Command injection in the Comfast CF-N1-S router version 2.6.0.1 allows an authenticated remote attacker to execute arbitrary OS commands by manipulating the `destination` parameter of the `/cgi-bin/mbox-config?method=SET§ion=ping_config` CGI endpoint. A public exploit has been released on GitHub. No vendor patch exists - the vendor was contacted prior to disclosure and did not respond. Despite the public POC, EPSS sits at 0.84% and SSVC classifies exploitation as none with partial technical impact, suggesting limited real-world uptake at time of analysis.
Reflected XSS in mailcow-dockerized's login page (all versions prior to 2026-03b) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The flaw stems from two compounding issues: the raw `REQUEST_URI` server variable is rendered inside a JavaScript string literal in `base.twig` using HTML-only escaping instead of JS-context escaping, and the `query_string()` helper propagates all `$_GET` parameters into language-switching links, preserving injected payloads across page navigation. A publicly available Nuclei detection template confirms the attack surface is known; however, SSVC lists exploitation as 'none' and EPSS at 0.05% indicates no observed widespread abuse at time of analysis.
Server-side request forgery in Bagisto's Downloadable Link Handler component (versions up to 2.3.15) allows authenticated remote attackers to perform arbitrary HTTP requests on behalf of the server, potentially enabling access to internal resources, metadata services, or information disclosure. The vulnerability has publicly available exploit code and affects the copy function with low-to-moderate CVSS score (5.3) but concrete real-world impact if internal services are exposed. Vendor acknowledges the issue and states fixes are coming in upcoming releases.
Cross-site scripting (XSS) in WebSystems WebTOTUM 2026 Calendar component allows authenticated remote attackers to inject malicious scripts via an unknown function, requiring user interaction for exploitation. Publicly available exploit code exists, and vendor has released a patched version following responsible disclosure.
Stored cross-site scripting (XSS) in Bagisto up to version 2.3.15 allows authenticated attackers to inject malicious scripts via the Custom Scripts Handler component, which are then executed in the browsers of other users with user-interaction. The vulnerability has publicly available exploit code and affects the integrity of user sessions. Vendor has acknowledged the issue and committed to fixes in upcoming releases but no patched version has been released at time of analysis.
Improper access control in Oracle User Management (E-Business Suite component: Workflow and Business Events) exposes versions 12.2.7 through 12.2.15 to unauthorized data access and manipulation by highly privileged, authenticated network attackers over HTTP. Successful exploitation yields limited confidentiality and integrity impact - read access to a subset of data and the ability to insert, update, or delete some records - with no availability impact. No active exploitation is confirmed (absent from CISA KEV), EPSS stands at 0.03% (7th percentile), and SSVC rates exploitation status as none, making this a low operational priority despite the network-reachable attack vector.
Partial denial-of-service exposure in the Libraries component of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition allows unauthenticated remote attackers to degrade service availability across a wide range of versions from Java 8u481 through 26. The flaw (CWE-770) can be triggered via APIs exposed by web services consuming attacker-controlled input, or through client-side Java Web Start and applet environments loading untrusted code. No active exploitation has been observed (not in CISA KEV), no public proof-of-concept has been identified, and both EPSS (0.04%, 12th percentile) and SSVC (Exploitation: none, Automatable: no) classify this as low operational urgency.
BACnet Stack prior to version 1.4.3 exhibits undefined behavior in the decode_signed32() function when processing signed-integer property values containing bytes with the high bit set, causing denial of service through integer overflow. Network-remote attackers can trigger this vulnerability by sending specially crafted BACnet packets with high-bit-set byte sequences, resulting in application instability or crash on embedded systems running vulnerable versions. The vulnerability is confirmed fixed in version 1.4.3.
Oracle Java SE 25.0.1 exposes an integrity-bypass in its Libraries component that allows a remote unauthenticated attacker, via multiple protocols, to perform unauthorized data writes against accessible Java SE data. The attack is constrained to client-side deployments - specifically sandboxed Java Web Start applications and sandboxed Java applets loading untrusted internet code - and carries a vendor-assigned CVSS 3.7 (Low). No active exploitation is confirmed (SSVC: none, EPSS: 0.03%), and a vendor patch is available via the April 2026 Oracle Critical Patch Update.
HTTP request smuggling in HCL BigFix Service Management allows remote unauthenticated attackers to exploit HTTP parsing inconsistencies between front-end and back-end servers, potentially leading to limited information disclosure through cache poisoning or request hijacking attacks. The vulnerability has a CVSS score of 3.7 with low confidentiality impact but no direct availability or integrity impact.
October CMS versions prior to 3.7.16 and 4.1.16 fail to enforce fine-grained sub-permission checks for asset and blueprint file operations in the CMS and Tailor editor extensions, allowing backend users with editor access but explicitly withheld editor.cms_assets or editor.tailor_blueprints permissions to perform unauthorized file operations (create, delete, rename, move, upload) on theme assets and blueprint files. Additionally, an operator precedence error discloses the theme blueprint directory tree under the same conditions. This affects an uncommon permission configuration where high-privileged users have granular restrictions selectively applied.
