Denial of service in fflate through 0.8.2 exposes any application calling unzipSync() to an indefinite process hang when processing attacker-supplied ZIP archives. The synchronous decompression helper z64e() enters an infinite loop when a ZIP central directory entry sets compressed_size=0xFFFFFFFF (the ZIP64 sentinel) but omits the required extra field tag 0x0001, causing JavaScript out-of-bounds array reads to silently return undefined, which coerces to 0 and prevents the loop from ever terminating. No public exploit has been identified at time of analysis, but the attack is network-reachable with no authentication required (CVSS 4.0 PR:N, UI:N) and is flagged automatable (AU:Y), making it a credible denial-of-service threat against any fflate-consuming service that accepts untrusted ZIP input.
Availability loss in ISC BIND 9 DNS server arises when a stored DNS key record containing the PRIVATEDNS algorithm (algorithm number 253) carries a malformed identifier length field that exceeds the actual identifier data. BIND accepts the structurally invalid record without rejecting it at ingestion time, but when it subsequently attempts to render that record to text - during logging, zone display, or similar operations - the inconsistent length triggers a reachable assertion (CWE-617) that causes BIND to abort and exit. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; however, BIND 9 spans a very wide version range and is critical infrastructure, making patch urgency high despite the medium CVSS score of 6.5.
Path traversal via indirect prompt injection in the Ansible Lightspeed Model Context Protocol (MCP) server allows an attacker to manipulate an AI agent into writing files to unauthorized filesystem locations on the user's system. Specifically affected is the Lightspeed MCP server component; the attack leverages poisoned content processed by the agent rather than a direct network request. Successful exploitation can expose sensitive host information and enable execution of malicious commands, potentially resulting in full system compromise. No public exploit identified at time of analysis.
Privilege escalation in Hikvision DS-2CD series IP cameras allows an SSH-authenticated attacker to gain full administrative control of the device by exploiting incorrect permission allocation in the device firmware. The vulnerability requires prior SSH authentication, making it an insider or credential-theft-dependent threat rather than an unauthenticated remote attack. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but successful exploitation delivers complete confidentiality, integrity, and availability compromise of the affected camera.
Arbitrary shortcode injection in the Contact Form 7 - Dynamic Text Extension WordPress plugin (all versions ≤ 5.0.6) allows unauthenticated remote attackers to execute any registered WordPress shortcode on the target site by submitting crafted form input that bypasses input validation before reaching the native do_shortcode() function. The blast radius depends on what shortcodes are registered by other installed plugins, making high-privilege shortcodes the real threat multiplier. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, a partial patch shipped in 5.0.4 was insufficient, leaving sites on all sub-5.0.7 versions exposed.
Server-side request forgery in Progress Telerik UI for ASP.NET AJAX's RadEditor PDF export feature enables authenticated attackers to force the web server to issue outbound HTTP requests to arbitrary attacker-controlled hosts. Because the affected product runs on Windows, those outbound connections can carry Windows NTLM authentication material, exposing credentials for potential relay or offline cracking attacks. The vulnerability affects all versions prior to v2026.2.708 and carries a vendor-confirmed CVSS 6.5 (High confidentiality impact) with no public exploit identified at time of analysis.
Unauthenticated file read and deletion in Progress Telerik UI for ASP.NET AJAX (all versions prior to v2026.2.708) is made possible by a hardcoded cryptographic key (CWE-321) embedded in the obsolete RadChart component's ChartImage.axd HTTP handler. Remote attackers without any credentials can exploit this to read or delete image-extension files within the application directory, bypassing standard authentication controls entirely. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis, but the unauthenticated network-accessible attack vector warrants prompt patching for all affected deployments.
Authorization bypass in Universe Software's Online Registration and Workflow Management System (through version 12022026) allows authenticated low-privilege users to access other users' registration records by manipulating user-controlled key parameters. The vulnerability, classified as CWE-639 (IDOR), exposes a high-severity confidentiality impact with no integrity or availability risk - attackers can read but not modify data. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and network accessibility make this straightforward to exploit for any authenticated user of the platform.
