Privilege escalation in Windows Admin Center in Azure Portal (versions 1.0 up to but not including 2.6.7) lets an already-authenticated, low-privileged network user gain higher privileges by abusing improper access control (CWE-284). Microsoft reports a patch is available; there is no public exploit identified at time of analysis and EPSS probability is low (0.06%). Tagged as an authentication-bypass class issue, successful exploitation yields total control (high confidentiality, integrity, and availability impact) over the affected management surface.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated attacker with low-privilege access to execute arbitrary code across the network by abusing insufficiently granular access controls (CWE-1220). The flaw carries a CVSS 8.8 rating with full confidentiality, integrity, and availability impact; however EPSS estimates only a 0.06% exploitation probability and CISA SSVC records no observed exploitation, so this is currently no public exploit identified at time of analysis. Microsoft has released patches for all affected editions.
Critical unauthenticated access control bypass in Fortinet FortiAuthenticator versions 6.5.0-6.5.6, 6.6.0-6.6.8, 8.0.0, and 8.0.2 enables remote code execution without authentication. The CVSS score of 9.8 with AV:N/AC:L/PR:N/UI:N indicates trivial remote exploitation against default configurations. While the vendor advisory (FG-IR-26-128) confirms this vulnerability, the incomplete description placeholder ('<insert attack vector here>') suggests the advisory may contain additional details not yet published in CVE records. No public exploit code or active exploitation confirmed at time of analysis, though the authentication bypass nature and maximum CVSS scores make this a priority patching target for organizations running FortiAuthenticator.
Remote code execution in Fortinet FortiSandbox 4.4.x through 5.0.x (on-premises, Cloud, and PaaS deployments) allows unauthenticated attackers to execute arbitrary code or commands via crafted HTTP requests. This CWE-862 missing authorization flaw affects sandbox analysis appliances across multiple deployment models with CVSS 9.8 (critical) severity. Fortinet has published vendor advisory FG-IR-26-136. No CISA KEV listing or public POC identified at time of analysis, though the trivial attack complexity (AC:L) and network vector without authentication (PR:N) indicate high exploitability if technical details emerge.
Authentication bypass in Cleanuparr before 2.9.10 lets an unauthenticated remote attacker gain full administrator access by spoofing a trusted local IP in the X-Forwarded-For header. Because the TrustedNetworkAuthenticationHandler trusts the leftmost X-Forwarded-For value - which is client-controlled and append-only - any attacker can claim to originate from the trusted network and be logged in as admin. Publicly available exploit code exists (SSVC exploitation: poc) and CISA's SSVC framework rates the attack as automatable with total technical impact, though EPSS remains low at 0.04%.
Remote code execution in PySyft Datasite/Server versions 0.9.5 and earlier allows unauthenticated attackers to execute arbitrary Python code on the server through the function submission mechanism. The vulnerability stems from insufficient validation and sandboxing of user-submitted Python functions decorated with @sy.syft_function(), which are executed using unsafe exec() and eval() calls after approval. With an EPSS score of 0.04% and no current KEV listing, this appears to be a high-severity vulnerability without confirmed active exploitation.
Authentication bypass in Apache Tomcat's DIGEST authentication implementation allows remote attackers to circumvent HTTP Digest access authentication and reach protected resources without valid credentials, affecting Tomcat 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.117, 10.1.0-M1-10.1.54 and 11.0.0-M1-11.0.21. The NVD-published CVSS of 9.8 reflects an unauthenticated network vector with total impact, but this record is marked DEPRECATED by the CVE program and there is no public exploit identified at time of analysis, with EPSS at just 0.04% (12th percentile) and no CISA KEV listing. Impact is scoped to deployments that actually enable DIGEST authentication, which is uncommon relative to Tomcat's overall footprint.
Improper input validation in Apache Tomcat (CWE-20) affects a broad range of releases across the 8.5, 9.0, 10.0, 10.1, and 11.0 branches, with the NVD assigning a critical CVSS 9.8 and a network/no-auth vector. No public exploit has been identified at time of analysis and the EPSS probability is only 0.04% (11th percentile), and CISA SSVC records exploitation status as none. Note a signal conflict: the intelligence tags label this 'Information Disclosure' while the official CVSS claims full confidentiality, integrity, and availability impact - the terse advisory does not resolve which is correct.
