Memory corruption via use-after-free in NLnet Labs Unbound 1.25.0-1.25.1 can cause a DNS resolver crash under specific, non-default configurations when the server is under load. The flaw originates from a regression introduced in a fix enabling 'respip' and 'dns64' module interoperability: subqueries receive a shallow copy of the active view name, and if the parent query is evicted (jostled) before the subquery completes, the dangling reference causes memory corruption. No public exploit code exists and no confirmed active exploitation (CISA KEV) has been identified; the vendor explicitly describes crash likelihood as low due to dependence on memory layout and allocator behavior.
Use-after-free in NLnet Labs Unbound 1.15.0 through 1.25.1 crashes the DNS daemon via a dangling pointer to a freed TLS server name string in the DNS-over-TLS forwarding path. A remote attacker with knowledge of the target resolver's configuration can trigger the crash by sustaining query pressure against the configured DoT zone while inducing a transient upstream connection failure, causing denial of service. No public exploit code exists and this vulnerability has not been confirmed as actively exploited, but the network-accessible attack surface (PR:N) makes it relevant to operators running internet-facing recursive resolvers with DoT forwarding.
Fatal application termination in NLnet Labs Unbound's libunbound library (up to and including 1.25.1) can be triggered remotely when the 'unwanted-reply-threshold' feature is enabled. An attacker controlling or able to spoof responses from an authoritative nameserver can flood the resolver with wrong-transaction-ID UDP datagrams until the threshold is crossed, causing libunbound to invoke 'libworker_alloc_cleanup' - a function absent from the internal allow list - resulting in a fatal exit that crashes the embedding application. Notably, standalone Unbound is unaffected because its counterpart function 'worker_alloc_cleanup' is correctly registered; only applications embedding libunbound are at risk. No public exploit code or CISA KEV listing has been identified at time of analysis.
Parameter tampering in the DialogHandler component of Progress Telerik UI for ASP.NET AJAX (all versions prior to 2026.2.708) allows unauthenticated remote attackers to manipulate server-side dialog behavior, establishing a foothold for chained exploitation of downstream application components. The CVSS vector specifies High integrity impact with no required privileges (PR:N), making the DialogHandler endpoint a meaningful attack surface in any deployment where it is network-accessible. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the vendor's explicit mention of chained exploitation elevates the practical risk beyond the moderate base score of 5.9.
Denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 causes server termination when DNS-over-QUIC (DoQ) is enabled and the resolver operates under high concurrency. Unbound incorrectly passes realtime clock values to libngtcp2 where monotonic timestamps are required; under load, the resulting assertion failure in libngtcp2 abruptly kills the Unbound process. No public exploit code exists and no active exploitation has been reported, but the self-termination of a DNS resolver constitutes a severe availability impact for any infrastructure depending on it.
Polkit privilege escalation in PortProtonQt 0.1.12 through 1.3.0 allows any local unprivileged user to modify system NetworkManager connections and mount or unmount arbitrary block devices without authorization. The vulnerable Polkit rule (ru.linux_gaming.PortProtonQt.rules) identifies trusted callers by inspecting process command lines via 'ps', a method trivially defeated by command-line spoofing or PID recycling races. A shell script reproducer confirmed by SUSE researchers achieves exploitation reliably and consistently. No public exploit is independently published but a working reproducer exists; no CISA KEV listing at time of analysis.
DNS cache poisoning risk in NLnet Labs Unbound 1.4.22 through 1.25.1 arises because the SO_REUSEPORT load balancing mechanism structurally leaks the secret entropy value - UDP source port randomization - that defends against Kaminsky-style attacks. Each worker thread is assigned a disjoint subset of source ports at startup, so an adjacent-network attacker who can observe Unbound's outgoing UDP queries to authoritative name servers can infer the thread-to-port-subset mapping and substantially reduce the port space to guess during a cache poisoning attempt. Proof-of-concept exploit code exists (CVSS 4.0 E:P); no confirmed active exploitation or CISA KEV listing has been identified.
