Path traversal in radare2's project deletion function (r_core_project_delete in libr/core/project.c) allows a local attacker to cause recursive deletion of arbitrary directories by supplying crafted absolute project paths that escape the configured dir.projects root. All versions prior to 6.1.4 are affected. An attacker who controls a project file path can cause radare2 - running with the victim's permissions - to wipe arbitrary directories, resulting in significant integrity and availability impact. No public exploit identified at time of analysis for weaponized in-the-wild use; however, a publicly available exploit (POC) exists via the upstream GitHub PR, and SSVC rates technical impact as total despite non-automatable exploitation.
Path traversal in radare2's project notes handling exposes arbitrary filesystem files to read and overwrite when a user imports a crafted .zrp archive. All radare2 releases prior to 6.1.4 are vulnerable via the `r_core_project_notes_file()` function in `libr/core/project.c`, which failed to detect symlinks within imported project archives before performing note operations. An attacker who can deliver and persuade a victim to import a malicious .zrp file can escape the configured `dir.projects` directory entirely, gaining low confidentiality and high integrity impact on the host filesystem. No active exploitation is confirmed in CISA KEV, but a working proof-of-concept is publicly available in the referenced GitHub PR test suite.
HT Mega Addons for Elementor WordPress plugin before version 3.0.7 leaks customer PII through an unauthenticated AJAX endpoint, exposing full name, city, state, and country for any orders placed in the prior 7 days. Any remote unauthenticated attacker can query this endpoint without credentials on affected WordPress installations. A public proof-of-concept is available and SSVC classifies the attack as automatable, enabling mass scanning of exposed WooCommerce stores; however, the EPSS score of 0.77% suggests exploitation has not yet become widespread.
SenseLive X3050 web management interface transmits all administrative communication including authentication credentials and configuration data over unencrypted HTTP, allowing network-adjacent attackers to intercept sensitive operational information without authentication or user interaction. The vulnerability affects all versions of the X3050 and is classified as information disclosure with confirmed CISA ICS advisory coverage.
Resource exhaustion in OpenClaw npm package versions up to 2026.3.28 allows remote unauthenticated attackers to degrade availability of the LINE webhook integration by flooding the endpoint with concurrent requests before signature verification occurs. The CVSS 4.0 score of 6.9 reflects network-accessible, zero-privilege exploitation with bounded low availability impact; the vendor's own triage classifies severity as low due to the transient, non-persistent nature of the disruption. No public exploit code exists and no active exploitation is confirmed - SSVC marks exploitation status as none, though the attack is rated automatable.
XML injection in Kirby CMS's XML creator toolkit allows attackers who can supply input to `Xml::value()`, `Xml::tag()`, `Xml::create()`, or the `Xml` data handler to bypass CDATA escaping and inject arbitrary XML structure into generated output. Affected versions are getkirby/cms below 4.9.0 and 5.0.0 through 5.4.0 exclusively when site or plugin code passes attacker-controlled data through these methods. No public exploit has been identified at time of analysis, EPSS is 0.04%, and CISA SSVC rates exploitation as none — real-world risk is conditional on a specific non-default usage pattern not present in the Kirby core.
OpenLearn forum software with safeMode enabled allows unauthenticated attackers to bypass post approval restrictions and read unpublished content directly via post UUID, bypassing the public forum list filtering. The vulnerability affects all versions prior to commit 844b2a40a69d0c4911580fe501923f0b391313ab and is remotely exploitable without authentication or user interaction. A vendor patch is available.
OpenClaw's Control UI bootstrap HTTP endpoint exposed internal system metadata - specifically the server version string and assistant agent identifier - in its JSON response payload to any unauthenticated network client on versions up to and including 2026.3.28. This constitutes a fingerprinting/information disclosure vulnerability (CWE-497) that enables attackers to enumerate precise deployment versions and agent configurations without authentication. No active exploitation has been confirmed (not in CISA KEV, EPSS 0.03%), and the maintainer assessed severity as low-narrow; a patched release (2026.3.31) was published 2026-03-30.
PySpector versions prior to 0.1.8 allow arbitrary code execution within the PySpector process when a malicious plugin is supplied and executed. The plugin security validator uses incomplete AST-based static analysis that fails to block dangerous Python constructs, permitting attackers with write access to plugin files to bypass the blocklist and achieve remote code execution. The vulnerability is fixed in version 0.1.8.