JunoClaw agentic AI platform exposes BIP-39 wallet mnemonics in plaintext through LLM tool-call parameters, leaking cryptocurrency private keys to logs, telemetry, and transport channels between AI providers and blockchain execution. Every blockchain write operation (token transfers, smart contract deployment, IBC transactions) required the 12- or 24-word seed phrase as a JSON parameter visible to the language model, API logs, and any middleware. Version 0.x.y-security-1 eliminates mnemonic exposure by introducing a wallet registry with AES-256-GCM encrypted storage and opaque wallet_id references. EPSS data not available for this recent CVE; no public exploit identified at time of analysis.
SQL injection in Akilli Commerce E-Commerce Website versions before 4.5.001 allows remote unauthenticated attackers to execute arbitrary SQL commands with complete database access. The vulnerability permits extraction of sensitive customer and transaction data, modification of product catalogs and pricing, and potential complete system compromise. CVSS score of 9.8 (Critical) reflects network-accessible exploitation requiring no authentication or user interaction, though no active exploitation has been reported in CISA KEV and EPSS data is not available.
Arbitrary code execution in imgaug library (versions through 0.4.0) occurs when the BackgroundAugmenter class deserializes malicious pickle payloads without validation in its multiprocessing worker method. Attackers who can influence queue data-through compromised shared queues, malicious input scripts, or social engineering-can achieve remote or local code execution depending on deployment context. CVSS 9.8 critical severity reflects network-based exploitation without authentication, though EPSS probability is low (0.02%, 6th percentile), indicating limited observed exploitation activity. No CISA KEV listing or public exploit code identified at time of analysis.
Remote code execution in Ludwig framework ≤0.10.4 allows unauthenticated network attackers to execute arbitrary code by supplying a malicious PyTorch model file to the ludwig serve endpoint. The vulnerability stems from unsafe deserialization in the model loading component, which uses torch.load() without the weights_only=True safety parameter. With CVSS 9.8 (critical network vector, no authentication required) but only 0.02% EPSS, this represents a high-severity issue in vulnerable deployments, though widespread exploitation has not been observed. No CISA KEV listing or public POC identified at time of analysis.
Arbitrary code execution in optimate's neural_magic_training.py allows remote attackers to execute Python code by supplying a malicious directory path containing a crafted module.py file. The _load_model() function directly executes file contents via Python's exec() without validation. CVSS 9.8 reflects network vector with no authentication, but EPSS score of 0.02% (5th percentile) indicates very low observed exploitation probability. No active exploitation confirmed (not in CISA KEV). Vulnerability exists in commit a6d302f912b481c94370811af6b11402f51d377f from July 2024. Affects organizations using optimate for neural network model optimization.
Command injection in Adversarial Robustness Toolbox (ART) up to version 1.20.1 enables remote code execution through unsafe eval() usage in Kubeflow pipeline components. The robustness_evaluation_fgsm_pytorch.py script directly evaluates user-controlled --clip_values and --input_shape arguments without sanitization, allowing Python code injection. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) indicating network-exploitable unauthenticated access, this represents critical risk in automated ML pipeline environments where attackers can control pipeline configurations. EPSS score of 0.02% (5th percentile) suggests low observed exploitation activity, though the attack vector and ML tooling context create significant supply chain risk in CI/CD and research environments.
Arbitrary code execution occurs in the llm CLI tool (versions through 0.27.1) when attackers social-engineer victims into running crafted commands containing malicious Python code in the --functions argument. The tool directly executes this code via unsafe exec() without sanitization, enabling full system compromise. CVSS 9.8 assigns network attack vector and no authentication, but real-world exploitation requires local command execution by a tricked user, creating a significant disparity between the vector and actual attack prerequisites. EPSS score of 0.02% (5th percentile) suggests minimal automated exploitation risk, and no active exploitation or public POC has been identified at time of analysis.
Remote code execution in Mamba language model framework (through version 2.2.6) allows unauthenticated attackers to execute arbitrary Python code by publishing malicious models on HuggingFace Hub. When victims call MambaLMHeadModel.from_pretrained() on a weaponized model repository, insecure pickle deserialization executes attacker-controlled code in the context of the victim's process. Despite the critical CVSS 9.8 score and network attack vector requiring no authentication, EPSS probability remains extremely low (0.02%, 5th percentile), suggesting limited real-world exploitation to date. No CISA KEV listing or public POC identified at time of analysis.
