Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code execution.
ALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS command injection vulnerability via the command parameter in the popen.cgi endpoint.
Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows attackers to set the Administrator password and username as blank values, allowing attackers to bypass authentication.
ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library.
UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially write and execute arbitrary PHP code.
alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths.
Kernel crash and use-after-free list corruption in the Linux kernel's NVMe-over-Fibre-Channel (nvme-fc) transport driver occurs when tearing down a controller: nvme_fc_delete_ctrl() calls cancel_work_sync() on ->ioerr_work before nvme_fc_delete_association() completes, so a late I/O error can re-queue ->ioerr_work after cancellation and let it run against a freed nvme_fc_ctrl object. The result is a kworker hitting kernel BUG at lib/list_debug.c (list_del corruption) and an oops, affecting hosts using NVMe/FC attached storage. There is no public exploit identified at time of analysis, and EPSS is very low (0.05%), consistent with a local, hardware-conditional stability bug rather than a broadly weaponizable flaw.
Use-after-free in the Linux kernel's MPTCP subsystem stems from a race in mptcp_schedule_work() (net/mptcp/protocol.c), where the socket refcount was taken only after the work item was queued, allowing mptcp_worker() to run and free the socket before sock_hold() executes. Reachable via the MPTCP timeout timer (mptcp_tout_timer), it was found by syzbot and produces a refcount 'addition on 0' warning that signals kernel memory corruption. No public exploit identified at time of analysis and EPSS is very low (0.05%), consistent with a hard-to-time race rather than a readily weaponized flaw despite the auto-generated 9.8 score.
Denial-of-service via a use-after-free in the Linux kernel's MPTCP path-manager allows the add-address timer (mptcp_pm_del_add_timer()) to call sk_stop_timer_sync() on an announcement-list entry that another context has already freed, corrupting kernel memory. The flaw affects the mptcp subsystem across multiple long-lived stable branches and was found by syzbot via a KASAN slab-use-after-free report; the upstream fix adds RCU protection. No public exploit is identified at time of analysis, EPSS is 0.05%, and it is not listed in CISA KEV.
Out-of-bounds read in the Linux kernel's QLogic qede (FastLinQ 4xxxx) Ethernet driver arises in the TPA hardware-aggregation handlers qede_tpa_cont() and qede_tpa_end(), where loops walk the fixed-size cqe->len_list[] array using only a zero-length terminator as the stop condition; a missing or malformed terminator lets the loop read past the array. It affects systems running the qede driver on QLogic FastLinQ NICs and, if triggered, exposes the kernel to adjacent-memory disclosure or a crash. There is no public exploit identified at time of analysis, EPSS is very low (0.05%), and the flaw was found by static analysis (SVACE) rather than observed exploitation, so the published 9.8 CVSS appears substantially inflated relative to the true read-primitive impact.
LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attackers to redirect the administrator’s reset token to an attacker-controlled server. This can be combined with the module installation process to automatically execute the ServiceProvider::boot() method, enabling arbitrary PHP code execution.
An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. When they are powered on, an X11 display server is started. The display server listens on all network interfaces and is accessible over port 6000. The X11 access control list, by default, allows connections from 127.0.0.1 and 192.168.2.15. If a device is powered on and later connected to a network with DHCP, the device may not be assigned the 192.168.2.15 IP address, leaving the display server accessible by other devices on the network. The exposed X11 display server can then be used to gain root privileges and the ability to execute code remotely by interacting with matchbox-desktop and spawning a terminal. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
A remote code execution vulnerability (CVSS 9.8). Critical severity with potential for significant impact on affected systems.
A remote code execution vulnerability in Thermo Fisher Torrent Suite Django application 5.18.1 (CVSS 9.8). Critical severity with potential for significant impact on affected systems.
Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors.