ALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS command injection vulnerability via the command parameter in the popen.cgi endpoint.
Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows attackers to set the Administrator password and username as blank values, allowing attackers to bypass authentication.
ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library.
UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially write and execute arbitrary PHP code.
alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths.
Unauthenticated command execution in Remote Keyboard Desktop 1.0.1 on Windows lets remote attackers invoke system commands through the exported rundll32.exe function named 'export' when the product's remote keyboard/control listener is reachable. Public exploit code exists (Exploit-DB 52299), while EPSS is 0.60% at the 69th percentile and there is no CISA KEV listing, indicating high technical severity but limited evidence of broad active exploitation. Exposure is primarily constrained by network reachability and the product's small deployment footprint.
Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter injection flaw. Attackers can inject shell metacharacters to execute arbitrary commands on the server.
AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type arbitrary keystrokes directly into the victim's iOS device in real-time without user interaction, resulting in full remote input control.
dawa-pharma-1.0 allows unauthenticated attackers to execute SQL queries on the server, allowing them to access sensitive information and potentially gain administrative access.
R Radio Network FM Transmitter 1.07 allows unauthenticated attackers to access the admin user's password through the system.cgi endpoint, enabling authentication bypass and FM station setup access.
Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword parameter of /get_subject.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can use UNION-based injection to extract sensitive information from the users table including usernames and passwords.
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
Privilege escalation to LocalSystem is possible on Windows hosts running VeePN 1.6.1 due to an unquoted service path in VeePNService (CWE-428). A local attacker who can write an executable into a directory preceding the service binary in the unquoted path can have it executed with SYSTEM privileges when the service restarts or the machine reboots; public exploit code exists, though EPSS is low at 0.13% and CISA KEV does not list it. While the original description mentions remote attackers, the independent assessment confirms this is a local-only escalation requiring local access to the host and write permissions in the service path, rated CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
perl2exe <= V30.10C contains an arbitrary code execution vulnerability that allows local authenticated attackers to execute malicious scripts. Attackers can control the 0th argument of packed executables to execute another executable, allowing them to bypass restrictions and gain unauthorized access.
A vulnerability has been identified in Genexis Platinum P4410 router (Firmware P4410-V2-1.41) that allows a local network attacker to achieve Remote Code Execution (RCE) with root privileges. The issue occurs due to improper session invalidation after administrator logout. When an administrator logs out, the session token remains valid. An attacker on the local network can reuse this stale token to send crafted requests via the router’s diagnostic endpoint, resulting in command execution as root.
Kernel crash and use-after-free list corruption in the Linux kernel's NVMe-over-Fibre-Channel (nvme-fc) transport driver occurs when tearing down a controller: nvme_fc_delete_ctrl() calls cancel_work_sync() on ->ioerr_work before nvme_fc_delete_association() completes, so a late I/O error can re-queue ->ioerr_work after cancellation and let it run against a freed nvme_fc_ctrl object. The result is a kworker hitting kernel BUG at lib/list_debug.c (list_del corruption) and an oops, affecting hosts using NVMe/FC attached storage. There is no public exploit identified at time of analysis, and EPSS is very low (0.05%), consistent with a local, hardware-conditional stability bug rather than a broadly weaponizable flaw.
Use-after-free in the Linux kernel's MPTCP subsystem stems from a race in mptcp_schedule_work() (net/mptcp/protocol.c), where the socket refcount was taken only after the work item was queued, allowing mptcp_worker() to run and free the socket before sock_hold() executes. Reachable via the MPTCP timeout timer (mptcp_tout_timer), it was found by syzbot and produces a refcount 'addition on 0' warning that signals kernel memory corruption. No public exploit identified at time of analysis and EPSS is very low (0.05%), consistent with a hard-to-time race rather than a readily weaponized flaw despite the auto-generated 9.8 score.
