHub issue #9600, and a vendor patch has been released in version 3.9.5.
Improper authorization in Open5GS 2.7.7 and 2.8.0 AMF (5G) and MME (4G) components allows an authenticated, network-registered gNB or eNB to send crafted NG-Reset or S1-Reset messages listing NGAP/S1AP UE IDs that belong to sessions managed by a different base station. The AMF/MME processes these resets without verifying ownership, enabling session termination for subscribers served by other base stations. A publicly available proof-of-concept exists (GitHub issue #4680), and an upstream patch commit is available, though no versioned release has been independently confirmed.
Improper access control in Dolibarr's Legacy File Manager connector allows any authenticated user - regardless of assigned module permissions - to access and interact with the medias directory. Affected versions span up to 21.0.4, 22.0.5, and 23.0.3. A public exploit exists via GitHub issue #38963, and the patch commit (ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec) confirms that the vulnerable file (htdocs/core/filemanagerdol/connectors/php/config.inc.php) entirely lacked an authorization gate, meaning even zero-privilege authenticated accounts could reach the file manager. No active exploitation (CISA KEV) has been confirmed.
Let me synthesize. Product: pfSense (Netgate pfSense Plus / pfSense CE). Product name: "pfSense". Key facts: XSS in captive_portal_status.widget.php, affects pfSense Plus <= 26.03 and pfSense CE <= 2.8.1. CVSS 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. CWE-79. EPSS 0.26% (17th percentile). No KEV. Tags mention RCE — likely mislabeled/stretch (XSS → limited code exec in browser context). "N A" tag is noise. CPE is n/a — data quality flag possible: CPE missing. Hmm, the flag types are mislabeled_tag/wrong_vendor/wrong_product/missing_tag. Not "missing_cpe". I could flag "RCE" as mislabeled tag? The description says "execute arbitrary code" but it's XSS — the CWE is CWE-79, so "RCE" tag is arguably mislabeled. Hmm — but description itself says allows arbitrary code execution. I'd be careful. Maybe flag "RCE" mislabeled with medium/low confidence... Actually the rules say only emit flags when clearly wrong and verifiable. XSS in a captive portal widget page = script execution in victim's browser, not server RCE. CVSS vector C:L/I:L/A:N with S:U strongly implies no RCE. I think flagging "RCE" as mislabeled is defensible with medium confidence. Also "N A" tag — that's clearly a bad tag (from "n/a" vendor parsing). Could flag as mislabeled_tag target "N A" — but suggested? It's not a real tag. Hmm, "wrong_vendor"? The tag "N A" is a garbage placeholder. I'd flag it as mislabeled_tag with suggested null. Actually maybe better: type "mislabeled_tag", target "N A", suggested null, confidence high, reason "Placeholder 'N A' is an artifact of missing CPE vendor/product data, not a real tag." Also missing tags: "pfsense" would be a clearly applicable vendor/product tag. Suggested "pfsense". That seems high confidence and unambiguous. Also "netgate"? I'd emit missing_tag target "pfSense", suggested "pfsense". Hmm, but the instruction says emit missing_tag only when unambiguously implied — pfSense is the product; the tag list lacks it. Yes. Should I flag "PHP"? captive_portal_
Broken access control in the web management interface (wwwugw.cgi) of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote attacker holding only the low-privileged Standard role to change the password of arbitrary accounts, including administrative ones. Successful exploitation yields account takeover and, by resetting an administrator's credentials, effective full control of the gateway. No public exploit identified at time of analysis and EPSS probability is low (0.24%, 15th percentile); the flaw is not listed in CISA KEV, so real-world exploitation is not confirmed.
SQL injection in OASYS sysoa 1.0 lets remote attackers inject arbitrary SQL through the unsanitized 'outtype' parameter of the /outaddresspaging endpoint. The CVSS 3.1 vector (PR:N) indicates no authentication is required, and the advisory claims the flaw can be escalated to arbitrary code execution. A public write-up with proof-of-concept details exists on GitHub, though EPSS estimates only a 0.20% exploitation probability and the CVE is not on CISA KEV - no public exploit is confirmed weaponized in the wild.