Sandbox escape in Mozilla Firefox's Profile Backup component allows an attacker to break out of the browser's content-process isolation and gain broader access to the host, affecting versions prior to 150.0.3. There is no public exploit identified at time of analysis and EPSS estimates only a 0.02% exploitation probability, but SSVC rates the technical impact as total and the flaw automatable, so it warrants prompt patching. Not listed in CISA KEV.
Remote code execution in Kubectl MCP Server v1.1.1 allows unauthenticated network attackers to execute arbitrary commands on systems running the vulnerable server through crafted HTML-based exploitation vectors. Despite a critical 9.8 CVSS score, EPSS rates exploitation likelihood at only 0.02% (4th percentile), suggesting limited real-world targeting thus far. The vulnerability is classified as CWE-94 (Code Injection), affecting an open-source Model Context Protocol (MCP) server implementation for Kubernetes management. No CISA KEV listing indicates absence of confirmed widespread exploitation at time of analysis.
Local privilege escalation in Fuji Electric TELLUS 5.0.2 arises because its installer registers a kernel-mode driver with permissions that grant read and write access to all users. A low-privileged local user can therefore interact with a privileged driver interface to read or corrupt kernel-controlled data, undermining the confidentiality, integrity, and availability of the host. No public exploit identified at time of analysis, and CISA SSVC currently marks exploitation status as none.
Command injection in Siemens RUGGEDCOM ROX industrial network devices enables authenticated remote attackers to execute arbitrary commands with root privileges during feature key installation. The vulnerability affects multiple ROX product lines (MX5000, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536, RX5000) running firmware versions below V2.17.1. While exploitation requires low-level authentication and higher attack complexity (CVSS 4.0: AV:N/AC:H/PR:L), successful exploitation grants complete control over critical industrial network infrastructure. No public exploit identified at time of analysis, and EPSS data not available for this recently disclosed vulnerability.
Path traversal in Ivanti Xtraction enables remote authenticated attackers with low-level privileges to read sensitive system files and inject arbitrary HTML into web-accessible directories, creating risks of credential theft, configuration exposure, and client-side attacks against other users. CVSS 9.6 severity driven by scope change (S:C) indicates the attacker can impact resources beyond the vulnerable component. No public exploit or CISA KEV listing identified, but vendor advisory confirms the vulnerability affects all versions prior to 2026.2.
Authentication bypass in ChurchCRM 7.2.0 through 7.2.2 re-exposes a previously patched flaw (CVE-2026-4058) because the hardening applied to src/api/routes/public/public-user.php was silently removed by an unrelated pull request before any 7.2.x tag was cut. As a result, every shipped 7.2.x release is exploitable using the PoC published with the original advisory, letting an attacker with low-level access defeat the API login endpoint's protections to reach protected data and functions. Publicly available exploit code exists (SSVC: PoC), but EPSS is very low (0.03%) and the flaw is not on the CISA KEV list; fixed in 7.3.1.
Arbitrary server-side code execution in SAP Commerce Cloud via unauthenticated malicious configuration upload and code injection. Attackers can remotely exploit a misconfigured Spring Security framework to upload crafted configuration files and inject code without authentication, requiring only that a user interact with malicious content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R). The vulnerability affects SAP Commerce Cloud Configuration with critical impact across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing identified at time of analysis, though EPSS data unavailable. Patch details available in SAP Security Note 3733064.
SQL injection in SAP S/4HANA Enterprise Search for ABAP allows authenticated attackers to extract sensitive database information and crash the application via malicious SQL statements injected through improperly validated user input. The scope change (S:C) indicates potential lateral movement beyond the vulnerable component. SAP has released security patches (SAP Note 3724838) for this critical vulnerability with CVSS 9.6. No active exploitation confirmed at time of analysis, though the authentication bypass tag suggests potential credential bypass implications.
Local code execution in Microsoft Word (Office 2016 through Office LTSC 2024, Microsoft 365 Apps, and Office for Mac) results from a type-confusion flaw (CWE-843) that lets an unauthorized attacker run arbitrary code with the victim's privileges. Microsoft rates it CVSS 8.4 with total technical impact, but there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 35th percentile). CISA SSVC records exploitation status as none and the issue is not automatable, indicating no observed in-the-wild activity.
