CVE-2025-53870

Improper Neutralization of Special Elements in OS Command Injection in Fortinet FortiAP Devices

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAP 7.6.0 through 7.6.2, FortiAP 7.4.0 through 7.4.5, FortiAP 7.2 all versions, FortiAP 7.0 all versions, FortiAP 6.4 all versions, FortiAP-W2 7.4.0 through 7.4.4, FortiAP-W2 7.2 all versions, FortiAP-W2 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via a specifically crafted cli command.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fortinet

Products

Fortiap Fortiap-w2

CVE-2026-3290

Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values

Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Silicon Labs

Products

Rs9116 Sdk

CVE-2024-36345

Out‑of‑Bounds Read in AMD OverDrive SMM Module

Improper input validation in the AMD OverDrive (AOD) System Management Mode (SMM) module could allow a privileged attacker to perform an out-of-bounds read, potentially resulting in loss of confidentiality.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-36332

Guest VM Privilege Escalation: Unauthorized GPU Register Access Causing Host Reboot

Improper isolation of GPU HW register space could allow a privileged attacker in malicious Guest Virtual Machine (VM) to perform unauthorized access to specific victim range of GPU MMIO register space, potentially causing the host OS to reboot and creating a Denial of Service (DOS) condition.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Amd

Products

Radeon Pro V710

CVE-2025-0045

Local Buffer Overflow in AMD Secure Processor PCI Driver

Improper Input validation in the AMD Secure Processor (ASP) PCI driver may allow a local attacker to create a buffer overflow condition, potentially resulting in a crash or denial of service

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-48519

Local Privilege Escalation via Out-of-Bounds Access in AMD PMF Driver

An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read or write Out-of-Bounds, potentially resulting in privilege escalation

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-54517

Out‑of‑Bounds Write in AMD GPU Diagnostic IOCTL Enables Local Privilege Escalation

Out of bounds write in AMD AMDGV_CMD_GET_DIAG_DATA ioctl handler could allow a local user to escalate privileges via remote code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Amd

Products

Instinct Mi210 Instinct Mi250 Instinct Mi300a and 5 more

CVE-2025-48512

Privilege Escalation via Improper GPIO Installation Directory Permissions

Incorrect default permissions in the installation directory for the AMD general-purpose input/output controller (GPIO) could allow an attacker to achieve privilege escalation resulting in arbitrary code execution.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-0432

Privilege Escalation via Incorrect Permissions in AMD Chipset Driver Installation Directory

Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalation resulting in arbitrary code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-29938

Unchecked return value in AMD PMF enables arbitrary memory write

An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to write to an arbitrary memory address resulting in denial of service or arbitrary code execution.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Amd

Products

Ryzen 7035 Series Processors With Radeon Graphics Ryzen 7040 Series Mobile Processors With Radeon Graphics Ryzen 8040 Series Mobile Processors With Radeon Graphics and 1 more

CVE-2025-48521

Improper Input Validation In AMD Secure Processor PCI Driver Leads To Local Use‑After‑Free

Improper input validation in the AMD Secure Processor (ASP) PCI driver could allow a local attacker to trigger a Use-After-Free (UAF) condition, potentially resulting in a loss of platform integrity or crash.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-42312

pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS. The option ("general", "ssl_verify") is not on that allowlist. Any authenticated user with the non-admin SETTINGS permission can set general.ssl_verify = off, and every subsequent outbound pycurl request is made with SSL_VERIFYPEER=0 and SSL_VERIFYHOST=0 — TLS peer and hostname verification are fully disabled. An on-path attacker can then present forged certificates for any hostname pyload fetches. This is a direct continuation of the fix family CVE-2026-33509 / CVE-2026-35463 / CVE-2026-35464 / CVE-2026-35586, each of which patched a different missed option in the same allowlist. This vulnerability is fixed in 0.5.0b3.dev100.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Pyload Pyload-ng Project

Products

Pyload Pyload-ng

CVE-2026-6228

Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36. This is due to insufficient authorization checks in the role field update mechanism combined with overly permissive capabilities for the admin_form post type. The admin_form custom post type uses 'capability_type' => 'page', which grants editors the ability to create and edit forms. When an editor creates an edit_user form, they can manipulate the form configuration to include 'administrator' in the role_options array by directly submitting POST data to wp-admin/post.php, bypassing the UI restrictions in feadmin_get_user_roles(). When the form is subsequently submitted, the pre_update_value() function in class-role.php only validates that the submitted role exists in the form's role_options array (lines 107-110), but fails to verify that the current user has permission to assign that specific role. This makes it possible for unauthenticated attackers to first register as editors (via a public new_user form), then create an edit_user form with administrator in the allowed roles, and finally use that form to escalate their own privileges to administrator.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Shabti Wordpress

