Command injection in Signal K Server (maritime navigation) before 1.5.0 allows authenticated users to execute OS commands. EPSS 4.96% with PoC and patch available.
Sandbox escape in SandboxJS before 0.8.27 via __lookupGetter__ prototype chain access. CVSS 10.0 — complete sandbox bypass. PoC and patch available.
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal endpoint cause sensitive data logging. Patch available.
Critical path traversal in Wildfire IM instant messaging server before 1.4.3 allows unauthenticated access to arbitrary files. EPSS 0.25%, patch available.
Remote privilege escalation in Android Thread networking protocol implementation via out-of-bounds write. No additional execution privileges needed.
No password by default on industrial device — ships without any authentication, and setting a password is not enforced. Unauthenticated remote full access.
Unauthenticated file upload leading to stored XSS and potential RCE in Samsung MagicInfo9 Server. HTML files uploaded without authentication.
Hardcoded database credentials in Samsung MagicInfo9 Server allow direct database access and manipulation.
Improper password reset process in User Profile Builder WordPress plugin before 3.15.2 allows unauthenticated attackers to reset any user's password with minimal requests.
Local File Inclusion in parisneo/lollms-webui /reinstall_extension endpoint allows authenticated users to include arbitrary local files. EPSS 0.26%.
Out-of-bounds write in Android WLAN STA driver due to missing bounds check allows local privilege escalation to System with user interaction.
Arbitrary file write in H2O-3 machine learning platform version 3.46.0.1 allows remote attackers to write data to any file on the server.
NixOS Odoo package from 21.11 to before 25.11 publicly exposes the database manager interface without authentication, enabling full database control.