SQL injection in SeaCMS's WeChat integration module allows remote unauthenticated attackers to manipulate database queries through the `Content` parameter processed in `weixin/index.php`. Versions up to and including 13.6 are confirmed affected, and a public proof-of-concept exploit has been published on GitHub. The root cause is reliance on PHP's `addslashes()` for SQL sanitization - a known-insufficient defense that fails to prevent injection in many charset and connector configurations.
Code injection in SeaCMS's Locoy Collector module (versions up to 13.6) allows remote unauthenticated attackers to execute arbitrary PHP code by manipulating the `pwd` argument to the `parseIf` function in `seacms_locoy_news.php`. A publicly available proof-of-concept exploit exists, documented in a GitHub security advisory, elevating practical risk above the conservative 6.9 base score. The provided CVSS 4.0 impact metrics (VC:L/VI:L/VA:L) conflict with the 'RCE' tag - PHP code injection in a CMS context typically yields full server-side code execution, suggesting the vendor scoring may significantly understate actual impact.
Unrestricted file upload via ZIP extraction in ILIAS MediaPool allows authenticated low-privilege users to bypass extension controls through the subtitle bulk-upload endpoint (`uploadMultipleSubtitleFileObject` backed by `ZipAdapter`), placing arbitrary file types - including PHP scripts - into server directories. Versions 9.x through 9.21, 10.x through 10.9, and 11.x through 11.2 across all active release branches are affected. No public exploit has been identified at time of analysis, but the CWE-434 primitive in a PHP application is a well-understood RCE precursor if extracted files land in a web-executable path.
Path traversal in Piwigo's Image Derivative Handler (i.php) exposes arbitrary server-side files to remote unauthenticated attackers on installations up to version 16.3.0. The CVSS 4.0 vector confirms network-accessible, zero-authentication exploitation with low confidentiality and integrity impact, consistent with a traversal primitive that can both read and potentially write files in unanticipated filesystem locations. A public proof-of-concept titled 'unauthenticated_derivative_path_traversal' is available on GitHub, materially lowering the bar for exploitation; no active exploitation has been confirmed in CISA KEV at time of analysis.
Stored cross-site scripting in OpenCart 4.1.0.3 and 4.1.0.4 allows an authenticated low-privilege user (e.g., a customer account) to inject malicious script into the address_1 field via the Autocomplete Workflow in catalog/controller/account/address.php, which then executes in the browser of any user who subsequently views the stored address data. A public proof-of-concept exploit is available on GitHub. The vendor did not respond to the coordinated disclosure, so no official patch has been issued.
Unauthenticated arbitrary file upload in Casdoor's /api/upload-resource endpoint (controllers/resource.go) exposes all versions through 4.0.0 to remote file-write with no authentication required. The CWE-306 flaw means any network-reachable attacker can deposit attacker-controlled content into the platform's resource storage without credentials or user interaction. A public proof-of-concept has been disclosed by researcher geo-chen; the vendor deleted the GitHub issue without comment and did not respond to coordinated disclosure email, leaving patch status unconfirmed.
Null pointer dereference in FLVMeta up to 1.2.2 causes a process crash when parsing a malformed AMF object from a crafted FLV file, resulting in denial of service. The flaw resides in `amf_object_get` (and the parallel `amf_object_set`) in `src/amf.c`, where a chained double dereference `node->next->next` executes without first confirming `node->next` is non-NULL. A public SEGV proof-of-concept exists, though the project maintainer disputes the security relevance, stating no exploitation path beyond a crash has been demonstrated. No CISA KEV listing; no public exploit identified at time of analysis beyond the crash reproducer.
Heap-based buffer overflow in FLVMeta versions up to 1.2.2 allows remote attackers to trigger a crash via a crafted FLV file that manipulates the length argument passed to amf_string_new() during AMF string processing. A public proof-of-concept exists, but the CVSS 4.0 score of 2.1 reflects the strictly limited impact - low-severity availability disruption only, with no confidentiality or integrity consequences. The project maintainer has publicly disputed that the reported bugs are practically exploitable, further tempering the real-world risk assessment.