Honor PcManager contains a privilege bypass vulnerability allowing local attackers without privileges to impact service availability through a type-confusion mechanism. The vulnerability requires high attack complexity and local access, resulting in a CVSS 3.2 (low severity) score with confidentiality and integrity impact ruled out. No active exploitation or public exploit code has been identified at the time of analysis.
Improper access control in Oracle VM VirtualBox 7.2.6's Core component allows a high-privileged local attacker with logon access to the host infrastructure to perform unauthorized writes, inserts, or deletions against VirtualBox-accessible data. Notably, Oracle's advisory confirms a scope change - successful exploitation may affect additional products beyond VirtualBox itself, such as guest VM environments sharing the same host. No active exploitation is confirmed (SSVC: none; EPSS: 0.01%, 2nd percentile), and no public exploit or POC has been identified at time of analysis.
Disk exhaustion via decompression bomb in OpenBao's OCI plugin downloader allows network attackers to exhaust victim disk resources by serving a crafted container image. The vulnerability exists in ExtractPluginFromImage() which writes decompressed tar streams without size bounds, and validates SHA256 integrity only after the full file is written to disk. An attacker controlling or compromising the OCI registry can replace legitimate plugin images with malicious compressed payloads that decompress to arbitrarily large files, causing denial of service. OpenBao versions prior to 2.5.3 are affected; the CVSS score of 3.1 reflects low impact (availability only) but the attack requires the victim to manually trigger plugin extraction with a compromised registry configured.
Reflected cross-site scripting (XSS) in October CMS backend DataTable widget allows unauthenticated remote attackers to inject arbitrary JavaScript via a query parameter, requiring user interaction to execute malicious code. The vulnerability affects versions prior to 3.7.16 and 4.1.16, with a low severity CVSS score of 3.1 reflecting the requirement for high attack complexity and user clicking a malicious link.
Unauthorized read access to a subset of JVM-accessible data is achievable in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition via a flaw in the Security component, exploitable by a local unauthenticated attacker with infrastructure logon access. The attack carries high complexity (AC:H), limiting opportunistic exploitation, and is confirmed by Oracle's April 2026 Critical Patch Update with patches available. All exploitation signals are minimal: EPSS is 0.01% at the 2nd percentile, SSVC registers exploitation as none and not automatable, and neither KEV listing nor public exploit code has been identified.
Information disclosure in Oracle Java SE (8u481 through 26) and Oracle GraalVM (for JDK 17.0.18/21.0.10; Enterprise Edition 21.3.17) exposes a subset of data accessible to the Java process via the Security component. Exploitation requires local infrastructure logon and high attack complexity (AC:H), limiting the realistic threat surface significantly. No public exploit has been identified, EPSS is at the 2nd percentile (0.01%), and CISA SSVC classifies exploitation status as none - making this a low-priority finding despite the breadth of affected product versions.
Information disclosure in Oracle MySQL Server's Information Schema component allows high-privileged remote attackers to read an unauthorized subset of MySQL Server data across three major version lines. Affected are versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. No public exploit code exists, EPSS exploitation probability sits at 0.03% (7th percentile), and CISA has not added this to KEV - all signals converge on this being a low-priority, low-severity finding appropriate for routine patch cycle treatment.
Unauthorized read access in Oracle Database Server's RDBMS component (versions 19.3-19.30) is achievable by a highly privileged attacker holding the Row Access Method privilege, via multiple network protocols, when a third party performs required human interaction. Impact is limited to a partial confidentiality disclosure of RDBMS-accessible data with no integrity or availability effects. No public exploit exists and EPSS at 0.03% (7th percentile) reflects near-zero exploitation likelihood; SSVC confirms exploitation status as none and the attack is not automatable.
Partial denial-of-service in Oracle VM VirtualBox 7.2.6 Core component allows a locally authenticated, high-privileged attacker to degrade availability of the hypervisor. Exploitation is limited to the local system and requires pre-existing administrative-level access, with no confidentiality or integrity impact. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog; EPSS at 0.01% (2nd percentile) reflects near-zero exploitation probability.
OpenBao versions prior to 2.5.3 allow high-privileged administrators in one tenant to revoke or renew authentication tokens belonging to users in other tenants if the token accessor is disclosed, bypassing the multi-tenant isolation guarantee. The vulnerability requires high privilege level and user interaction but undermines the core security boundary of OpenBao's namespace-based multi-tenancy model. No active exploitation has been reported.
OpenBao's Certificate authentication method with disable_binding=true allows token renewal using any sibling certificate signed by the same CA, rather than requiring the original certificate, enabling attackers with knowledge of a token or accessor to extend dynamic lease lifetimes beyond intended scope. The vulnerability affects OpenBao versions prior to 2.5.3 and requires high privileges and user interaction, resulting in a CVSS 2.0 score with low confidentiality and integrity impact. No public exploit code or active exploitation has been identified.
OpenClaw before version 2026.3.31 fails to sanitize environment variables in its host exec policy, allowing authenticated local attackers to override proxy, TLS, Docker, and Git TLS security controls. An attacker with local access and limited privileges can bypass intended security restrictions by injecting malicious environment variables, potentially disabling certificate verification or redirecting traffic through unauthorized proxies. No public exploit code has been identified, and the vulnerability requires process interaction (AT:P) to trigger.