Shell sandbox bypass in the optional @n8n/computer-use package for n8n exposes the full host filesystem and network to any privileged user who can invoke a computer-use workflow on Linux or Windows, because sandboxing was only implemented for macOS. Affected are n8n versions before 2.29.8 and 2.30.x before 2.30.1; standard n8n installations without the @n8n/computer-use package are entirely unaffected. No public exploit has been identified at time of analysis, but the subsequent-system impact is rated High across confidentiality, integrity, and availability in the vendor-sourced CVSS 4.0 vector.
Denial of service in Unistal Protegent 360 v2.0.0.4 allows a local low-privileged attacker to crash the system by exploiting uncontrolled resource consumption via the sub_13828 function. A proof of concept is publicly available, but no active exploitation has been reported, and EPSS score indicates a low likelihood of widespread attacks.
Mark-of-the-Web bypass in BandiZip 7.37 allows remote attackers to craft archives that, when extracted, fail to propagate zone identifiers to extracted files, letting malicious executables run without security warnings. A public proof-of-concept is available; the EPSS exploitation probability is low (0.39%).
Stored cross-site scripting (XSS) in multiple Regular Labs Joomla extensions allows an authenticated content author to inject arbitrary JavaScript. The script executes in visitors' browsers, potentially stealing session tokens or performing actions on their behalf. No active exploitation or public exploit code has been identified; EPSS score indicates very low likelihood of exploitation.
Unauthenticated information disclosure in IBM Sterling B2B Integrator and Sterling File Gateway allows remote attackers to read sensitive data by sending a specially crafted HTTP request that bypasses authentication controls. Affected deployments span versions 6.2.0.0 through 6.2.2.0_1 across both products, covering a wide span of the 6.2.x release train. No public exploit or active exploitation has been identified at time of analysis; IBM has released a patch and published an advisory.
Quota bypass in NLnet Labs Unbound 1.22.0 through 1.25.1 allows a remote unauthenticated client to cause the resolver to send more upstream DNS packets per query than the operator-configured 'max-global-quota' limit. A single crafted query for a deeply nested hostname under a DNSSEC-signed parent zone triggers excessive recursive DNSSEC validation traffic, effectively neutralizing a security control designed to suppress upstream amplification. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated denial-of-service in Progress Telerik UI for ASP.NET AJAX (all versions prior to 2026.2.708) is possible because the internal LayoutBuilder control parses client-submitted XML without disabling DTD processing, exposing recursive XML entity expansion (CWE-776, 'Billion Laughs'). Any network-reachable attacker can send a crafted HTTP request containing a self-referencing DTD payload to cause exponential memory and CPU exhaustion on the server-side process. No public exploit code or CISA KEV entry has been identified at time of analysis, but the low attack complexity and absence of authentication make this a straightforward DoS primitive once the target endpoint is located.
Cache-clearing denial-of-service in NLnet Labs Unbound through 1.25.1 allows a remote attacker who controls a DNS delegation to indefinitely and repeatedly flush Unbound's message and rrset caches without sending a single spoofed packet. The attack exploits a logic flaw in how the iterator processes in-bailiwick glue records containing the unspecified address 0.0.0.0/::0: on Linux, such queries are routed via loopback and answered by 127.0.0.1, creating an IP mismatch that the unwanted-reply counter tallies until the configured threshold triggers a defensive cache clear - which resets the counter, enabling the loop to continue indefinitely. No public exploit identified at time of analysis; CVSS 3.1 scores this 5.3 (Medium) with Low availability impact and no confidentiality or integrity impact.
Graylog2 Server's event definition duplicate endpoint fails per-entity authorization, allowing any authenticated low-privilege user holding only the global `eventdefinitions:create` capability to clone event definitions they have not been granted access to. By issuing POST /events/definitions/{definitionId}/duplicate against arbitrary IDs, an attacker receives a full copy of the target definition - exposing detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings that may be restricted to other teams or roles. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the upstream fix is confirmed at commit 46a2eeba4cdbc1408ff4cbf7b466853a8acfb38d.