Denial-of-service via a use-after-free in the Linux kernel's MPTCP path-manager allows the add-address timer (mptcp_pm_del_add_timer()) to call sk_stop_timer_sync() on an announcement-list entry that another context has already freed, corrupting kernel memory. The flaw affects the mptcp subsystem across multiple long-lived stable branches and was found by syzbot via a KASAN slab-use-after-free report; the upstream fix adds RCU protection. No public exploit is identified at time of analysis, EPSS is 0.05%, and it is not listed in CISA KEV.
Out-of-bounds read in the Linux kernel's QLogic qede (FastLinQ 4xxxx) Ethernet driver arises in the TPA hardware-aggregation handlers qede_tpa_cont() and qede_tpa_end(), where loops walk the fixed-size cqe->len_list[] array using only a zero-length terminator as the stop condition; a missing or malformed terminator lets the loop read past the array. It affects systems running the qede driver on QLogic FastLinQ NICs and, if triggered, exposes the kernel to adjacent-memory disclosure or a crash. There is no public exploit identified at time of analysis, EPSS is very low (0.05%), and the flaw was found by static analysis (SVACE) rather than observed exploitation, so the published 9.8 CVSS appears substantially inflated relative to the true read-primitive impact.
Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via the _download_file_or_dir function.
An issue in the Bluetooth Human Interface Device (HID) of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to inject arbitrary keystrokes via a spoofed Bluetooth HID device.
A lack of Management Frame Protection in Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows attackers to execute de-authentication attacks, allowing crafted deauthentication and disassociation frames to be broadcast without authentication or encryption.
A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to transmit Administrator credentials in plaintext.
auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.
Buffer overflow in the H3C Magic B0 home router's web management interface allows an authenticated, low-privileged attacker to corrupt memory by sending a crafted HTTP request to /goform/aspForm that invokes the EditWlanMacList handler with an over-length 'param' argument, yielding high confidentiality, integrity, and availability impact on the device. Publicly available exploit code exists and the vendor has not responded to disclosure, so no patch has been released. EPSS is 0.16% (37th percentile) and the CVE is not in CISA KEV, so observed exploitation remains limited, though the low attack complexity and LAN reachability of the management interface make it a realistic post-compromise or insider-abuse vector.
This vulnerability fundamentally arises from yzcheng90 X-SpringBoot 6.0's implementation of role-based access control (RBAC) through dual dependency on frontend menu systems and backend permission tables, without enforcing atomic synchronization between these components. The critical flaw manifests when frontend menu updates (such as privilege revocation) fail to propagate to the backend permission table in real-time, creating a dangerous desynchronization. While users lose access to restricted functions through the web interface (as UI elements properly disappear), the stale permission records still validate unauthorized API requests when accessed directly through tools like Postman. Attackers exploiting this inconsistency can perform privileged operations including but not limited to: creating high-permission user accounts, accessing sensitive data beyond their clearance level, and executing admin-level commands.
Monkeytype 25.49.0 and earlier renders attacker-controlled quote submission fields (quote.text and quote.source) directly into the DOM inside the quote-approval modal, so HTML/script payloads survive the partial quote/textarea escaping and execute in the browser of the moderator reviewing the pending quote. This is a stored cross-site scripting (CWE-79) issue in a client-side TypeScript frontend, and publicly available exploit code exists, though exploitation requires a victim moderator to open the approval view (UI:P) and, per the assessed vector, an attacker account able to submit quotes (PR:L). Risk is real but low-urgency: EPSS is 0.05% (16th percentile) and the flaw is not listed in CISA KEV.
Server-side request forgery in Open WebUI versions prior to 0.6.37 lets any authenticated user force the server to fetch arbitrary URLs through the /api/v1/retrieval/process/web endpoint, exposing cloud instance metadata services (AWS/GCP/Azure/Alibaba), internal network ranges, and services behind the firewall. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N (7.1) - remotely reachable with low complexity, but it requires a valid session of any role, so instances that allow open self-registration effectively expose the endpoint to any network-reachable user. Publicly available exploit code exists (the GHSA includes a working curl PoC) and a vendor fix ships in 0.6.37; EPSS is low at roughly 0.04% (12th percentile), suggesting exploitation has not been observed at scale, though confirmed active exploitation (CISA KEV) has not been reported.