Cross-site scripting in Typora's embedded Mermaid rendering engine allows remote attackers to inject and execute arbitrary JavaScript by manipulating the `classDef` or `style` arguments within Mermaid diagram syntax. Affected versions include all Typora releases up to 1.13.8 and 1.14.6; a publicly available proof-of-concept exploit exists on GitHub. Exploitation requires passive user interaction (opening or previewing a crafted file), and no authentication is needed from the attacker, making social-engineering delivery via shared documents or email a realistic threat vector. No active exploitation is confirmed in CISA KEV at time of analysis.
Use-after-free in open62541 up to version 1.5.5 allows remote unauthenticated attackers to crash the OPC UA server's History Backend by sending crafted requests targeting the `UA_DataValue_backend_copyRange` function in the in-memory history data plugin. The impact is availability loss only - no confidentiality or integrity compromise. A public proof-of-concept exists via a GitHub issue, and the project closed the disclosure report on procedural grounds rather than issuing a formal security advisory.
Out-of-bounds read in Kamailio's IMS AVP handler exposes telecom infrastructure to remote memory disclosure and potential service disruption. The `get_4bytes()` function across five IMS modules - `ims_auth`, `ims_icscf`, `ims_registrar_scscf`, `ims_charging`, and `ims_ocs` - fails to validate that Diameter AVP data buffers contain at least 4 bytes before reading, allowing a remote attacker with low-privilege Diameter interface access to trigger the flaw via a crafted malformed message. Publicly available exploit code exists per GitHub issue #4816, and the vendor has confirmed that the 5.5.0 branch is end-of-life and will receive no further security updates, compounding risk for operators running that release.
Path traversal in SeaCMS up to version 13.6 enables authenticated remote attackers to delete arbitrary files by injecting directory traversal sequences into the `itype` or `vid` parameters of the Comment Cache deletion endpoint `/member.php?action=del_pl`. A public proof-of-concept exploit is documented in a GitHub security advisory, lowering the barrier to exploitation. While not confirmed in CISA KEV, the combination of network reachability, low privilege requirement, and public POC elevates practical risk for exposed SeaCMS deployments beyond what the medium CVSS score alone suggests.
Unauthenticated remote attackers can bypass authorization controls in SeaCMS 13.6 via the `/ass.php` endpoint, disclosing premium or paywalled content URLs without valid subscription credentials. The vulnerability exploits CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class flaw where a user-supplied parameter determines access rights without server-side validation. A publicly available proof-of-concept is referenced in a GitHub security advisory; no active exploitation has been confirmed by CISA KEV, and impact is confined to information disclosure with no integrity or availability consequences.
Reflected cross-site scripting in SeaCMS up to version 13.6 allows remote unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session via the `errtxt` parameter of `/err.php`. Exploitation requires social engineering to deliver a crafted URL to a target user; no privileges or prior authentication are needed. A public proof-of-concept exploit exists on GitHub, raising the likelihood of opportunistic abuse against sites running unpatched SeaCMS installations.
Unauthenticated remote SQL injection in SeaCMS 13.6 and earlier exposes database contents and integrity via the `/zyapi.php?ac=videolist` API endpoint. An attacker with network access can manipulate the `ids` parameter to inject arbitrary SQL, enabling read, write, or deletion of backend database records. A public proof-of-concept exploit has been released, meaning exploitation requires minimal skill and no authentication.
Arbitrary file deletion in SeaCMS up to version 13.6 is achievable by authenticated remote users through the Avatar Upload component's password-change handler, where the `oldpic` parameter is passed unsanitized to PHP's `unlink()` function. A publicly available proof-of-concept exploit hosted on GitHub demonstrates the technique against the `/member.php?action=chgpwdsubmit` endpoint, lowering the barrier for exploitation to any account holder. While the CVSS 4.0 score of 2.1 reflects limited impact - file deletion only, no data exfiltration - deletion of configuration, credential, or application files could cascade into more severe outcomes than the base score implies; no public exploit identified at time of analysis has been confirmed as actively exploited (CISA KEV).