Products

Frontend Admin By Dynamapps Wordpress

CVE-2026-6646

The7 <= 14.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dt_default_button' shortcode in all versions up to, and including, 14.3.2. This is due to insufficient input sanitization and output escaping on the 'title' component of the 'link' shortcode parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Dream-theme Wordpress

Products

The7 — Website And Ecommerce Builder For Wordpress Wordpress

CVE-2026-6403

Quick Playground <= 1.3.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' Parameter

The Quick Playground plugin for WordPress is vulnerable to Path Traversal in versions up to and including 1.3.3. This is due to insufficient path validation in the qckply_zip_theme() function, which appends a user-controlled 'stylesheet' parameter directly to the theme root directory path without sanitizing directory traversal sequences. This makes it possible for unauthenticated attackers to trigger the creation of a ZIP archive containing arbitrary files from the server's filesystem — including wp-config.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Davidfcarr Wordpress

Products

Quick Playground Wordpress

CVE-2026-5229

Receive Notifications After Form Submitting – Form Notify for Any Forms <= 1.1.10 - Unauthenticated Authentication Bypass via LINE OAuth Callback

The Form Notify plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.1.10. This is due to the plugin trusting user-controlled cookie data to determine which WordPress account to authenticate after a LINE OAuth login. When LINE doesn't provide an email address (which is common), the plugin falls back to reading the 'form_notify_line_email' cookie value without verifying that the LINE account is associated with that email address. This makes it possible for unauthenticated attackers to gain access to any user account on the site, including administrator accounts, by completing a LINE OAuth flow with their own LINE account while injecting a malicious cookie containing the target victim's email address.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

M615926 Wordpress

Products

Receive Notifications After Form Submitting – Form Notify For Any Forms Wordpress

CVE-2026-4683

Smartcat Translator for WPML <= 3.1.77 - Missing Authorization to Unauthenticated Plugin Settings Update

The Smartcat Translator for WPML plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'routeData' REST endpoint in all versions up to, and including, 3.1.77. This makes it possible for unauthenticated attackers to overwrite the plugin's Smartcat API credentials (account ID, API secret key, hub key, API host, and hub host), effectively hijacking the translation service or causing a denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Smartcatai Wordpress

Products

Smartcat Translator For Wpml Plugin Wordpress

CVE-2026-8425

Notify Odoo <= 1.0.1 - Cross-Site Request Forgery to Settings Update

The Notify Odoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the _updateSettings function. This makes it possible for unauthenticated attackers to change the Notify Odoo URL to an attacker-controlled URL and modify notification, tracking image, and allowed IP address settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pektsekye Wordpress

Products

Notify Odoo Wordpress

CVE-2026-42313

pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS. The allowlist contains ("proxy", "username") and ("proxy", "password") — which protect the proxy credentials — but it does not include ("proxy", "enabled"), ("proxy", "host"), ("proxy", "port"), or ("proxy", "type"). Any authenticated user with the non-admin SETTINGS permission can enable proxying and point pyload at any host they control. From that point, every outbound download, captcha fetch, update check, and plugin HTTP call is transparently routed through the attacker. This is a direct continuation of the fix family CVE-2026-33509 / CVE-2026-35463 / CVE-2026-35464 / CVE-2026-35586, each of which patched a different missed option in the same allowlist. This vulnerability is fixed in 0.5.0b3.dev100.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Pyload Pyload-ng Project

Products

Pyload Pyload-ng

CVE-2025-53680

Fortinet FortiAP OS Command Injection Vulnerability

An improper neutralization of special elements used in an OS command ("OS Command Injection") vulnerability [CWE-78] vulnerability in Fortinet FortiAP 7.6.0 through 7.6.2, FortiAP 7.4.0 through 7.4.5, FortiAP 7.2 all versions, FortiAP 7.0 all versions, FortiAP 6.4 all versions, FortiAP-U 7.0.0 through 7.0.5, FortiAP-U 6.2 all versions, FortiAP-W2 7.4.0 through 7.4.4, FortiAP-W2 7.2 all versions, FortiAP-W2 7.0 all versions allows an authenticated privileged attacker to execute unauthorized code or commands via crafted CLI requests.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Fortinet

Products

Fortiap Fortiap-u Fortiap-w2