Heap-based buffer overflow in Libgcrypt before 1.12.2 allows local attackers to trigger denial of service and corrupt memory via crafted ECDH ciphertext passed to gcry_pk_decrypt, affecting cryptographic operations in dependent applications including GnuPG. No public exploit code or active exploitation has been identified at time of analysis; vendor has released patched versions 1.10.4, 1.11.3, and 1.12.2 to resolve the vulnerability.
Authenticated users can trigger a denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 for Linux, UNIX, and Windows through improper neutralization of special elements in database query logic, causing service unavailability without requiring user interaction or special configuration. The vulnerability affects both standalone Db2 instances and Db2 Connect Server deployments, with CVSS 6.5 reflecting network accessibility and authenticated access requirements. No public exploit code or active exploitation has been identified at the time of analysis.
Unauthenticated remote command injection in ToToLink A3300R routers running firmware v17.0.0cu.557_B20221024 allows network-accessible attackers to execute arbitrary OS commands by injecting shell metacharacters into the `informEnable` parameter of the `/cgi-bin/cstecgi.cgi` CGI endpoint. A proof-of-concept exploit is publicly hosted on GitHub, and the SSVC assessment confirms the attack is automatable with no required privileges or user interaction. Despite the PoC availability, EPSS sits at 0.04% (12th percentile), suggesting limited observed exploitation at time of analysis, likely reflecting the niche deployment footprint of this device rather than limited attacker capability.
Command injection in TOTOLINK A3300R firmware v17.0.0cu.557_B20221024 exposes the router's CGI management interface to unauthenticated remote attackers who can execute arbitrary OS commands by injecting shell metacharacters into the dhcpMtu parameter of /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit is available on GitHub, and SSVC assessment marks exploitation as automatable with partial technical impact. No vendor-released patch has been identified at time of analysis, leaving affected devices persistently vulnerable.
Unauthenticated command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 permits remote attackers to execute arbitrary OS commands by supplying a malicious payload in the `mode` parameter to the `/cgi-bin/cstecgi.cgi` CGI endpoint. A public proof-of-concept is available on GitHub, and SSVC classifies the attack as automatable with no authentication required per the provided CVSS vector, making mass exploitation feasible despite a low EPSS score of 0.04%. No vendor patch has been identified at time of analysis, leaving devices with internet-exposed management interfaces without a vendor-supplied fix.
Command injection in ToToLink A3300R router firmware v17.0.0cu.557_B20221024 allows unauthenticated remote attackers to execute arbitrary OS commands by supplying a crafted value to the `interval` parameter of the `/cgi-bin/cstecgi.cgi` endpoint. The SSVC assessment confirms publicly available proof-of-concept exploit code exists and the attack is automatable, meaning scripted mass exploitation is feasible against any internet-exposed instance. No KEV listing is present and EPSS sits at a low 0.04%, likely reflecting the niche market footprint of the device rather than low exploitability.
Unauthenticated remote command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allows network-adjacent or internet-facing attackers to execute arbitrary OS commands on the router by supplying shell metacharacters in the recHour parameter of the /cgi-bin/cstecgi.cgi endpoint. A publicly available proof-of-concept exploit exists on GitHub, and SSVC flags this as automatable with no authentication barrier, making mass exploitation of exposed devices feasible. No vendor patch has been identified at time of analysis; no CISA KEV listing exists, but the combination of unauthenticated network access and available POC represents a credible near-term risk.
Remote command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allows unauthenticated network-adjacent or remote attackers to execute arbitrary OS commands by submitting shell metacharacters in the `ttlWay` parameter to the `/cgi-bin/cstecgi.cgi` management endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-friction exploitation with no authentication requirement, and SSVC classifies the attack as automatable. A public proof-of-concept is available on GitHub; however, EPSS at 0.04% (12th percentile) indicates limited observed exploitation in the wild at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated remote command injection in ToToLink A3300R router firmware v17.0.0cu.557_B20221024 allows attackers to execute arbitrary OS commands by passing a malicious payload through the `week` parameter of the `/cgi-bin/cstecgi.cgi` CGI endpoint. A public proof-of-concept is hosted on GitHub (confirmed by SSVC exploitation status: poc), and the attack is rated automatable by SSVC, meaning mass scanning and exploitation is feasible without manual intervention. Despite these conditions, EPSS sits at 0.04% (12th percentile), indicating minimal observed exploitation in the wild at time of analysis - likely reflecting the niche deployment footprint of this budget consumer router.