Loaded Commerce 6.6 contains a client-side template injection vulnerability that allows unauthenticated attackers to execute code on the server via the search parameter.
Unauthenticated information disclosure in Mersive Solstice Pod firmware (5.5/5.6 and 6.2) lets any host that can reach the Pod's web/API interface read sensitive data - including the live session key, server version, product details, and display name - from the /api/config endpoint without credentials or user interaction. Publicly available exploit code exists (Exploit-DB 52104) and a VulnCheck advisory documents the issue, but there is no CISA KEV entry; EPSS is low at roughly 0.09% (26th percentile), and real-world exposure is governed mainly by network placement, since Pods on segmented AV VLANs or otherwise unreachable from untrusted segments cannot be attacked. The impact is read-only disclosure: an attacker gains no code execution or write capability, so the practical risk depends on whether the leaked session key enables session hijacking in the target environment.
An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the 'rec_no' parameter in the /student/get-receipt endpoint.
Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all platform users.
Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.
Unauthenticated brute-force attacks against the Medtronic CareLink Network API authentication endpoint can allow remote attackers to determine a valid account password under certain circumstances, because the endpoint lacks adequate anti-automation controls such as rate limiting or account lockout (CWE-307). The vendor assigned CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H (9.8 Critical), while independent analysis assesses the practical risk as materially lower - AV:N/AC:H/PR:N/UI:N/C:H/I:N/A:N (approximately 5.9, Medium) - because the advisory itself limits success to 'certain circumstances' and no integrity or availability impact has been demonstrated. Risk signals are currently muted: EPSS is 0.13% (32nd percentile), there is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; all CareLink Network instances running code from before December 4, 2025 are affected, with no user interaction or prior authentication required (PR:N in both vectors).
An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. When they are powered on, an X11 display server is started. The display server listens on all network interfaces and is accessible over port 6000. The X11 access control list, by default, allows connections from 127.0.0.1 and 192.168.2.15. If a device is powered on and later connected to a network with DHCP, the device may not be assigned the 192.168.2.15 IP address, leaving the display server accessible by other devices on the network. The exposed X11 display server can then be used to gain root privileges and the ability to execute code remotely by interacting with matchbox-desktop and spawning a terminal. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
A remote code execution vulnerability (CVSS 9.8). Critical severity with potential for significant impact on affected systems.
A remote code execution vulnerability in Thermo Fisher Torrent Suite Django application 5.18.1 (CVSS 9.8). Critical severity with potential for significant impact on affected systems.
Local memory corruption in the Linux kernel's imx_sc_key input driver (drivers/input/keyboard/imx_sc_key.c) for NXP i.MX SoCs occurs during module unload/unbind: a devm cleanup action was registered with the address of a stack variable (&priv) instead of the priv pointer itself, so imx_sc_key_action() dereferences a stale stack address. Triggering the corruption requires unloading or unbinding the driver on affected i.MX hardware, and there is no public exploit identified at time of analysis. EPSS is negligible (0.05%, 16th percentile) and it is not in CISA KEV, so this is a stability/robustness fix on niche hardware rather than a broadly exploited flaw.
Local privilege-escalation-grade memory corruption in the Linux kernel's AF_VSOCK (virtio/vhost vsock) stack allows a local user to trigger a use-after-free or NULL-pointer dereference by racing a signal or timeout against an in-progress connect() on an already-established socket. Aborting the connect could tear down a connected socket while a concurrent sendmsg() or sockmap operation runs, corrupting credit accounting (bytes_unsent), breaking sockmap invariants, and enabling a transport change/drop after TCP_ESTABLISHED. No public exploit is identified at time of analysis and EPSS is 0.05%, but the flaw is patched across many stable branches and tracked by Ubuntu, Debian, and Siemens.