Remote code injection in SeaCMS 13.6 and earlier allows unauthenticated network attackers to execute arbitrary code by passing malicious input through the `searchtype` parameter, which flows into the `parseIf` function of the template engine in `search.php` without adequate sanitization. A public proof-of-concept exploit has been disclosed on GitHub under the title 'cascade-template-rce,' materially lowering the attack threshold for any internet-exposed instance. No vendor-released patch has been identified at time of analysis; publicly available exploit code exists.
Memory corruption in LatencyUtils 2.0.3 and earlier allows a local low-privileged user to cause availability disruption by manipulating input to the `LatencyStats.recordDetectedPause` function in the PauseDetector component. A public proof-of-concept has been disclosed via a GitHub issue, and the project maintainers have not responded to the disclosure, leaving the library without an upstream fix. The CVSS 4.0 score of 1.9 and availability-only impact (VA:L) reflect a tightly scoped, low-severity flaw with no confidentiality or integrity consequences and no confirmed active exploitation.
Reachable assertion (CWE-617) in Open5GS through 2.7.7 allows remote authenticated attackers to abort the SMF (Session Management Function) process by supplying an invalid ARP preemption capability or vulnerability enum value via the Nudm SDM interface, disrupting all active PDU sessions managed by that instance. The root cause is the use of ogs_assert() for enum validation in smf_nudm_sdm_handle_get() - when preemptCap or preemptVuln holds an unexpected value, the assertion fires unconditionally and kills the process. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; vendor-confirmed fix is available in version 2.8.0.
Denial of service in Open5GS AMF (Access and Mobility Management Function) versions up to 2.7.7 allows a remote low-privileged attacker to crash the AMF process by submitting a crafted N1N2MessageTransfer request containing an unrecognized ngapIeType value, triggering an unchecked assertion termination. The AMF is a singleton or small-cluster critical component of 5G core infrastructure; its crash disconnects all user equipment registered through that instance until service restarts. A public exploit exists (GitHub issue #4396) and the fix is available in version 2.8.0, making patching the clear immediate action.
Server-side request forgery in Forgejo up to 15.0.4 allows authenticated users to bypass the repository migration IP allowlist by manipulating `net.LookupIP` in the migration handler, causing the Forgejo server to issue requests to internal network resources that should be unreachable. The CVSS 4.0 vector confirms network-exploitable, low-privilege access with limited but real impact across confidentiality and integrity. Publicly available exploit code exists via Codeberg issue #13433, and the project maintainer has explicitly declined to backport the fix to v15 or v16, leaving those release lines permanently exposed absent a self-applied patch.
Path traversal in flutter_file_picker's Android implementation (all versions through 10.3.10) allows a malicious Android app on the same device to write arbitrary files into the victim app's internal storage directories. The openFileStream() method in FileUtils.kt constructs file paths using the DISPLAY_NAME value returned by ContentResolver.query() without sanitization, making it trivially exploitable by a crafted ContentProvider that returns filenames containing ../ sequences. No public exploit has been identified at time of analysis; SSVC classifies exploitation as none and the attack is not automatable, keeping real-world risk constrained despite the clear code-level flaw.
Stored Cross-Site Scripting in xipblog v2.0.1 and earlier for PrestaShop allows unauthenticated remote attackers to inject persistent JavaScript payloads through the name and content parameters of ajax.php, which are written to the database without sanitization and rendered unsafely in Smarty templates. When a store administrator subsequently reviews submitted comments in the PrestaShop back office, the payload executes within the admin's authenticated browser session, enabling full store compromise including session hijacking, unauthorized admin actions, and potential exfiltration of customer and payment data. A publicly available proof-of-concept exists per SSVC data and a GitHub Gist reference; exploitation is not currently confirmed in CISA KEV.
Cross-site scripting via `javascript:` URI injection in Omeka S 4.2.0 allows an attacker who controls site navigation configuration to plant a malicious custom URL that executes arbitrary JavaScript in any visitor's browser when the navigation link is clicked. The flaw resides in the `Url.php` navigation link handler, which failed to reject URLs using the `javascript:` scheme. A researcher-published writeup exists, but no confirmed active exploitation or CISA KEV listing is present at time of analysis.