Command injection in TOTOLINK A3300R firmware v17.0.0cu.557_B20221024 allows unauthenticated remote attackers to execute arbitrary OS commands by supplying shell metacharacters in the pppoeServiceName parameter submitted to /cgi-bin/cstecgi.cgi. A public proof-of-concept repository exists (SSVC exploitation=poc; GitHub reference confirmed) and the attack is classified as automatable with no privileges or user interaction required per the CVSS vector. No vendor-released patch has been identified at time of analysis, and the provided CVSS impact metrics (C:L/I:L/A:N) appear significantly understated relative to what arbitrary OS command execution on an embedded router realistically yields.
Unauthenticated OS command injection in ToToLink A3300R router firmware v17.0.0cu.557_B20221024 exposes the device to remote code execution via the /cgi-bin/cstecgi.cgi web management endpoint. The published CVSS score of 6.5 with C:L/I:L/A:N impact metrics is inconsistent with the arbitrary command execution primitive described - router firmware CGI handlers typically execute with root-equivalent privileges, making full device compromise the realistic outcome. A public proof-of-concept repository exists on GitHub, and SSVC classifies the vulnerability as automatable, though no confirmed active exploitation appears in CISA KEV at time of analysis.
Command injection in ToToLink A3300R router firmware v17.0.0cu.557_B20221024 exposes the device to unauthenticated remote OS command execution through the web management CGI interface. The `provider` parameter passed to `/cgi-bin/cstecgi.cgi` is not sanitized before being used in a system command, allowing any network-reachable attacker to run arbitrary commands on the router. A proof-of-concept is publicly available on GitHub (confirmed by SSVC classification), and SSVC rates the attack as automatable with partial technical impact; EPSS at 0.04% (12th percentile) suggests exploitation remains limited in scale, likely reflecting the narrow deployment footprint of this budget SOHO router model.
Unauthenticated command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 exposes the device's CGI management interface to arbitrary OS command execution via the password parameter at /cgi-bin/cstecgi.cgi. The CVSS vector (PR:N, AV:N, AC:L, UI:N) confirms exploitation requires no credentials and no user interaction, making it scriptable against any Internet-exposed device. A public proof-of-concept exists on GitHub, and SSVC classifies the vulnerability as automatable with a PoC - though the EPSS score of 0.04% (12th percentile) suggests exploitation has not yet reached widespread real-world activity, likely reflecting the niche deployment footprint of this SOHO router model.
Unauthenticated remote command injection in TOTOLINK A3300R firmware v17.0.0cu.557_B20221024 allows network-adjacent or internet-exposed attackers to execute arbitrary OS commands by injecting shell metacharacters into the stun-port parameter of /cgi-bin/cstecgi.cgi. The CVSS vector (PR:N/AC:L/UI:N) confirms no credentials or user interaction are required, and the SSVC assessment independently classifies the attack as automatable with a publicly available proof-of-concept - though EPSS at 0.04% (12th percentile) indicates minimal observed exploitation activity to date and no CISA KEV listing has been recorded. The vendor-assigned impact metrics (C:L/I:L/A:N) appear inconsistent with the expected consequence of OS-level command execution on router firmware, which typically yields full device compromise.
Command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 exposes the device to arbitrary OS command execution via the stun-user parameter of the /cgi-bin/cstecgi.cgi endpoint. The CVSS vector assigns no privileges required and no user interaction, making this remotely exploitable from the network, and the SSVC framework independently classifies it as automatable with a publicly available proof-of-concept on GitHub. Notably, the provided CVSS impact ratings of C:L/I:L/A:N appear to significantly understate the realistic consequence of arbitrary command execution on embedded router firmware - no public exploit activity is confirmed and EPSS sits at the 12th percentile, suggesting limited real-world exploitation so far.
Command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 enables remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the `pppoeMtu` parameter of the `/cgi-bin/cstecgi.cgi` web management endpoint. A public proof-of-concept is available on GitHub, and SSVC classifies this as automatable with poc-level exploitation status. No public exploit identified at time of analysis meets the KEV threshold; EPSS sits at just 0.04% (12th percentile), suggesting limited real-world exploitation activity despite POC availability.