Local privilege escalation / kernel memory corruption in the Linux kernel's AF_UNIX garbage collector arises because unix_add_edge() fails to initialise the new vertex's scc_index field. On kernels where GC has already run and grouped sockets into strongly-connected components, a freshly allocated in-flight socket inherits a stale SCC index (via heap spraying), causing unix_vertex_dead() to misjudge an alive in-flight socket as dead and garbage-collect its receive queue - a use-after-free. A detailed public reproducer exists (publicly available exploit code exists); it is not in CISA KEV and EPSS is very low (0.04%).
Local denial of service in the Linux kernel's mlx5_core driver (Mellanox/NVIDIA ConnectX network adapters) allows a system crash when mlx5_irq_alloc() fails on an exhausted IRQ vector pool. The faulty error path frees the entire CPU reverse-map (rmap) instead of only the newly added IRQ glue object, producing a general protection fault in free_irq_cpu_rmap() when another thread later dereferences the freed structure. The fix is available from vendor; EPSS is very low (0.03%, 7th percentile) and there is no public exploit identified at time of analysis.
Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to render the Administrator password in plaintext.
Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors.
Stored cross-site scripting in Open WebUI's Notes PDF export (versions through 0.6.36) allows an attacker who can get crafted Markdown into a victim's Notes to execute JavaScript when the victim chooses 'Download PDF (.pdf)', exposing session/JWT tokens stored in the browser and enabling account takeover. The payload does not fire on import or normal viewing; exploitation requires the Notes feature and victim interaction (UI:R), and an external attacker can attempt it by sharing a malicious Markdown file for the victim to import. Publicly available exploit code exists, EPSS is low at 0.04% (13th percentile), and the issue is fixed in 0.6.37.
WEBIGniter 28.7.23 contains a cross-site scripting vulnerability in the user creation process that allows unauthenticated attackers to execute malicious JavaScript code, enabling potential XSS attacks.
A security vulnerability in its authentication mechanism (CVSS 5.3) that allows unauthenticated attackers. Risk factors: public PoC available.
Stored cross-site scripting in Compass Plus TranzAxis 3.2.41.10.26 allows an authenticated user to inject script through the 'Open Object in Tree' endpoint; the payload is stored and executes when another operator opens the crafted object, enabling session-cookie theft and possible privilege escalation. Publicly available exploit code exists (Exploit-DB 52086), but EPSS is only 0.03% (10th percentile) and there is no CISA KEV confirmation of active exploitation. This is a moderate-severity, low-priority issue gated by authenticated access and a victim opening the malicious object.
Host-header injection in LaraDashboard 2.3.0 and earlier allows remote attackers to poison the administrator password-reset link and redirect the reset token to an attacker-controlled host, enabling admin account takeover and, via the module installer, arbitrary PHP code execution. The reset URL is built with url(route(...)) rather than config('app.url'), so a crafted Host header controls the link; token capture still depends on administrator interaction or mail prefetching, and RCE requires module upload after takeover. No public exploit identified at time of analysis; vendor patch commit/advisory exist, and EPSS is 0.11% (29th percentile).
An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. The /configure/plugins/plugin/upload/zip/ and /configure/newupdates/offline/bundle/upload/ endpoints allow low-privilege users to upload ZIP files to the server. The plupload_file_upload function handles these file uploads and constructs the destination file path by using either the name parameter or the uploaded filename, neither of which is properly sanitized. The file extension is extracted by splitting the filename, and a format string is used to construct the final file path, leaving the destination path vulnerable to path traversal. An authenticated attacker with network connectivity can write arbitrary files to the server, enabling remote code execution after overwriting an executable file. An example is the pdflatex executable, which is executed through subprocess.Popen in the write_report_pdf function after requests to a /report/latex/(\d+).pdf endpoint.