MongoDB's mongod daemon can be crashed by any authenticated user holding only read-only privileges, dropping database service for every connected client until an operator restarts the process. The root cause is CWE-617 (Reachable Assertion) inside the aggregation framework's engine selection logic - a state the codebase assumed unreachable that a crafted combination of aggregation options can actually trigger. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the PR:L attack vector makes this a reliable insider-threat and post-compromise availability weapon against any network-reachable MongoDB deployment.
Denial of service against the MongoDB mongod process is achievable by any authenticated user holding standard read/write privileges by submitting a crafted aggregation command that exploits insufficient input validation in the bundled libmongocrypt library. An integer overflow (CWE-190) in libmongocrypt allows attacker-controlled payload values to produce an excessively large memory allocation request, causing the operating system to terminate the mongod process under an out-of-memory condition. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Incorrect authorization in MongoDB's $listSessions aggregation stage allows any authenticated user to enumerate session metadata cluster-wide - a capability that should be restricted to cluster-level administrators. Exposed data includes active session identifiers, associated usernames, and activity timestamps, which in combination represent a meaningful secondary risk for session-hijacking attempts against high-value accounts. No public exploit code exists and this is not listed in CISA KEV at time of analysis; however, the low exploitation bar (any valid MongoDB account) in multi-tenant environments elevates real-world concern above the moderate CVSS score alone.
Reflected XSS in JoomShopping's product frontend controller allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser when the victim clicks a crafted link. The flaw affects Joomla-based e-commerce sites running the JoomShopping extension, and successful exploitation could enable session hijacking, credential theft, or malicious page manipulation targeting shoppers. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Heap buffer overflow in Red Hat Directory Server (389-ds-base) exposes LDAP services to remote unauthenticated denial of service or potential arbitrary memory write via malformed DN input. When a Distinguished Name containing a legacy-quoted value is processed, the server fails to close the associated heap allocation, permitting a subsequent operation to reference the same memory pointer - a classic heap confusion primitive. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, though the network-accessible unauthenticated attack surface warrants prompt patching for any externally reachable Directory Server deployment.
Unauthenticated remote information disclosure in Hikvision DS-2CD and DS-2DE series IP cameras exposes partial device memory contents to network-accessible attackers without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no user interaction against default configurations, making the attack surface broad given the cameras' typical internet or LAN exposure. While confidentiality impact is rated Low (partial memory only), leaked memory may contain sensitive fragments such as session tokens or configuration data, and no public exploit or CISA KEV listing is confirmed at time of analysis.
Broken authorization in n8n's OAuth 2.1 consent flow allows a member-level authenticated user to self-approve OAuth consent for workflows they do not own, then execute those workflows in the victim owner's project context using the owner's stored credentials. Versions 2.27.0 through 2.29.7 and 2.30.0 are affected - the flaw was introduced precisely when the OAuth 2.1 MCP Server Trigger flow was added. On multi-user instances with at least one OAuth2-enabled MCP Server Trigger workflow, the attacker obtains a valid token, drives the workflow with attacker-controlled inputs, and reads outputs that may include sensitive data exfiltrated from the owner's connected third-party integrations, breaking both user and project isolation. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Credential exposure in n8n's LLM sub-node allows authenticated users to read plaintext API keys and secrets persisted in workflow execution records. Versions before 1.123.64 fail to mask custom HTTP header values - such as Authorization or X-API-Key headers - when those headers are used in LLM node configurations, causing secrets to be written in cleartext to execution data stored in the database. While exploitation requires a low-privilege authenticated session, the downstream impact is high because recovered credentials can be used to access external APIs and services configured in those workflows. No public exploit code or KEV listing has been identified at time of analysis.
Credential exfiltration in n8n's GraphQL node allows authenticated non-owner users to bypass the platform's 'Allowed HTTP Request Domains' domain-restriction policy and route HTTP-based credentials to an attacker-controlled server. Unlike the HTTP Request node, which correctly enforces domain allowlists, the GraphQL node omits this authorization check entirely, meaning any low-privileged workflow editor can redirect HTTP-based credential types - Header Auth, Basic Auth, Query Auth, and OAuth - to an arbitrary endpoint. No public exploit code or active exploitation has been identified at time of analysis; impact is bounded to deployments using domain-restricted shared credentials.
