Provider type tampering in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote attackers manipulate the DialogHandler's provider type input to alter dialog processing, serving as a stepping stone for chained exploitation. The flaw stems from unsafe reflection (CWE-470), where externally-controlled input selects the class/code path handling dialog operations, and carries a CVSS 8.1 (high). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Telerik components have a notable history of being targeted once weaponized.
Authentication bypass in Magarsus Consulting IDM-MFA (versions 2025.11.27 up to but not including 2026.03.10) lets remote unauthenticated attackers circumvent multi-factor authentication by supplying improperly-typed input that the application fails to validate. Because IDM-MFA is itself an identity and MFA gateway, a successful bypass undermines the primary control protecting downstream systems, yielding high confidentiality and integrity impact. Exploitation requires some victim interaction (CVSS UI:R), and there is no public exploit identified at time of analysis.
Full takeover of Oracle Platform Security for Java (OPSS), a security framework within Oracle Fusion Middleware, is possible for a low-privileged attacker positioned on the same physical communication segment as the host. Disclosed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 score of 8.0 and a scope change, meaning successful exploitation can significantly impact additional products beyond OPSS itself. Exploitation is rated difficult (AC:H) and there is no public exploit identified at time of analysis, so risk is elevated by potential blast radius rather than by ease of attack.
Broken CSRF token enforcement across 23 Regular Labs AJAX-based Joomla extensions allows authenticated lower-privileged users to directly invoke privileged endpoints, or allows any attacker to perform those operations via a cross-site request forgery attack against an authenticated victim. The affected surface spans virtually the entire Regular Labs extension portfolio, from Advanced Module Manager through Sourcerer, covering all versions from 1.0.0 up to per-extension maximums. No public exploit or active exploitation has been confirmed; EPSS is 0.13%, consistent with the UI:R requirement that prevents mass automated attack.
Authentication bypass in the Traefik reverse proxy (v2.11.51 and earlier, v3.6.0-v3.6.22, and v3.7.0-v3.7.6) allows unauthenticated remote attackers to reach protected backend routes by abusing the ReplacePathRegex middleware. When the middleware rewrites a path using a capture group lacking a mandatory separator, a crafted request such as GET /api../admin yields an un-normalized path (/../admin) that the middleware forwards without re-validation; a normalizing backend then resolves it to a protected route, skipping any auth middleware bound to that path. No public exploit identified at time of analysis, and no EPSS/KEV data was supplied, but the flaw is trivially reproducible from the advisory's own example.
Command injection in the Ansible Lightspeed extension for Visual Studio Code lets a crafted project achieve arbitrary code execution on a developer's machine. The extension's ansible.python.activationScript setting is treated as a shell command rather than validated as a file path, so when a victim opens or runs a malicious repository, attacker-controlled content in that setting executes with the privileges of the VS Code process. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Information disclosure and potential data corruption in the Linux kernel's XFS filesystem can allow a local attacker with low privileges to achieve high integrity, confidentiality, and availability impact. The vulnerability resides in the reflink copy-on-write logic where stale data fork mappings are used after cycling the ILOCK, leading to inaccurate shared-extent tracking. No active exploitation or public exploit code has been identified at time of analysis, and a vendor patch is available.
Path traversal in IZArc v4.6's unrar.dll component enables arbitrary file writes outside the intended extraction directory when a victim extracts a maliciously crafted RAR archive. The vulnerability stems from insufficient path validation in the RAR extraction routine, permitting an attacker-controlled archive to place files at attacker-chosen filesystem paths with the victim user's privileges. No public exploit identified at time of analysis and EPSS sits at 0.21% (11th percentile), but SSVC rates technical impact as total, reflecting the high-C/I/A CVSS score if the attack chain completes.
Local privilege escalation in Analog Way Picturall Quad Compact Mark II firmware version 3.5.8 allows authenticated low-privileged users to gain root access via path traversal in a maintenance script. No active exploitation or public exploit code has been reported; vendor patch is available in version 3.5.9.
Local privilege escalation in Unistal Systems Protegent 360 v2.0.0.4 through its kernel driver pgsecdl.sys allows a low-privileged local attacker to gain complete system control. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed and the EPSS score is low (0.19%). The flaw stems from improper privilege management (CWE-269) in the driver.