Command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allows remote attackers to execute arbitrary OS commands by sending a crafted request to /cgi-bin/cstecgi.cgi with a malicious user parameter. A public proof-of-concept is available on GitHub, and SSVC confirms exploitation is automatable with partial technical impact. Despite a CVSS score of 6.5 with conservative impact metrics, the arbitrary command execution nature of CWE-77 on a network-exposed CGI endpoint is likely understated - no vendor patch has been identified at time of analysis.
Stored cross-site scripting (XSS) in Rescue Shortcodes WordPress plugin versions through 3.3 allows authenticated users with limited privileges to inject malicious scripts that execute in the context of other users' browsers, potentially compromising site administrators and other high-privilege accounts. Attack requires user interaction (UI:R) but affects the entire scope of the application (S:C), enabling privilege escalation and data theft with moderate impact.
Stored cross-site scripting (XSS) in Magepeople's Taxi Booking Manager for WooCommerce plugin (versions up to 2.0.0) allows authenticated users with low privileges to inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, credential theft, or defacement. The vulnerability requires user interaction (UI:R) and affects the confidentiality, integrity, and availability of the application. No public exploit code or active exploitation has been confirmed at this time.
IBM Security Verify Access and Verify Identity Access products versions 10.0 through 10.0.9.1 and 11.0 through 11.0.2 use cryptographic algorithms weaker than expected, allowing authenticated network attackers to decrypt highly sensitive information. The vulnerability affects both containerized and non-containerized deployments across multiple major versions. CVSS 6.5 reflects high confidentiality impact with low attack complexity, though authenticated access is required.
Command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allows network-accessible attackers to execute arbitrary OS commands by supplying shell metacharacters in the 'hour' parameter of the /cgi-bin/cstecgi.cgi management endpoint. A public proof-of-concept is confirmed on GitHub and SSVC classifies exploitation as automatable, meaning scripted mass-scanning is feasible against any exposed management interface. No vendor-released patch has been identified; the provided CVSS impact scoring of C:L/I:L/A:N appears inconsistent with the actual capability of arbitrary command execution on embedded firmware, warranting independent re-evaluation.
Server-Side Request Forgery (SSRF) in ntfy (ntfy.sh) before v2.22.0 allows authenticated remote attackers to make the server issue arbitrary HTTP requests to internal network resources by exploiting an unanchored regex pattern in the web push endpoint allow-list. Despite the CVE description attributing the vulnerability to the 'parseActions' function with an RCE classification, the confirmed fix in v2.22.0 - tightening the web push endpoint allow-list regex to prevent SSRF via unanchored pattern matching - indicates the real impact is SSRF, not arbitrary code execution. No active exploitation has been confirmed (not in CISA KEV), though a public proof-of-concept gist exists from the reporter.
Stored Cross-Site Scripting in WP Store Locator plugin for WordPress up to version 2.2.261 allows authenticated contributors and above to inject arbitrary JavaScript via the 'wpsl_address' post meta field, executing in browsers of any user who views an affected map marker info window. The vulnerability requires contributor-level access or higher and does not require user interaction beyond normal page browsing, resulting in session hijacking, credential theft, or malware distribution with CVSS 6.4 impact spanning confidentiality and integrity across security boundaries.
Stored Cross-Site Scripting in Social Rocket - Social Sharing Plugin for WordPress up to version 1.3.4.2 allows authenticated Subscriber-level users to inject arbitrary JavaScript via the 'id' parameter, which executes in the browsers of all users viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping, and exploitation requires only subscriber-level WordPress authentication with no user interaction needed beyond the initial injection.
Denial of service in OpenClaw versions 2026.2.26 through pre-2026.3.31 allows unauthenticated remote attackers to exhaust the shared pending pairing-request window on multi-account channel deployments, blocking legitimate accounts from initiating new pairing or onboarding. The root flaw is a quota-scoping error: the cap on pending requests was enforced per channel file rather than per account, so one actor's requests consume capacity allocated to unrelated accounts. The GHSA advisory confirms this is an availability-only impact - no cross-account data access, approval, or authorization bypass is possible. No public exploit or CISA KEV listing exists; EPSS probability is 0.10%, reflecting minimal real-world exploitation pressure at time of analysis.
