Improper authentication in Sim's CRON secret handler allows attackers to bypass authentication on internal APIs and CRON endpoints when required environment secrets are not configured. Publicly available exploit code exists, and the issue affects Sim versions up to 0.5.27. Attackers can remotely access sensitive internal operations by providing an empty or arbitrary secret token.
Directory traversal in Yealink SIP-T21P(E2) IP phone firmware 52.84.0.15 exposes arbitrary files to low-privileged remote attackers via a crafted request to the diagnostic component's result read function. The flaw is confined to confidentiality impact - attackers can exfiltrate sensitive files (credentials, configuration, logs) stored on the device but cannot modify or crash it. A publicly available proof-of-concept exists, though EPSS at 0.62% indicates limited observed exploitation activity and the device is not listed in the CISA KEV catalog.
Authentication bypass in Alteryx Server's Gallery API status endpoint (/gallery/api/status/) allows remote, unauthenticated attackers to access restricted information and perform low-impact modifications. Public exploit code is available, but no active exploitation or CISA KEV listing has been observed. EPSS score of 0.03% indicates low likelihood of widespread attacks.