Credential exposure in n8n workflow automation platform leaks full Google Service Account PEM private keys into the JWT header's kid field, where they are trivially recoverable via Base64 decoding. Affected versions span both the 1.x line (before 1.123.64) and the 2.x line (before 2.29.8 and 2.30.1), but only deployments configured with Google Service Account credentials are at risk. An attacker who captures these JWTs from logs, network traffic, or monitoring systems can extract the raw private key and fully impersonate the service account against any Google Cloud resource it is authorized to access. No public exploit code has been identified at time of analysis, and no confirmed active exploitation is recorded in CISA KEV.
OS command injection in danger-js up to version 13.0.7 allows low-privileged local attackers to execute arbitrary shell commands by supplying a maliciously crafted file path to the `danger.git.diffForFile` function. The vulnerable code in `localGetFileAtSHA.ts` constructs a git command via unsafe template string interpolation and passes it to Node.js `exec()`, which invokes a shell - meaning any shell metacharacters embedded in a filename (e.g., `x";touch /tmp/pwn;#`) break out of the quoted argument and run as OS commands. Vendor-released patch 13.0.8 is available; no public exploit has been identified at time of analysis.
Stored cross-site scripting in Regular Labs Conditional Content and related Joomla extensions enables authenticated administrators to execute
Heap buffer overflow in NLnet Labs Unbound up to and including 1.25.1 allows a network attacker who controls a DNSSEC-signed authoritative server to corrupt heap memory or crash the resolver by serving a PX, RP, MINFO, or SOA record with RDATA truncated to omit the expected second embedded domain name. The DNSSEC validator's canonical RDATA construction routine computes a pointer to the absent second domain name and passes it unchecked to query_dname_tolower(), which then walks label-by-label through stale bytes in the per-worker env->scratch_buffer - overflowing the heap allocation when msg-buffer-size is configured below its default. No public exploit has been identified at time of analysis; exploitation is constrained by the AC:H requirement for attacker control of a DNSSEC-signed zone.
Dell PowerProtect Data Manager's REST API exposes sensitive information to high-privileged local users in all versions prior to 20.2.0.0. An administrator-level attacker with local access can query the REST API and retrieve sensitive data that should be restricted even at the admin tier - with the CVSS Scope:Changed indicator suggesting the exposed information may include credentials or secrets belonging to systems external to the PPDM instance itself. No public exploit code or active exploitation has been identified at time of analysis; Dell has released version 20.2.0.0 to address this and multiple other vulnerabilities per advisory DSA-2026-287.
Off-by-one heap out-of-bounds read in the BlueZ SBC (Sub-Band Coding) frame decoder allows a Bluetooth-adjacent unauthenticated attacker to leak a single byte of heap memory by streaming a crafted audio payload. Red Hat Enterprise Linux 7 through 10 are confirmed affected via the bundled sbc library. No public exploit code exists and this vulnerability is not listed in CISA KEV, making active exploitation unlikely; the impact is constrained to minor information disclosure of a single heap byte.
Cross-space information disclosure in Kibana 9.4.0 through 9.4.3 allows authenticated users to access data from Kibana Spaces they are not authorized to view. The flaw (CWE-862, Missing Authorization) arises because user-supplied input can reference cross-space resources without adequate space-level authorization checks, enabling privilege boundary bypass within a multi-tenant Kibana deployment. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Elgg's ImageService processes avatar uploads without validating source image dimensions prior to resizing, allowing authenticated users to trigger out-of-memory (OOM) conditions on the hosting server. All Elgg releases before 7.0.0 are affected; the fix introduced in 7.0.0 enforces hard limits on image height, width, and total resolution before any GD library resize operation is invoked. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the technique is conceptually trivial for any authenticated user with avatar upload access.