OpenClaw's Telegram legacy `allowFrom` migration incorrectly propagates default-account trust to all configured named Telegram accounts in npm package versions through 2026.3.28, enabling Telegram users previously trusted only on the default account to bypass authentication controls and interact with named accounts they were never explicitly authorized to access. The vendor-confirmed fix is present in version 2026.3.31, released 2026-03-31. No public exploit exists; EPSS is 0.06% and CISA SSVC records exploitation as none at time of analysis.
Rate limiting bypass in OpenClaw's WebSocket gateway (npm package ≤ 2026.3.28) allows unauthenticated remote attackers to conduct unbounded brute-force attempts against shared-secret passwords by including a fake DeviceToken field in WebSocket handshake requests, suppressing the IP-based rate limiter. The maintainer's own triage classifies the practical risk as narrow, noting that only deployments relying on weak shared passwords face meaningful threat since high-entropy secrets remain non-bruteforceable regardless of rate limiting. No public exploit code exists, EPSS is 0.04%, and SSVC exploitation status is none - consistent with a low-priority patching target outside of weak-credential deployments.
Silent message suppression in OpenClaw's Zalo webhook integration allows deduplicate key collisions across distinct conversations and senders, causing legitimate bot events to be silently dropped. All OpenClaw npm installations prior to version 2026.4.2 are affected via CPE cpe:2.3:a:openclaw:openclaw. An unauthenticated network attacker who can send or replay Zalo webhook events with a predictable message_id can cause cross-chat or cross-sender deduplication collisions, disrupting bot workflows without any visible error. No public exploit has been identified at time of analysis; EPSS is 0.04% (11th percentile) and SSVC confirms no active exploitation.
Blind server-side request forgery in SocialEngine 7.8.0 and prior allows authenticated remote attackers to weaponize the server as an HTTP proxy against internal infrastructure via the /core/link/preview endpoint's unsanitized `uri` parameter. The vulnerability enables internal network enumeration, discovery of non-externally-reachable services, and potential access to cloud metadata endpoints such as AWS IMDSv1. EPSS is very low at 0.04% (11th percentile) with no active exploitation identified (not in CISA KEV, SSVC exploitation=none), but the CVSS 4.0 subsequent-system confidentiality score of High signals meaningful lateral risk in cloud-hosted or network-rich deployments.
Replay detection bypass in the OpenClaw npm package (versions ≤ 2026.3.28) allows an attacker who has previously captured a valid Telnyx-signed webhook to re-encode the Ed25519 signature from standard Base64 to Base64URL and resubmit the payload as an apparently unreplayed request. Because Ed25519 cryptographic verification operates on the decoded byte sequence, both encodings pass signature validation; only the replay cache lookup - keyed on the raw uncanonicalised header string - is defeated, enabling duplicate event processing. No public exploit has been identified at time of analysis and EPSS stands at 0.03% (8th percentile), consistent with SSVC Exploitation: none and the maintainer's own normalized severity of low.
Callback origin mutation in OpenClaw's Plivo voice-call replay handler allows an attacker in possession of a captured valid Plivo webhook callback for a live call to inject a modified Host header during the replay window, causing OpenClaw to store an attacker-controlled domain as the callback base URL before replay rejection occurs. All npm releases of openclaw up to and including 2026.3.28 are affected; the vendor-triaged severity is low and scope is narrow, requiring pre-capture of a live call's callback as an explicit prerequisite. No public exploit identified at time of analysis, and EPSS sits at 0.03% (7th percentile), consistent with minimal observed exploitation activity.
Weak cryptography in the TDDPv2 debug protocol on TP-Link TL-WR841N v13 routers exposes devices left in default configuration to network-adjacent attackers. DES-CBC encryption - an algorithm deprecated for over a decade - is keyed from the device's default web management credentials, meaning the cryptographic secret is fully predictable without any credential theft. An attacker sharing the same network segment can exploit this to access the debug protocol unauthenticated, exfiltrate debug output, alter device configuration, and force reboots, resulting in integrity loss and denial of service. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact.