ES|QL engine denial of service in Elasticsearch allows any authenticated network user to trigger exponential CPU consumption by submitting a specially crafted query, exhausting query worker thread pool resources and rendering ES|QL unavailable until the node is manually restarted. Affected versions span two major release trains: Elasticsearch 8.0.0-8.19.18 and the full 9.x series through 9.4.3. No public exploit code has been identified at time of analysis and CISA KEV confirmation is absent; however, Elastic's security team has released patches across all three affected branches (ESA-2026-74).
Information disclosure in Regular Labs Joomla extensions (Users Anywhere and Articles Anywhere) allows authenticated users to access insufficiently restricted user fields via crafted content containing user tags, filters, or conditions. Attackers with low privileges can expose authentication-related data, raw user parameters, and restricted contact details. No public exploit or active exploitation has been identified at the time of analysis, and the EPSS score (0.23%) indicates low exploitation probability.
DNS response policy poisoning in NLnet Labs Unbound 1.7.0 through 1.25.1 allows an unauthenticated network attacker to become the authoritative XFR source for an auth/rpz zone by spoofing the configured primary hostname's A/AAAA record. The flaw stems from Unbound accepting a BOGUS-validated hostname resolution - one where DNSSEC validation has explicitly failed - as a valid zone transfer endpoint without requiring a valid RRSIG, violating the integrity guarantees DNSSEC is designed to enforce. Successful exploitation enables complete replacement of the resolver's response policy zone, making this a DNS firewall bypass with high real-world consequence for organizations relying on RPZ for threat blocking. No public exploit code has been identified at time of analysis.
Incomplete RBAC authorization in AWX's websocket event consumer exposes real-time job stdout to any authenticated user, regardless of organizational access controls. Three event group types - inventory_update_events, project_update_events, and system_job_events - are absent from the consumer_access() authorization mapping, causing authorization checks to be silently skipped when users subscribe to these channels for arbitrary object IDs. This is confirmed as an incomplete remediation of CVE-2020-10698, affecting Red Hat Ansible Automation Platform 2. No public exploit or CISA KEV listing is identified at time of analysis.
Stored Cross-Site Scripting in the Ultimate Addons for Elementor WordPress plugin allows authenticated contributors to implant persistent JavaScript payloads via the Navigation Menu Widget's data-toggle-icon and data-close-icon attributes, affecting all versions through 2.9.1. The attack survives WordPress's wp_kses_post sanitization because the filter does not decode HTML entities within data-* attribute values at save time, while the browser subsequently decodes them client-side before jQuery's .html() renders them as live markup. No public exploit code or CISA KEV listing is identified at time of analysis, but the low privilege bar - contributor access on any multi-user WordPress site - and the scope-changed CVSS impact make this a meaningful risk wherever open or broad contributor registration is permitted.
Server Action endpoint IDs in Next.js App Router applications are exposed to unauthenticated users through publicly served client-side static JavaScript chunks, effectively bypassing page-level authentication gates on those endpoints. Applications running Next.js 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 with App Router and Server Actions (`use server`) or `use cache` directives are affected. Standalone exploitation provides an enumeration primitive rather than direct data access, but the disclosed IDs can amplify secondary weaknesses - particularly when Server Actions perform sensitive operations without re-authenticating callers within the action boundary itself. No public exploit code has been identified and no CISA KEV listing exists at time of analysis.
Unauthenticated cancellation of active test webhook sessions is possible in n8n prior to 2.28.0 (and prior to 2.27.4 on the 2.27.x branch) because the DELETE test-webhook endpoint is registered before the authentication middleware stack, making it reachable by any network caller who possesses a valid workflow ID. The impact is deliberately scoped: only in-progress developer test sessions can be disrupted; production webhooks, persistent workflow state, and stored data are explicitly unaffected per the vendor advisory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS 4.0 AT:P qualifier confirms a workflow-ID prerequisite limits opportunistic mass exploitation.
Unbounded Server Action payload processing in Next.js App Router exhausts server memory when the affected Server Action uses the Edge runtime, enabling remote denial of service without authentication. Any Next.js application on npm/next versions 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 that exposes at least one Server Action on the Edge runtime is vulnerable. An attacker can send arbitrarily large HTTP request bodies to trigger runaway memory allocation, potentially crashing the process or degrading service for all users. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.
