Administrator account takeover in Network Optix Nx Witness VMS before 6.1.2 allows remote unauthenticated attackers to hijack authenticated user sessions through a CORS misconfiguration in the REST API when the product runs in default Standard security mode on Linux or Windows. By luring a logged-in operator to a malicious cross-origin page, the attacker's site can read credentialed REST responses and steal the session token, achieving full administrative takeover; no public exploit identified at time of analysis, but the issue is trivially weaponizable given the well-understood CORS attack pattern.
Denial of service in cpp-httplib before 0.43.4 lets remote unauthenticated attackers crash the server by sending a chunked HTTP request with a negative chunk-size value. Because ChunkedDecoder::read_payload parses the size with std::strtoul(), a value like "-2" wraps to a near-maximum unsigned integer (0xFFFFFFFFFFFFFFFE) that bypasses the library's single guard against ULONG_MAX, driving unbounded memory allocation and a process crash. Publicly available exploit code exists (SSVC: PoC) though it is not in CISA KEV, and EPSS is low at 0.06%.
SSRF deny-list bypass in Gotenberg v8 (<= 8.32.0) allows unauthenticated remote attackers to reach internal cloud metadata services (e.g., AWS/GCP/Azure IMDS at 169.254.169.254) by serving a crafted DNS AAAA record containing IPv6 6to4, NAT64, or deprecated site-local prefixes that the IsPublicIP allow-list fails to recognize. Publicly available exploit code exists via the GitHub Security Advisory PoC, and the Chromium URL-convert route returns the upstream response as a PDF, yielding a full-read SSRF that can leak IAM credentials. No vendor-released patch identified at time of analysis (advisory lists no fixed version).
Remote denial-of-service in russh, a Rust implementation of the SSH protocol, allows unauthenticated remote attackers to exhaust server memory by sending small compressed SSH packets that inflate to massive sizes post-decompression. Affecting all versions from 0.34.0 through 0.61.0, the flaw stems from missing post-decompression size enforcement in Decompress::decompress(), allowing payloads under the 256 KiB wire cap to expand beyond 128 MiB. No public exploit identified at time of analysis, but the advisory includes a detailed PoC demonstrating pre-authentication exploitation against default server configurations.
Authorization bypass in OpenClaw QQBot before 2026.5.18 allows non-approver users to resolve pending exec and plugin approval requests by clicking native approval buttons, because the configured approver identity is not enforced server-side. The flaw collapses a core access-control gate around command and plugin execution workflows, and no public exploit identified at time of analysis, though the GitHub Security Advisory GHSA-mgq6-vr84-7m2j and VulnCheck advisory provide enough detail to reproduce.
Authentication bypass in Red Hat OpenShift Container Platform 4 Router allows remote unauthenticated attackers to impersonate TLS client certificate identities by injecting X-SSL-Client-* headers over plain HTTP. The flaw affects Routes configured with insecureEdgeTerminationPolicy set to Allow, where the HTTP frontend fails to strip these trusted headers from inbound requests. No public exploit identified at time of analysis, EPSS is very low (0.03%), and CISA SSVC marks exploitation status as none with total technical impact.
Relative path traversal (Zip Slip) in Waterfall WF-500 RX Host version 7.9.1.0 R2502171040 enables code execution on the RX side when attackers already control the TX Host and the deployment uses a MySQL connector with file compression enabled. The flaw, tracked as CWE-23 and reported by Nozomi Networks Labs, has no public exploit identified at time of analysis and an EPSS of 0.02% (4th percentile), but it meaningfully undermines the data-diode trust boundary the WF-500 is deployed to enforce.
Out-of-bounds read in the Waterfall WF-500 RX Host (firmware 7.10.0.0 R2601141040) enables an attacker who already controls the TX Host to execute code on the receiving (RX) side, bypassing the unidirectional security guarantee the data diode is designed to enforce. Discovered by Nozomi Networks Labs with no public exploit identified at time of analysis and an EPSS score of 0.02%, the issue is significant because it undermines the OT/IT segmentation use case the product exists to provide. The vulnerability is not listed in CISA KEV and there is no evidence of active exploitation.
Authentication bypass in FreeScout help desk (versions prior to 1.8.220) allows remote attackers who can spoof an agent's email From address to inject forged replies into customer-facing threads. The FetchEmails command's notification reply path parsed thread_id and user_id directly from the Message-ID without HMAC verification, so spoofed messages were relayed to customers through the legitimate SMTP server. No public exploit identified at time of analysis, but the upstream commit publicly documents the exact missing hash check.
Server-side request forgery in JetBrains TeamCity versions prior to 2026.1 and 2025.11.5 allows remote unauthenticated attackers to coerce the build server into issuing arbitrary outbound HTTP requests through the build status functionality. The CVSS 7.5 score (C:H/I:N/A:N) reflects high-impact disclosure of internal data without integrity or availability effects, and no public exploit is identified at time of analysis.
Information disclosure in JetBrains YouTrack before 2026.1.13162 allows remote unauthenticated attackers to obtain sensitive data through fetchApp requests. The flaw exposes confidential information without requiring authentication or user interaction, but carries no integrity or availability impact. There is no public exploit identified at time of analysis, and the EPSS score of 0.00% reflects no observed exploitation activity.