Local code execution in Microsoft Office Word (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, and Office LTSC for Mac 2021/2024) arises from a use-after-free memory-corruption flaw that lets an attacker run arbitrary code in the context of the user who opens a maliciously crafted document. Microsoft has released a patch, and no public exploit has been identified at time of analysis; EPSS is very low at 0.06% (18th percentile) and CISA SSVC records no known exploitation.
Command injection in MongoDB Ops Manager (all 7.0 versions and 8.0.22 and prior) lets an administrative user with webhook-configuration rights achieve arbitrary command execution by embedding malicious FreeMarker template syntax in a webhook and then triggering it. The flaw is vendor-reported (MongoDB) with a patch in 8.0.23; there is no public exploit identified at time of analysis and EPSS is very low (0.05%), consistent with SSVC's 'exploitation: none' rating despite the total technical impact.
Local code execution in Microsoft Word (and Office 2016/2019, LTSC 2021/2024, 365 Apps, Office for Mac, and SharePoint Server) stems from an untrusted pointer dereference (CWE-822) that lets an attacker run arbitrary code with the victim's privileges when a malicious file is processed. Microsoft rates it CVSS 8.4 with total technical impact (high confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC marks exploitation as none and not automatable, indicating no observed real-world attacks yet.
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, 365 Apps, and Office LTSC for Mac 2021/2024) arises from a use-after-free memory corruption (CWE-416) that lets an attacker run arbitrary code with the victim's privileges. Microsoft's CVSS vector rates it AV:L/PR:N/UI:N (base 8.4) with total technical impact, though there is no public exploit identified at time of analysis and EPSS exploitation probability is negligible at 0.04%. A vendor patch is available from Microsoft (MSRC update guide).
Local code execution in Microsoft Word (and the Office suites that bundle it - Office 2016/2019, LTSC 2021/2024, Microsoft 365 Apps, and Office LTSC for Mac 2021/2024) stems from a use-after-free memory-corruption defect that lets an attacker run arbitrary code in the context of the current user, typically by having the victim process a crafted document. Microsoft (the reporting party) has released a fix; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 14th percentile). SSVC rates exploitation as none but technical impact as total, so this is a patch-on-schedule item rather than an emergency.
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, 365 Apps for Enterprise, Office for Android, and Office LTSC for Mac 2021/2024) stems from a heap-based buffer overflow that lets an attacker run arbitrary code with the victim's privileges. The flaw was reported by Microsoft, a vendor patch is available, and there is no public exploit identified at time of analysis; EPSS is very low at 0.04% and CISA SSVC records exploitation as none. Impact is total (full confidentiality, integrity, and availability loss) but exploitation is not automatable and, per typical Office file-parsing bugs, hinges on processing attacker-supplied content.
Client-side arbitrary script execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) lets a remote attacker inject malicious scripts that run in the victim's browser session, enabling account or session takeover. Rooted in an Incorrect Authorization flaw (CWE-863), exploitation requires the victim to click a crafted URL or interact with a compromised page, and the changed scope means the injected code can reach resources beyond the vulnerable component. No public exploit has been identified at time of analysis, and EPSS is modest at 0.47% (65th percentile), consistent with the CISA SSVC assessment of no observed exploitation.
Arbitrary file write leading to unauthenticated remote code execution affects efw4.X (Enterprise Framework for Web) prior to 4.08.010, where efw.file.FileManager.unZip extracts ZIP entries via new File(baseDir, zipEntry.getName()) with no canonical-path validation - a classic Zip Slip. By combining the framework's public multipart /uploadServlet with an event that chains file.saveUploadFiles and FileManager.unZip, an attacker with no credentials can plant a JSP webshell in the Tomcat servlet context root and execute OS commands as the Tomcat user. Publicly available exploit code exists (SSVC lists proof-of-concept); the flaw is not on CISA KEV and EPSS is low (0.21%, 43rd percentile).