Local privilege escalation in Unistal Systems Protegent 360 v2.0.0.4 allows a low-privileged attacker to gain SYSTEM-level control through the sub_186f4 function. A publicly available proof-of-concept exists, but no active exploitation is currently reported and the EPSS estimate of 0.19% suggests low threat actor interest.
Local privilege escalation in Duplicati v2.3.0.1 allows an authenticated standard user to replace DLLs in the service directory when the software is installed outside the default Program Files path. On service restart, the Windows service loads the attacker-controlled DLL, granting arbitrary code execution as SYSTEM. No active exploitation is reported, and EPSS probability is low at 0.18%.
Arbitrary code execution in the Visual Studio Code Ansible Lightspeed extension lets an attacker embed shell metacharacters in an Ansible playbook filename that the AnsiblePlaybookRunProvider passes unsanitized to a command invocation. When a developer opens the malicious project and runs the playbook, the injected characters execute arbitrary commands with the privileges of the VS Code user. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the local high-impact profile (CVSS 7.8, C:H/I:H/A:H) makes it a meaningful supply-chain/repository-poisoning risk for Ansible developers.
Local code execution in the Visual Studio Code Ansible (Lightspeed) extension lets a malicious project run arbitrary shell commands on a developer's machine by abusing the ansible.executionEnvironment.containerOptions and volumeMounts settings, which fail to sanitize shell separators (CWE-78). Because these are workspace-scoped settings, simply opening a booby-trapped repository can auto-trigger execution during Language Server initialization, yielding code execution as the VS Code user. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; CVSS is 7.8 (High).
Privilege escalation in n8n Enterprise SSO (versions before 1.123.64, 2.29.8, and 2.30.1) lets an SSO-authenticated user who controls their IdP-asserted instance-role claim be provisioned directly as global:owner, seizing full administrative control of workflows, credentials, users, and instance configuration. The instance-role provisioning path fails to block the owner role that the parallel token-exchange path explicitly rejects. Reported by VulnCheck with no public exploit identified at time of analysis; exploitation depends on a non-default configuration.
Denial of service (with potential memory corruption) in select Hikvision network cameras - specifically the DS-2CD and DS-2DE series - lets remote unauthenticated attackers crash or destabilize a device by sending specially crafted packets that trigger a heap buffer overflow. The flaw carries a CVSS 7.7 (AV:N/PR:N) and, per the supplied CVSS vector, high integrity and availability impact, though the vendor advisory characterizes the primary observable effect as device malfunction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Denial of service in ISC BIND 9 lets a remote unauthenticated attacker exhaust resolver memory by flooding a DNSSEC-validating resolver with random-subdomain ('water torture') queries against a DNSSEC-signed zone. When queries arrive faster than the resolver can complete validation, memory consumption grows unbounded - orders of magnitude beyond the configured max-cache-size - eventually crashing the service. Affects a broad span of 9.11 through 9.21 release and supported-preview (-S) branches; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote denial of service in ISC BIND 9 lets an attacker crash a validating resolver via a maliciously crafted DNSSEC proof. When a provably-insecure delegation is covered by both NSEC and NSEC3 records at the parent but only one of those types carries an RRSIG, BIND hits a reachable assertion (CWE-617) and terminates while validating the insecurity proof. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, unauthenticated attack surface and named process termination make this a high-availability-impact issue for recursive resolvers.
Denial of service in ISC BIND 9 resolvers (9.20.0-9.20.24, 9.21.0-9.21.23, and 9.20.9-S1-9.20.24-S1) lets remote unauthenticated attackers exhaust CPU by luring a validating resolver to query an authoritative zone that returns many valid-but-superfluous RRSIG records, which BIND always validates even when unnecessary. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/A:H) reflects an availability-only impact with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and it is not in CISA KEV, but ISC has released fixed builds (9.20.26 and 9.21.24).
Cache poisoning in ISC BIND 9 recursive resolvers allows an attacker who controls an authoritative zone to inject forged records by returning an RRSIG with fewer labels than its containing zone, tricking `named` into synthesizing a wildcard name for a zone shorter than the attacker's own. Affected versions span the 9.11.x through 9.21.x branches (including -S subscription editions), and the flaw is exploitable against default deployments because the triggering feature `synth-from-dnssec` is enabled by default. No public exploit identified at time of analysis; the issue was reported by ISC and vendor patches (9.20.26, 9.21.24) are available.