Integer overflow in FFmpeg's libavfilter/vf_scale.c video scaling filter allows a remote attacker to crash the FFmpeg process by delivering a crafted video file that a user then opens or processes. Affected is FFmpeg development build N-122528-gdd2976b9e1, a git-snapshot identifier rather than a stable release. No public exploit and no active exploitation are identified at time of analysis; EPSS sits at 0.15% (4th percentile), confirming low observed exploitation probability despite the ubiquitous deployment footprint of FFmpeg.
Unauthenticated log extraction in Veno File Manager 4.4.9 exposes all application log data to any network-reachable attacker via a missing access control check on a PHP admin endpoint. The `/vfm-admin/admin-panel/view/save-cvs.php` script performs no authentication or authorization before processing POST requests, allowing arbitrary retrieval of log records from any specified date onward. A public proof-of-concept repository exists on GitHub (jfs-jfs/CVE-2026-37067); EPSS sits at 0.16% (6th percentile), indicating no widespread exploitation has been observed at time of analysis.
Remote code execution in Cohere North AI v1.1.5 arises from an arbitrary file upload flaw in the /v1/my_drive/batch_upload endpoint, where insufficient validation of uploaded file type/content lets an attacker place a malicious file that the server subsequently executes. The affected component is part of Cohere's North enterprise AI knowledge platform, and successful exploitation yields full compromise of confidentiality, integrity, and availability. No public exploit is identified in the intelligence feeds, though a third-party technical write-up exists on GitHub; EPSS is low (0.15%, 5th percentile), indicating limited observed exploitation activity to date.
Privilege escalation in Unraid OS 6.12.14 and earlier is enabled by a CSRF vulnerability rooted in the authentication cookie's lax SameSite policy, allowing a remote attacker to forge authenticated requests on behalf of a logged-in victim. When an authenticated Unraid user visits an attacker-controlled page, the browser's permissive cookie policy causes the session credential to accompany the cross-site request, potentially granting the attacker elevated access to the NAS management interface. No active exploitation is confirmed by CISA KEV; EPSS sits at 0.28% (20th percentile), though public security research at alittleinsecure.com documents the vulnerability in detail.
Unauthenticated integrity compromise in Cohere North AI v1.1.5 exposes an internal user-management API endpoint with no effective access control, allowing any remote attacker to overwrite arbitrary user account data via crafted HTTP requests to /api/internal/v1/users/{USER_ID}. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and the 'Authentication Bypass' tag both confirm exploitation requires no credentials and no user interaction. A researcher-published PoC exists on GitHub, though EPSS remains low (0.14%, 4th percentile) and no CISA KEV listing has been issued.
Man-in-the-middle interception in CTFd v3.7.6, a widely-used Capture The Flag competition platform, exposes high-confidentiality data to adjacent-network attackers with no authentication required. Rooted in CWE-300 (Channel Accessible by Non-Endpoint), the flaw allows an attacker sharing the same network segment to intercept communications, capturing sensitive data such as session tokens or credentials, with limited integrity modification also possible. No active exploitation is confirmed - EPSS sits at 0.15% (4th percentile) and no CISA KEV listing exists - but the attack surface is acutely relevant in live CTF event environments where competitors and organizers routinely share the same LAN or Wi-Fi.
Sensitive-data exposure in Cohere North AI v1.1.5 stems from the server accepting cross-origin requests without validating the Origin header, letting any untrusted website read authenticated API responses in a victim's browser. Affects the North enterprise AI platform; tagged as CORS misconfiguration / information disclosure. No public exploit or active exploitation is identified, and EPSS is low (0.14%, 4th percentile), though the NVD-published CVSS of 9.8 likely overstates real-world impact.
Unauthenticated information disclosure in Cohere North AI v1.1.5 exposes sensitive data through an improperly secured WebSocket endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms high confidentiality impact accessible without credentials or user interaction over a network. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% at the 4th percentile indicates negligible observed exploitation activity across the threat landscape.