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible attacker to write arbitrary files and directories to restricted locations on a vulnerable system by sending a specially crafted file. Exploitation is constrained by limited attacker control over the write destination, and SSVC assessment rates exploitation as 'none' with non-automatable impact, consistent with the low EPSS of 0.08%. A publicly available proof-of-concept exists on GitHub Gist, but no confirmed active exploitation appears in CISA KEV; patched runtime versions are available for all affected .NET branches.
Sandbox escape in OpenClaude (npm package openclaude) versions before 0.5.1 allows a prompt-injected LLM to disable host sandboxing by setting the model-controlled `dangerouslyDisableSandbox: true` flag in any Bash tool_use call, yielding full unsandboxed command execution on the host. CVSS 4.0 scores this 9.3 Critical (AV:N/AC:L/PR:N/UI:N, VC/VI/VA:H); no public exploit identified at time of analysis beyond the reporter's PoC, but the upstream fix has been merged. The flaw is especially severe because it is reachable under default settings (`allowUnsandboxedCommands` defaults to true).
Remote path traversal in Siemens ROS# versions prior to V2.2.2 enables unauthenticated attackers to read arbitrary files from affected systems due to insufficient input sanitization. The vulnerability affects the ROS# library, a C# .NET implementation for Robot Operating System communication, with CVSS 9.3 critical severity. No active exploitation or public exploit code has been identified at time of analysis, though the network-accessible attack vector and lack of authentication requirements present significant risk for robotics systems using this library.
Arbitrary file relocation in efwGrp's efw4.X Enterprise Framework for Web before 4.08.010 lets remote attackers copy or move files out of the home directory to any location on the host by supplying a base64-encoded traversal path in the elfinder_paste 'dst' parameter. The elfinder_checkRisk routine validates the 'target'/'targets' parameters for traversal and home containment but overlooks 'dst', bypassing the protected=true control. Publicly available exploit code exists (SSVC: PoC), though EPSS is only 0.05% and it is not in CISA KEV.
Cross-origin source code exposure in webpack-dev-server up to 5.2.3 allows attackers controlling a malicious website to steal bundled application source code when a developer runs the dev server over non-trustworthy HTTP origins. The vulnerability exploits the omission of Sec-Fetch-Mode and Sec-Fetch-Site headers on non-HTTPS connections, enabling script injection and cross-origin code exfiltration. Chromium-based browsers Chrome 142+ are exempt due to local network access restrictions. CVSS 5.3 (AC:H due to user requirement to visit attacker site; High confidentiality impact). Fix: upgrade to webpack-dev-server 5.2.4 or later.
Arbitrary code execution in Siemens Simcenter Femap (all versions before V2512.0003) arises from a heap-based memory corruption bug triggered when the application parses a specially crafted IPT (Inventor part) file, letting an attacker run code in the context of the current user process. Discovered through ZDI (ZDI-CAN-27349, ZDI-CAN-27389) and published via a Siemens ProductCERT advisory and CISA ICS advisory, the flaw requires the victim to open a malicious file, so it is a local, user-interaction-dependent issue rather than a remotely reachable one. There is no public exploit identified at time of analysis, EPSS is very low (0.02%), and CISA's SSVC marks exploitation as none.
Local privilege escalation in the Intel Data Center Graphics Driver for VMware ESXi before version 2.0.2 lets a privileged local user trigger a Ring 1 device-driver buffer overflow to execute arbitrary code and take total control of the host. The flaw carries a CVSS 4.0 base score of 9.3 with high confidentiality, integrity and availability impact on both the vulnerable and subsequent systems. There is no public exploit identified at time of analysis, and the EPSS score is negligible at 0.01% (3rd percentile), consistent with the SSVC verdict of no known exploitation.
Uninitialized pointer access in Siemens Solid Edge SE2026 enables arbitrary code execution when processing malicious PAR files. Attackers must deliver a crafted PAR file and convince users to open it (CVSS:4.0 AV:L/UI:P), achieving full compromise of the victim's workstation with high confidentiality, integrity, and availability impact. No active exploitation confirmed at time of analysis, though the local attack vector and user interaction requirement limit automated mass exploitation. EPSS data not available for risk calibration.
Remote code execution in SPIP versions before 4.4.14 lets network attackers run arbitrary code as the web server user through the public space, but only when the CMS runs behind certain nginx configurations. The flaw (CWE-94 code injection) bypasses SPIP's built-in security screen, so that mitigation offers no protection. It was reported by VulnCheck and carries a CVSS 4.0 score of 9.2, though there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none.