RPZ policy bypass and remote denial-of-service in ISC BIND 9 resolvers lets unauthenticated attackers defeat Response Policy Zone protections or crash the daemon by sending queries with names long enough to trigger a NAMETOOLONG condition during RPZ processing. Affected are BIND 9.16.0-9.18.50, 9.20.0-9.20.24, 9.21.0-9.21.23 and the corresponding -S (subscription) editions, but only where RPZ is configured with wildcard CNAME policies. No public exploit identified at time of analysis; the vendor (ISC) has released fixed builds 9.20.26 and 9.21.24.
Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing and content of authoritative responses to paired queries. When a client asks named to resolve a DNAME plus an A record beneath it (or a CNAME plus an A record for the same name) and the attacker-controlled authoritative server answers the A query positively but delays the DNAME/CNAME response before returning a negative or self-referential answer, named hits a fatal assertion and terminates. The flaw is unauthenticated and network-reachable (CVSS 7.5, availability-only); there is no public exploit identified at time of analysis and it is not on CISA KEV.
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows remote unauthenticated attackers to exploit a timing oracle in RadAsyncUpload's upload metadata processing, recovering protected (encrypted/signed) metadata values through measurable response-time differences during cryptographic validation. The flaw stems from non-constant-time comparison of the metadata's cryptographic integrity, letting an attacker probe validity incrementally. No public exploit was identified at time of analysis, and it is not listed in CISA KEV; EPSS and POC data were not provided.
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote unauthenticated attackers abuse the RadAsyncUpload control's client-state handling as a cryptographic oracle. Because the server distinguishes decryption failures from invalid-JSON parse failures, an attacker can iteratively probe the encrypted rauPostData token and recover protected metadata values. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Server-side file path manipulation and forced server-side requests in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 stem from insufficient validation of the language (DictionaryLanguage) parameter in the spell check handler, letting remote attackers coerce the server into resolving attacker-influenced file paths and issuing unintended outbound requests. Classified as information disclosure (CWE-36, absolute path traversal) with a CVSS 7.5 confidentiality-only impact, it exposes sensitive server-side file contents. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured memory when downstream DNS-over-QUIC (DoQ) is enabled. The first two bidirectional QUIC streams (stream_id 0 and 4) skip the per-stream 'quic-size' accounting gate, so large input buffers are allocated after only a 2-byte length prefix arrives, letting a single connection with two streams force Unbound to allocate roughly double the configured limit at near-zero attacker cost. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the mechanics are trivial and fully described by the vendor advisory.
Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone crash the resolver daemon with a single crafted upstream response, but only when the non-default 'dns-error-reporting: yes' option is enabled. The flaw is a stack write triggered while building a DNS Error Report query name from a malformed EDNS Report-Channel option (code 18). No public exploit has been identified at time of analysis and it is not listed in CISA KEV; the CVSS 7.5 reflects a pure availability impact (A:H) with no data disclosure despite the vendor's 'Information Disclosure' tag.
Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recursive DNS resolver by sending a single malicious encrypted DNSCrypt query over TCP. The TCP in-place encryption routine omits the reply-length clamp that protects the UDP path, so an oversized reply is shifted 48 bytes forward past the end of a heap allocation sized to 'msg-buffer-size' (CWE-122). Only builds compiled with '--enable-dnscrypt' and an active 'dnscrypt:' clause are affected; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
DNSSEC wildcard validation bypass in PowerDNS Recursor allows an attacker controlling or spoofing DNS responses to forge signed records by supplying RRSIGs whose label count is smaller than required. Because the validator fails to reject RRSIGs with too few labels, a wildcard signature can be replayed to authenticate names it should not cover, letting an attacker present forged-but-'validated' DNS data for a signed zone. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; the primary consequence is integrity (data forgery), not confidentiality or denial of service.
Privilege escalation in Check Point Gaia Portal allows an authenticated user holding only read-only administrative privileges to execute arbitrary commands as root, giving full compromise of the affected Quantum Security Gateway or Security Management appliance. The flaw (CWE-269, improper privilege management) is vendor-reported via advisory sk185153 and carries a CVSS 3.1 base score of 7.5 with high attack complexity. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0, is possible via its Centralized Thirdparty Jars component. A low-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability, though the attack is rated difficult to execute (high attack complexity). No public exploit identified at time of analysis and the flaw is not in CISA KEV, but it was disclosed by Oracle in the July 2026 Critical Patch Update.