OS command injection in Comfast CF-WR630AX firmware v.2.7.0.2 allows an adjacent-network attacker with administrator-level credentials to execute arbitrary OS commands through the device's web management interface and CGI endpoint via unsanitized parameters. A public proof-of-concept exploit is available on GitHub, though EPSS probability remains very low (0.19%, 9th percentile), indicating minimal observed exploitation activity. No active exploitation has been confirmed by CISA KEV, and the AV:A/PR:H CVSS vector materially constrains the realistic attacker population.
Cross-site scripting across three components of Cockpit CMS (item.php, field-select.js, and tags.js) enables remote attackers to inject and execute malicious JavaScript within authenticated users' browser sessions in versions 2.13.5 and prior. The CVSS Scope:Changed metric signals that impact extends beyond the vulnerable component - successful exploitation against an authenticated administrator can result in session hijacking, credential theft, or persistent content manipulation within the CMS. No active exploitation is confirmed (no CISA KEV listing; EPSS 0.30% / 23rd percentile), though a researcher repository at github.com/Securify-AI/CVE-2026-39275 exists as a potential POC reference.
Command injection in Wgcloud 3.6.4 exposes the server to remote code execution: the `content` parameter is unsanitized and directly concatenated into a Java `ProcessBuilder` call, allowing an adjacent-network attacker to inject arbitrary OS commands. The CWE-77 classification and the researcher's own proof-of-concept - titled RCE.md - confirm arbitrary code execution capability, making the submitted CVSS of 4.3 (C:L only) a significant understatement of real impact. No public exploit in CISA KEV, but publicly available exploit code exists per the researcher's GitHub disclosure.
Replay attack vulnerability in the Acre Security (formerly Vanderbilt Industries) SPC5300.000 access-control panel allows a physically proximate attacker to cause a denial of service by injecting replayed application-layer payloads into an active TCP session handled by SPC Connect Pro software. Affected firmware is version 3.14.1 of the SPC5300.000 Main Board. No public exploit code has been identified at time of analysis, and EPSS probability is extremely low at 0.14% (4th percentile), but the target is life-safety physical security infrastructure where availability impacts carry elevated real-world consequences.
Stored XSS via unrestricted file upload in tamguo 1.5.3 allows authenticated network attackers to execute arbitrary JavaScript in victims' browsers. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java accept arbitrary HTML and JavaScript files without content-type or extension validation, enabling persistent script injection. No public exploit identified at time of analysis and EPSS probability is 0.14% (3rd percentile), indicating low current exploitation pressure.
libjpeg-turbo 3.2.0's PNG loader triggers an integer division-by-zero crash when tj3LoadImage12() or tj3LoadImage16() processes a valid indexed-color PNG image bearing a non-gray palette under the default pixel format. The fault occurs inside alloc_sarray(), generating a SIGFPE that terminates any application relying on those APIs to handle externally supplied images. No public exploit code has been identified and EPSS sits at 0.14% (4th percentile), but the crash is reproducible with a standards-compliant PNG file, making any network-facing image-ingestion service a realistic denial-of-service target.
Memory corruption in Das U-Boot's ZFS filesystem driver (all releases before 2026.04) lets an attacker who controls the on-disk ZFS metadata trigger an integer overflow (CWE-190) that leads to undersized allocation and out-of-bounds access, enabling a boot-time crash or arbitrary code execution in the pre-OS bootloader context. Rated CVSS 9.8 by the reporter, but the flaw is reached only when U-Boot parses attacker-supplied ZFS storage during boot, so realistic exploitation is local/physical rather than network-borne. EPSS is low (0.17%, 7th percentile) and there is no confirmed active exploitation.
Denial of service in the openRISC OR1200 soft-core processor (commit 83ac6b) stems from inaccurate program counter updates when Special Purpose Registers are modified, causing the processor to enter an invalid execution state. The flaw, classified under CWE-691 (Insufficient Control Flow Management), was discovered through hardware synthesis fuzzing (SynFuzz) at George Mason University. No public exploit code or active exploitation has been identified, and EPSS places the exploitation probability at 0.14% (4th percentile), consistent with a niche research-grade hardware target.
