Directory traversal in VMware Avi Load Balancer (formerly Avi Networks NSX Advanced Load Balancer) lets authenticated network users bypass file path validation to reach files outside intended directories. Rated CVSS 8.8, the flaw is exploitable remotely by any authenticated user (PR:L) and the vendor scores full high confidentiality, integrity, and availability impact, implying potential arbitrary file read and/or write on the appliance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in VMware Avi Load Balancer exposes organizations running versions from 22.1.1 through 32.1.1 to arbitrary code injection by low-privileged authenticated users with network access. The flaw is classified as CWE-94 code injection, meaning attacker-supplied input reaches an execution context without adequate sanitization. Broadcom has released patches across all affected branches; no public exploit code has been identified at time of analysis, and the EPSS score of 0.68% (48th percentile) reflects modest current exploitation probability despite the high CVSS 8.8 rating.
Remote code execution in VMware Avi Load Balancer exposes the Avi Control Plane to arbitrary code execution by any low-privileged, network-connected user, stemming from a code injection flaw (CWE-94) in the controller. Multiple major version branches from 22.1.1 through 32.1.1 are confirmed affected, with vendor-released patches available across all branches. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 rating and full high-impact triad (C:H/I:H/A:H) make this a high-priority patch target for any deployment where the control plane is network-reachable.
Privilege escalation in VMware Avi Load Balancer exposes authenticated, network-accessible users to remote code execution across a wide version range spanning 22.1.x through 32.1.x. The CVSS 8.8 rating reflects low-complexity, low-privilege network exploitation yielding full confidentiality, integrity, and availability impact on affected systems. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS at 0.39% (31st percentile) confirms limited active exploitation pressure at time of analysis.
Authentication bypass in FalkorDB QueryWeaver lets unauthenticated attackers hijack any existing account by submitting a signup request containing the victim's email address, whereupon the server issues a valid session token bound to the victim's identity. No credentials, prior access, or user interaction are required, making this a pre-auth account takeover. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and a vendor patch is available.
Stack-based buffer overflow in Shibby Tomato 1.28 router firmware lets an authenticated attacker corrupt memory through the Scheduler Name Handler (function sub_42537C) by supplying an overlong scheduler-name argument, enabling likely remote code execution on the device. The affected build is a niche, community-maintained MIPS router firmware distribution that has been retired and superseded by FreshTomato. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the VulDB-assigned CVSS 4.0 score is 8.7.
Stack-based buffer overflow in Shibby Tomato router firmware (version 1.28, RT-N5x MIPSR2 Build 124) lets an authenticated remote attacker corrupt the stack through the sub_40BB50 function that renders /proc/webmon_recent_domains, potentially achieving arbitrary code execution on the MIPS-based router. The flaw is remotely reachable and, per the CVSS 4.0 vector, requires low privileges (PR:L) but no user interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and no KEV listing; this Tomato fork has been superseded by FreshTomato, so no upstream patch is expected.
Denial of service and heap corruption in OpenPLC_v3 lets an authenticated web-interface user overflow the 100-byte MB_device.dev_name buffer via an oversized device_name field on the /modbus endpoint. Because getData() in modbus_master.cpp copies delimiter-bounded characters with no bounds check, a ~200-byte value writes 100 bytes past the allocation, overwriting adjacent Modbus config fields (protocol, dev_address, ip_port) and crashing the PLC control loop. No public exploit identified at time of analysis, though VulnCheck published a detailed technical advisory; the affected repository is archived and no vendor-released patch was identified.
Out-of-bounds write in Shibby Tomato 1.28 (RT-N5x MIPSR2 Build 124) router firmware lets an authenticated attacker corrupt memory in the setup_conntrack routine of /sbin/rc by manipulating the ct_tcp_timeout argument. The flaw (CWE-787) is reachable over the network and carries a CVSS 4.0 base of 8.7, but no public exploit is identified at time of analysis and it is not on CISA KEV. The affected project is end-of-life and superseded by FreshTomato, so no upstream fix is expected.
Arbitrary Python code execution in scikit-hep uproot (uproot5) arises because the library dynamically generates and compiles reader classes from a ROOT file's TStreamerInfo records, interpolating file-controlled streamer metadata (such as streamer element names) into generated Python source without repr()/!r safe quoting. A crafted ROOT file can inject expression-breaking content that is evaluated in the process opening the file, giving code execution to whoever processes attacker-supplied ROOT data. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authorization bypass in VMware Avi Load Balancer (branches 22.1.x, 30.x, 31.x, and 32.1.1) allows a network-based actor holding low-privilege credentials to reach a limited subset of the Avi Control Plane without proper authorization. Rated CVSS 8.3 by VMware/Broadcom with CWE-863 (Incorrect Authorization), the flaw exposes control-plane functionality that should be gated behind higher authorization. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical rather than observed.
Local privilege escalation in VMware (Broadcom) Avi Load Balancer allows a user who already has local access to the appliance to elevate to root and run arbitrary code. It affects the 22.1.x, 30.x, 31.x and 32.1.x release lines, is CVSS 7.8, and was reported by the vendor. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authenticated remote denial of service in ProFTPD's mod_sftp module allows any user with valid SFTP credentials to crash the per-connection server child with a single malformed packet. The flaw stems from an unsigned integer underflow and a size_t-to-int truncation that fools the allocator into returning a ~512-byte block while the caller believes it received ~4 GB, causing an attacker-controlled heap overflow past a 544-byte allocation. Publicly available exploit code exists (a VulnCheck proof of concept) demonstrating reliable DoS; heap metadata corruption and consequences beyond DoS are theorized but not demonstrated, and there is no public exploit identified for code execution.
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with OWNER or EDITOR rights define a custom function containing nested FOR loops that bypasses per-loop iteration limits and consumes all server CPU, ignoring configured query timeouts. The multiplicative iteration count (e.g. several nested loops of 1,000,000 each) monopolizes the process until it is manually killed, blocking all other queries and new connections. Discovered during a cure53 audit; no public exploit identified at time of analysis and it is not on CISA KEV, though the technique is trivially reproducible from the advisory.
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted query whose result contains a null byte to the /sql HTTP endpoint. The null byte triggers an uncaught exception during JSON serialization of the query response in the net module, terminating the process and any application that depends on it. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; the reported CVSS 4.0 base score is 7.1 (availability-only impact).
Denial of service in SurrealDB before 2.2.2 lets an authenticated user crash the database by calling the string::replace function with a regex pattern that produces an unbounded output string, exhausting server memory. The flaw spans the 2.0.x, 2.1.x, and 2.2.x release lines and was discovered during a cure53 security audit; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is availability-only with no confidentiality or integrity loss, rated CVSS 4.0 7.1 High.