Cryptographic key predictability in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 lets remote unauthenticated attackers forge integrity-protected upload metadata when Telerik.Upload.ConfigurationHashKey is absent and no explicit machineKey is configured, causing the upload handler to fall back to a predictable default key. This forgery capability is not the end goal but a stepping stone: it unlocks further exploit chains (notably the RAU unauthenticated deserialization chain referenced in the vendor KB). There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS was not provided.
Authentication bypass in Regular Labs Joomla extensions (Advanced Module Manager, Conditional Content, Content Templater Pro, and ReReplacer Pro) allows remote attackers to circumvent IP and GeoIP-based access restrictions by spoofing forwarded headers, effectively granting unauthorized access to location-restricted content or modules. The vulnerability has a CVSS 7.5 (High) with no authentication or user interaction required, but EPSS predicts a very low likelihood of exploitation (0.19%), and no public exploit code or active exploitation has been identified at this time. Affected versions span multiple extensions, and organizations using GeoIP/IP rules should treat this as a moderate risk requiring prompt attention.
Information disclosure in multiple Regular Labs Joomla extensions allows unauthenticated visitors to retrieve administrator-only content indexed via Smart Search. Affected extensions include Articles Anywhere, Conditional Content, Modules Anywhere, ReReplacer, Sourcerer, Snippets Pro, and Tabs & Accordions Pro. No public exploit or active exploitation is known, and EPSS probability is low (0.19%).
Buffer over-read when forwarding messages in Thunderbird allows remote attackers to crash the application by triggering an off-by-one error in MIME header parsing, with a possible but limited information leak of one byte. Affected versions are prior to 153 and 140.13; the user must have the non-default 'view all headers' option enabled while forwarding a specifically crafted email. At time of analysis, there is no evidence of active exploitation (not listed in CISA KEV) and EPSS indicates very low exploitation likelihood.
DNS cache poisoning in NLnet Labs Unbound (1.7.0 through 1.25.1) lets an actor who controls a single delegated zone under an NSEC-signed parent forge insecure DNS answers for unrelated sibling zones sharing that parent. The root cause is insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing, allowing fraudulent wildcard DS records to bring non-existent delegations into 'insecure' existence and inject spoofed records. Reported by NLnet Labs with a 7.5 (High) integrity-only CVSS; no public exploit identified at time of analysis and no EPSS/KEV data supplied.
Authentication bypass via IP spoofing in the IP Login extension for Joomla allows unauthenticated attackers to impersonate mapped accounts. The extension trusts forwarded client-IP headers without requiring a trusted proxy, enabling remote attackers to spoof the IP used for automatic login. No active exploitation has been confirmed, but the vulnerability is automatable and carries high integrity impact.
ID Token signature verification bypass in OIDC::Lite Perl library through version 0.12.1 allows unauthenticated remote attackers to forge authentication tokens by controlling the algorithm allowlist used during verification. When a relying party calls the verify method without pinning a specific algorithm, the library extracts the ‘alg’ value from the attacker-controlled token header and passes it as an accepted-algorithm allowlist, enabling ‘alg=none’ (no signature check) or key‑confusion attacks (e.g., RS256 to HS256). An attacker can impersonate any user by crafting a token with arbitrary ‘sub’ claims. No active exploitation has been confirmed, and the EPSS score (0.17%) suggests low immediate threat, but the issue is critical for unpatched systems using the unpinned verification path.
Unauthorized invoice disclosure in the Events Booking extension for Joomla (versions 5.0 through 5.8.1) lets remote unauthenticated attackers download invoice data belonging to other users because the extension fails to verify the requester's authorization. Rated CVSS 7.5 (confidentiality-only impact), with no public exploit identified at time of analysis and CISA SSVC marking exploitation status as none. The flaw is an access-control gap (CWE-284) tagged as an authentication/authorization bypass.
Information disclosure in the firmware of multiple Hikvision network camera families (DS-2CD, DS-2DE, DS-2DP, DS-2TD series) allows remote unauthenticated attackers to retrieve partial sensitive data by sending requests with improperly validated input parameters. The flaw was self-reported by Hikvision and rated CVSS 7.5 (confidentiality-only impact); no public exploit identified at time of analysis. Because these cameras are frequently internet-exposed, the network-reachable, no-authentication nature of the issue makes it a meaningful exposure risk despite the absence of integrity or availability impact.