Information disclosure in the OpenRISC OR1200 processor soft-core (commit 83ac6b) arises from a mismatch between the RTL source and the synthesized netlist, meaning the fabricated/synthesized hardware behaves differently than the verified design and can leak confidential state or misbehave. The flaw was surfaced by the academic SynFuzz RTL-vs-netlist fuzzing research (arXiv:2504.18812) rather than by field exploitation; no public exploit identified at time of analysis and EPSS is low (0.15%, 5th percentile). The NVD CVSS of 9.1 (C:H/A:H) is far more alarming than the vague one-line description supports, so the score should be treated skeptically.
TCP connection teardown handling in the Vanderbilt/Acre Security SPC5300.000 Main Board firmware v.3.14.1 accepts spoofed TCP FIN packets without validating sequence or acknowledgment numbers, enabling an attacker in physical or network proximity to forcibly terminate active TCP sessions and cause a denial of service. The affected device is a physical access control security panel, meaning exploitation could disrupt building access control operations. No public exploit code has been identified at time of analysis, and EPSS remains at the 4th percentile, reflecting minimal observed exploitation activity.
Denial of service in the Vanderbilt Industries / Acre Security SPC5300.000 Main Board running firmware v.3.14.1 allows a physically proximate attacker to crash the device by sending spoofed SYN packets, exploiting the panel's failure to bound resource consumption from crafted TCP traffic. The NVD-assigned CVSS vector uses AV:N (network), but the CVE description explicitly qualifies the attacker as physically proximate - a material, unresolved discrepancy that defenders must clarify with the vendor before assessing remote exploitability. No public exploit code and no active KEV-listed exploitation have been identified; EPSS probability is negligible at 0.14%.
Reflected cross-site scripting in Piwigo 16.3.0 public authentication pages allows a remote attacker to inject arbitrary JavaScript into a victim's browser by planting a malicious `lang` cookie value that is reflected unencoded through the application's fatal error handler. The vulnerability spans four public-facing PHP files (identification.php, password.php, register.php, profile.php) and is exploitable without authentication. A publicly available proof-of-concept exists; vendor-released patch 16.4.0 is available and exploitation is not confirmed in CISA KEV, though the AC:H complexity requirement meaningfully constrains real-world risk.
Remote denial-of-service in Open5GS HSS up to version 2.8.0 allows a low-privilege Diameter Cx peer to crash the Home Subscriber Server process by sending a UAR, MAR, SAR, or LIR request containing an empty User-Name or Public-Identity AVP, triggering a reachable assertion (CWE-617) in src/hss/hss-cx-path.c. A proof-of-concept is publicly available via GitHub issue #4675, and the upstream fix exists as commit c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4; no formally tagged patched release version has been independently confirmed. No CISA KEV listing is present, constraining the assessed threat primarily to actors with internal Diameter network access.
Prototype pollution in jQWidgets up to version 24.0.1 allows remote unauthenticated attackers to manipulate JavaScript object prototypes via the `JQXLite.extend` and `jqxBaseFramework.extend` functions in `jqwidgets/jqx-all.js`. Successful exploitation can affect the confidentiality, integrity, and availability of any web application embedding this library. Critically, the vendor closed the tracking GitHub issue as 'not planned,' meaning no official patch exists or is expected, leaving all consumers permanently exposed without mitigation.
Improper authorization in Open5GS 2.8.0's AMF UEContextReleaseRequest path handler allows remote low-privileged attackers to trigger unauthorized UE context release operations in the 5G core network. The flaw, tagged as an authentication bypass (CWE-285), affects the Access and Mobility Management Function - a security-critical component governing device connectivity and session management in 5G deployments. A proof-of-concept exploit exists (E:P in CVSS 4.0 supplemental), and no CISA KEV listing was identified at time of analysis.
Out-of-bounds read in Open5GS 2.8.0 PCRF Rx AA-Request handler allows remote low-privileged attackers with Diameter Rx interface access to send crafted AA-Request messages containing null or incorrectly-sized Framed-IP-Address or Framed-IPv6-Prefix AVPs, triggering memory reads beyond allocated boundaries. The patch commit c18dc6938bf63cc7374315d3dca303d92066e746 adds missing null and length validation for both AVP types; a tagged release incorporating it has not been independently confirmed. No active exploitation is recorded in CISA KEV, though the CVSS 4.0 E:P flag indicates proof-of-concept code is known to exist.