Path traversal in Chainguard's melange build tool (versions >= 0.32.0, < 0.43.4) allows an attacker who can influence a melange configuration file to escape the designated pipeline directory via `../` sequences or absolute paths in `pipeline[].uses`, enabling both arbitrary file reads and shell command execution within the build sandbox. This is acutely dangerous in pull-request-driven CI or build-as-a-service scenarios where untrusted contributors can submit melange configs that are automatically built without review. No public exploit has been identified at time of analysis; EPSS of 0.01% and SSVC exploitation status 'none' confirm no observed active exploitation, but the impact of arbitrary shell execution during a trusted build pipeline makes this high-priority for affected CI deployments.
OpenClaw npm package versions up to and including 2026.3.28 leaks Authorization headers to attacker-controlled servers by forwarding them intact across cross-origin HTTP redirects during media downloads. An attacker who can induce a victim's OpenClaw instance to fetch a media URL that redirects cross-origin - to an attacker-controlled host - receives the victim's full Authorization bearer token. No public exploit or CISA KEV listing exists; EPSS of 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate low current exploitation activity, though the credential-theft impact class is high for any user whose authorization tokens are intercepted.
PKCE code_verifier validation in @node-oauth/oauth2-server (versions <= 5.2.1) does not enforce RFC 7636 ABNF requirements, accepting arbitrarily short values including single-character strings for S256 flows. An attacker who intercepts an authorization code can brute-force the code_verifier online because failed attempts do not consume the code, allowing repeated guesses until token issuance succeeds. A working proof-of-concept is publicly documented in the GitHub security advisory; no active exploitation confirmed in CISA KEV.
Unbounded HTTP response body allocation in OpenTelemetry.Sampler.AWS allows an attacker who controls the configured X-Ray sampling endpoint or who holds a network MitM position to exhaust heap memory and crash the consuming .NET process via OutOfMemoryException. Both NuGet packages OpenTelemetry.Sampler.AWS (versions below 0.1.0-alpha.8) and OpenTelemetry.Resources.AWS (versions below 1.15.1) are affected, with AWSXRaySamplerClient.DoRequestAsync calling ReadAsStringAsync() with no response size cap. No public exploit has been identified and EPSS sits at 0.01% (2nd percentile), consistent with SSVC exploitation status of none and CISA KEV absence, making this a low-urgency but patchable DoS risk.
Environment variable injection in OpenClaw (npm) versions through 2026.3.24 allows a local, low-privileged attacker who can submit approved exec requests to redirect git or AWS CLI behavior through attacker-controlled configuration files, enabling untrusted code execution via git template hooks or malicious AWS credential loading. The root cause is an incomplete host-env blocklist - specifically, GIT_TEMPLATE_DIR and AWS_CONFIG_FILE were absent from the sanitization policy in src/infra/host-env-security-policy.json and src/infra/host-env-security.ts. No public exploit has been identified at time of analysis; EPSS sits at the 3rd percentile and SSVC rates exploitation as none, indicating no known active threat activity.
Uninitialized variable usage in OpenSC's libopensc library enables information disclosure and denial of service when processing specially crafted responses from malicious USB devices or smart cards. Attackers must physically present a crafted USB or smart card device to trigger the vulnerability, which reads uninitialized memory from the stack or heap, potentially exposing sensitive data or causing application crashes. No public exploit code has been identified at time of analysis.
IBM Security Verify Directory (Container) versions 10.0.0 through 10.0.0.3 fails to validate uploaded file types, allowing privileged users to upload malicious files that can be distributed to victims for lateral attacks. The vulnerability requires high-privilege credentials but enables integrity compromise and partial availability impact once exploited.
Denial of service in Linux kernel nexthop query handling allows local authenticated attackers to crash the kernel by querying nexthop objects with large Equal-Cost Multi-Path groups via the RTM_GETNEXTHOP netlink message. The vulnerability stems from fixed-size socket buffer allocation that overflows when processing nexthop groups exceeding approximately 512 members, triggering a kernel warning and potential system instability.
Froxlor versions prior to 2.3.6 allow authenticated resellers to bypass domain quota restrictions by attributing newly created domains to arbitrary admins through unvalidated `adminid` parameter input in the `Domains.add()` function. This vulnerability enables quota exhaustion attacks against other administrators and domain creation beyond the attacker's assigned limits, with confirmed patch availability in version 2.3.6.