Remote code execution in Falco Solutions PHPageBuilder v0.31.0 is possible through an unrestricted file upload flaw in the pagemanager/pagebuilder module, enabling unauthenticated remote attackers to upload arbitrary executable files (typically PHP webshells) and run code on the underlying web server. Publicly available exploit code exists in a dedicated GitHub repository, though EPSS scoring (0.06%, 18th percentile) and SSVC indicate no observed in-the-wild exploitation despite the attack being fully automatable.
Local privilege escalation in ASUS System Control Interface allows an authenticated low-privileged user to gain SYSTEM-level code execution by issuing a crafted RPC call that bypasses the component's validation logic. The flaw stems from incorrect permission assignment (CWE-732) on a critical resource exposed over RPC, and no public exploit identified at time of analysis. CVSS 4.0 scores it 7.3 with high attack complexity, indicating exploitation is non-trivial but yields full host compromise.
Local privilege escalation in ASUS Armoury Crate allows an authenticated low-privileged user to bypass driver validation and gain unauthorized read/write access to physical memory. The flaw stems from incorrect permission assignment (CWE-732) on a critical resource exposed by the application's kernel driver, enabling memory tampering that can be leveraged for full system compromise. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Authenticated remote code execution in Emlog Pro v2.6.9 stems from a path traversal flaw in the template upload feature that lets administrators write arbitrary PHP files outside the intended template directory. Attackers leverage crafted ZIP archives containing '../' sequences in member filenames to overwrite default template files or drop new PHP payloads inside the active template, yielding code execution under the web server account. No public exploit identified at time of analysis, but a vulnerability report repository on GitHub demonstrates the issue.
Stored cross-site scripting in the Link Whisper Free WordPress plugin (versions through 0.9.0) allows unauthenticated remote attackers to inject persistent JavaScript via the user_id parameter, which executes in the browser of any user who visits an affected page. The flaw stems from insufficient input sanitization and output escaping in the plugin's settings handler, and no public exploit identified at time of analysis. With a CVSS 7.2 score reflecting Scope:Changed impact, the bug is notable because exploitation requires no authentication despite affecting an administrative-adjacent plugin component.
SSRF filter bypass in CC-Tweaked (the ComputerCraft Minecraft mod) before 1.119.0 lets any user who can run Lua reach internal IPv4 services that the HTTP API's private-range blocklist is meant to protect. By encoding a blocked IPv4 address inside the NAT64 well-known prefix (64:ff9b::/96), an attacker crafts an IPv6 literal that Java's InetAddress classification methods do not recognise as private, so http.request/http.websocket connect to it and the network's NAT64 gateway translates it back to the target IPv4 service. A working Lua PoC is published in the vendor advisory, but there is no public exploit identified as being used in attacks; EPSS is low (0.05%, 17th percentile) and it is not in CISA KEV.
Arbitrary file write in PraisonAI (pip package, versions <= 4.6.39) lets a remote attacker plant hidden metadata (output_file/output_content/save_output) in a webpage so that when a victim's PraisonAI agent crawls and analyzes it, the agent autonomously invokes write_file and drops attacker-controlled content to any absolute path. The flaw stems from write_file skipping path validation whenever workspace is None, which is the production default. Publicly available exploit code exists (a working PoC ships in the advisory); it is not listed in CISA KEV and EPSS is low (0.05%, 17th percentile), indicating no evidence of widespread active exploitation.
Authorization bypass in BankPro E-Service Technology's Service Center application allows authenticated remote attackers to read other users' electronic commerce order details by tampering with an object identifier parameter in a query function. The CVSS 4.0 vector (AV:N/PR:L/VC:H) reflects a high-confidentiality impact over the network with low privileges and no user interaction, and there is no public exploit identified at time of analysis. The flaw is an Insecure Direct Object Reference (IDOR) reported by TWCERT, affecting financial/EC order data that is typically subject to privacy and PCI-DSS scrutiny.
Authenticated SQL injection in Mautic's API contact filtering allows API users to execute arbitrary SQL by abusing insufficient recursive sanitization of nested query parameters. The flaw (CWE-89) yields full read access to database contents and partial availability impact, but requires valid API credentials (PR:L). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authorization bypass in Mautic 7 API v2 endpoints allows authenticated low-privilege users to read or modify records owned by other users, undermining role-based ownership scopes such as viewown and editown. The flaw was reported by Mautic and disclosed via GHSA-2jrw-c95w-h43g; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Union-based SQL injection in eZ Publish Legacy's dfscleanup.php script allows a local authenticated attacker with sufficient privileges to extract sensitive data, including user credentials, from the underlying MySQL database. The flaw resides in the `_getFileList` function of the `eZDFSFileHandlerMySQLiBackend` class and is permanently unpatched because all branches of the project have reached end of life. No public exploit identified at time of analysis, though a detailed researcher write-up exists on GitHub.
Server-side request forgery in MoviePilot v2's image proxy endpoint (/api/v1/system/img-proxy) allows authenticated attackers holding a valid resource_token cookie to coerce the server into fetching arbitrary internal URLs. The flaw stems from SecurityUtils.is_safe_url performing domain-membership checks without blocking private, loopback, or link-local IPs, letting attackers enumerate co-hosted media services such as Jellyfin, Emby, and Plex and exfiltrate internal data. No public exploit identified at time of analysis, though the upstream patch and vendor-published advisory clearly document the attack path.