Divide-by-zero in Aria2's BitTorrent helper module (src/bittorrent_helper.cc) crashes the download utility when processing malformed BitTorrent data, resulting in denial of service. Aria2 1.37.0 and all prior versions are affected. No public exploit code and no CISA KEV listing have been identified; EPSS places exploitation probability at the 4th percentile, indicating negligible real-world exploitation pressure at time of analysis.
Command injection in the D-Link DI-7001 MINI_5G router (firmware 19.10.31A1) allows unauthenticated attackers on the adjacent network to execute arbitrary OS commands via the `flag` parameter of the `msp_info` endpoint. The vulnerability is rooted in CWE-77 (improper neutralization of command-special elements), and a public proof-of-concept writeup has been published on GitHub, lowering the exploitation bar. No active exploitation has been confirmed by CISA KEV, and EPSS sits at 0.17% (6th percentile), indicating limited observed exploitation activity at time of analysis.
Out-of-bounds memory corruption in SpaceDot AcubeSAT On-Board Computer software's CAN message parsing crashes the system when processing malformed ECSS telecommand packet headers. The vulnerable component MessageParser::parseECSSTCHeader at commit eaf90ec performs insufficient bounds checking, enabling denial-of-service against the spacecraft's onboard computer via a crafted CAN message. No active exploitation has been confirmed; an EPSS of 0.15% (4th percentile) is consistent with the highly specialized and niche deployment context of this aerospace platform.
Remote code execution in D-Link DI-8100G firmware 17.12.20A1 is achievable by unauthenticated attackers positioned on the adjacent network via a crafted `flag` parameter in the `msp_info` CGI handler. The flaw (CWE-94, Code Injection) permits full compromise of device confidentiality and integrity with no privileges or user interaction required, yielding a CVSS 8.1 (High) rating. A researcher-published proof-of-concept exists on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.17% reflects low observed exploitation probability at the time of analysis.
Open redirect via safe-URL validator bypass in CTFd versions 3.8.0 through 3.8.3 allows remote unauthenticated attackers to craft login URLs that redirect victims to attacker-controlled sites, enabling phishing of competition participants. The vulnerability lies in the _is_safe_url() function within CTFd/utils/validators/__init__.py, which fails to correctly reject malformed or protocol-relative values supplied via the 'Next' query parameter. The vendor CHANGELOG for the patched release (3.8.4) further notes that attacker-controlled links could serve as a vector for arbitrary JavaScript execution if clicked, suggesting the integrity impact may exceed the open-redirect framing; a public exploit writeup exists and no active KEV listing is present at time of analysis.
Unrestricted file upload in DeDeCMS 3 exposes the `/include/dialog/select_media_post.php` endpoint to abuse via the `uploadfile` parameter, enabling low-privileged authenticated users to upload arbitrary file types - including executable PHP scripts - to the server. Successful exploitation can culminate in remote code execution via a server-side webshell if the upload directory is web-accessible and script execution is permitted. No public KEV listing exists, but a proof-of-concept exploit is publicly available, materially lowering the skill threshold for exploitation.
SQL injection in DeDeCMS 53_1_UTF8 exposes the `/plus/advancedsearch.php` endpoint to remote unauthenticated database manipulation via an unsanitized `sql` argument. The flaw (CWE-89) allows attackers to craft malicious SQL statements that interact directly with the backend database, yielding limited but real confidentiality, integrity, and availability impact. A public exploit has been disclosed (CVSS 4.0 E:P), lowering the skill barrier for exploitation; no CISA KEV listing has been identified at time of analysis.
Unauthenticated information disclosure in The Library Corporation LS2 Admin (versions 5.7 through 5.8.0) exposes sensitive administrative export endpoints - including location configuration data - to any remote attacker without credentials. The root cause is CWE-306 (Missing Authentication for Critical Function), confirmed by a CVSS vector of AV:N/AC:L/PR:N/UI:N and the 'Authentication Bypass' tag. A GitHub gist reference may document the technique publicly, though confirmed active exploitation is absent from CISA KEV and EPSS sits at a low 0.17% (6th percentile).