Remote code execution in Dell PowerProtect Data Manager versions prior to 20.2.0.0 stems from improper input validation in the product's REST API, allowing a high-privileged, remotely authenticated attacker to escalate into arbitrary code execution on the data-protection appliance. Dell (the reporting vendor) rates it CVSS 7.2 (High) with full confidentiality, integrity, and availability impact but requiring high privileges (PR:H). There is no public exploit identified at time of analysis, the EPSS probability is low (0.61%, 46th percentile), and CISA SSVC marks exploitation status as none.
Elevation of privilege in Dell PowerProtect Data Manager versions prior to 20.2.0.0 allows an already high-privileged, remotely authenticated attacker to abuse improper input validation in the REST API to gain further control over the appliance. Exploitation yields total technical impact (full confidentiality, integrity, and availability compromise) but requires existing high privileges, keeping practical risk moderate. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Elevation of privilege in Dell PowerProtect Data Manager before 20.2.0.0 lets an already high-privileged, remote authenticated attacker abuse an improperly validated REST API input to gain further control over the backup and recovery appliance. Per the CVSS vector the attacker starts with high privileges (PR:H), yet the flaw yields total confidentiality, integrity, and availability impact on the affected system. There is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with a low EPSS probability of 0.50%.
Elevation of privilege in Dell PowerProtect Data Manager (versions prior to 20.2.0.0) allows a remote, high-privileged attacker to abuse improper input validation and gain elevated privileges, with full confidentiality, integrity, and availability impact per the CVSS vector. The flaw was reported by Dell, which has published advisory DSA-2026-287 and a fixed release. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently limited by the requirement for pre-existing high privileges.
Privilege escalation in n8n workflow automation platform before 2.30.1 allows a low-privileged Project Viewer to abuse the AI Agents feature, where the node-execution (run-node) tool omits authorization checks. By chatting with an agent that has node tools enabled, the viewer can execute arbitrary nodes and read credential secrets they should not access. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Improper authorization in MongoDB Server allows a local attacker holding a valid trusted-CA X.509 certificate to obtain unintended database roles when PROXY protocol v2 is used over the Unix domain socket, because certificate-derived roles bypass the configured tlsCATrusts allow-list during MONGODB-X509 authentication. An attacker with local access to the proxy socket can therefore escalate to roles they were never granted, compromising confidentiality and integrity of data. Tracked via MongoDB SERVER-128387 and rated CVSS 4.0 7.2 (High); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in MongoDB Server allows an authenticated user holding only read-only privileges to crash the mongod process by submitting an aggregation pipeline that uses the $linearFill window function with a maliciously typed sortBy expression. Because the required privilege level is minimal (any read user) and the trigger is a single crafted query over the normal database wire protocol, a low-privilege account can repeatedly terminate the database node. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; EPSS was not provided.
Denial-of-service via stack-based buffer overflow affects Hikvision DS-2CD and DS-2DE series IP cameras, where an authenticated attacker sending specially crafted network packets can corrupt memory and force device malfunction. The vendor's CVSS vector claims full confidentiality and integrity impact (C:H/I:H) in addition to availability, hinting at possible code execution beyond the DoS described, though the advisory text only states device malfunction. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Authorization bypass in MongoDB Server allows an authenticated user holding limited read privileges to read documents from collections they are not permitted to access, exploiting a discrepancy between how the $graphLookup aggregation stage is authorized versus how it is executed when the target collection is referenced inside an existing view's pipeline definition. The flaw (CWE-863, Incorrect Authorization) yields cross-collection data disclosure with no integrity or availability impact. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV; it was self-reported by MongoDB's CNA and tracked in SERVER-127357.
Denial of service in MongoDB Server allows an authenticated user to crash the database process by submitting a query whose sort specification embeds a `$meta` expression in raw BSONObj form. Because query planning fails to explicitly handle the meta-expression case when reading the sort pattern, it performs an incorrect transformation that trips an internal invariant, terminating the mongod process. No public exploit identified at time of analysis; the issue is tracked in MongoDB's Jira as SERVER-128341 and reported by MongoDB's own CNA.