Cross-site scripting (XSS) in Siemens SIMATIC S7-1500 PLC family firmware upload interface allows authenticated attackers to execute malicious JavaScript in administrator sessions via crafted filenames. This stored XSS requires social engineering to trick authenticated users into selecting the attacker-supplied firmware file on the web-based management interface. Successful exploitation enables session hijacking and credential theft without requiring the malicious file to be uploaded. EPSS data not provided, no CISA KEV status confirmed, affecting industrial automation controllers widely deployed in critical infrastructure environments.
Spoofing in Microsoft Azure Machine Learning (versions 3.0.0 up to but not including 1.7.6) lets an unauthenticated network attacker inject improperly neutralized special elements into output rendered by a downstream component, enabling them to impersonate trusted content or identities against a victim who interacts with the malicious output. The CVSS 3.1 base score is 8.2 with a scope change and high confidentiality impact, but real-world urgency is tempered by an EPSS of just 0.05% (15th percentile) and CISA SSVC rating exploitation as 'none'. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Full administrative database takeover in Google Cloud AlloyDB for PostgreSQL affected clusters provisioned via Terraform or the REST API before 2025-11-03, where those provisioning paths applied an insecure default password. A remote attacker with network reachability to such a cluster could authenticate as a privileged account and gain complete control of the database. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.04%, 12th percentile), consistent with the SSVC assessment of no observed exploitation.
Weak credential generation in Ingeteam's Ingecon Sun EMS Board Technical Support access mechanism allows remote privilege escalation via cryptographic weakness. The SAT (Technical Support) access feature generates credentials using a weak hashing algorithm instead of cryptographically secure methods, enabling attackers to predict or derive privileged access credentials. CVSS 9.2 reflects network-accessible attack with high complexity but no authentication required. INCIBE coordinated disclosure confirms vendor patch availability, and a practical analysis of the vulnerability has been published by ReverseMode, indicating detailed technical understanding exists in the research community.
Remote unauthenticated attackers can delete arbitrary ElasticSearch documents and MinIO storage files in nexent v1.7.5.2 via the unprotected DELETE /{index_name}/documents endpoint. The backend service fails to authenticate requests or validate the path_or_url parameter, enabling mass data destruction and denial of service. EPSS probability (0.12%) indicates low predicted exploitation likelihood, and no active exploitation or public exploit code has been identified at time of analysis, though the CVSS 9.1 reflects the severe impact of unauthenticated remote data deletion.
Unauthenticated directory deletion in SillyTavern versions <= 1.17.0 lets remote attackers wipe a user's entire extensions directory by sending 'extensionName' value of '.' to the POST /api/extensions/delete endpoint. Because the truthiness check runs before sanitize-filename (which collapses '.' to an empty string), path.join resolves back to the extensions base directory itself and fs.rm recursively deletes it. A working proof-of-concept exists and no authentication is needed in the default configuration (basicAuthMode: false), though EPSS scores this at just 0.08% and it is not on the CISA KEV list - no public exploit identified as actively exploited at time of analysis.
Unauthenticated remote attackers can delete arbitrary files from nexent v1.7.5.2's MinIO storage backend via an unprotected DELETE endpoint, leading to data loss and denial of service. The /storage/{object_name:path} API lacks authentication, authorization, and input validation (CWE-552). CVSS 9.1 reflects critical severity, though EPSS score of 0.08% (23rd percentile) and SSVC 'exploitation: none' indicate no observed active exploitation or public exploit code at time of analysis. SSVC marks this as 'automatable: yes' with 'technical impact: partial', suggesting straightforward exploitation once discovered but limited scope beyond data integrity/availability impacts.
Unauthorized file disclosure in Schneider Electric Saitel DP and EasyLogic T150 (formerly Saitel DR) Remote Terminal Units lets a low-privileged remote attacker read sensitive files outside intended directories via improper server-side file path handling. The advisory tagging also associates the flaw with an authentication-bypass angle, and the primary impact is confidentiality of files on the affected OT/ICS controllers. There is no public exploit identified at time of analysis, EPSS risk is very low (0.06%, 17th percentile), and CISA SSVC rates exploitation as none.