CPU exhaustion in the Next.js Image Optimization API allows unauthenticated remote attackers to deny service against the `/_next/image` endpoint by serving malicious image content - particularly crafted SVGs - from domains permitted by `config.images.remotePatterns`. Affected self-hosted deployments on Next.js 15.5.0-15.5.20 and 16.0.0-16.2.10 using the default image loader invoke Sharp's expensive `.metadata()` call on attacker-influenced buffers, exhausting server CPU. Vendor-released patches are available in versions 15.5.21 and 16.2.11; no public exploit or CISA KEV listing is identified at time of analysis.
Cache key collision in Next.js server-side fetch exposes confidential POST response bodies to unintended callers when request bodies contain non-UTF-8 byte sequences. Specifically, the incremental cache's key-generation routine decoded raw body bytes through a TextDecoder, causing distinct byte sequences - such as UTF-16 encodings - to collapse to the same replacement-character string (U+FFFD) and therefore the same cache key. A request whose body coincidentally produces a colliding cache key will receive a cached response intended for a different body, leaking whatever confidential data the upstream service returned. No public exploit has been identified at time of analysis; vendor-released patches are available in v15.5.21 and v16.2.11.
Server-side request forgery in n8n workflow automation platform (versions before 1.123.64) enables authenticated low-privilege users to redirect the n8n server's HTTP requests to arbitrary internal network targets by injecting absolute URLs into routing configuration on dynamic-node-parameters endpoints that lack authorization scopes. The CVSS 4.0 vector assigns SC:H - high subsequent-system confidentiality impact - reflecting the risk of internal infrastructure exposure including cloud metadata endpoints, internal APIs, and private services. Exploitation is conditional on SSRF protection being disabled; no public exploit identified at time of analysis and no CISA KEV listing.
MongoDB Server's bundled MozJS (SpiderMonkey) scripting engine unconditionally registers a module loading hook that permits JavaScript code - executing inside aggregation pipeline stages - to read arbitrary files from the host filesystem using the mongod process's OS-level privileges. Any authenticated database user with permission to run JavaScript-enabled aggregation stages can craft pipeline commands to exfiltrate sensitive host files such as private keys, configuration files, or application secrets, bypassing MongoDB's own role-based access controls. No public exploit code or CISA KEV listing exists at time of analysis, but low attack complexity and a default-enabled attack surface make this a meaningful threat in any deployment with untrusted or broadly-credentialed users.
Dompdf's chroot validation logic in versions before 3.1.6 can be bypassed by an attacker who controls HTML content rendered into a PDF, allowing files outside the configured chroot directories to be read and embedded in the output. The root cause is a flawed `strpos()` prefix check in `validateLocalUri()` that fails to enforce directory boundaries after `realpath()` strips trailing slashes, enabling sibling directories like `/var/www-admin` to satisfy a chroot configured as `/var/www`. A publicly available proof-of-concept exploit is included in the GitHub Security Advisory GHSA-wvh6-f5jh-8gw4; no active exploitation is recorded in CISA KEV, and upgrading to v3.1.6 fully resolves the issue.
WebSocket protocol upgrade in Netty's V07/V08 handshakers completes without enforcing RFC 6455-mandatory `Connection: Upgrade` and `Upgrade: websocket` headers, enabling an attacker to silently switch protocols in a way that upstream reverse proxies and load balancers do not recognize as an Upgrade request. This desynchronization between proxy and backend creates a classic HTTP request smuggling vector (CWE-444) that can be exploited to poison shared connections, bypass proxy-enforced access controls, or hijack other users' HTTP sessions. Affected versions are `io.netty:netty-codec-http` prior to 4.1.136.Final and 4.2.0.Final through 4.2.15.Final; no public exploit code or CISA KEV listing has been identified at time of analysis.
DNS response policy rewriting in NLnet Labs Unbound 1.6.2 through 1.25.1 bypasses DNSSEC validation when the respip module is positioned ahead of the validator with response-ip or RPZ-IP redirect rules active. The rewriting handler fails to check upstream DNSSEC security status, allowing a spoofed BOGUS A/AAAA answer whose address falls within an operator-configured redirect subnet to be rewritten and returned to clients with a hardcoded INSECURE security level rather than being rejected as BOGUS. No public exploit code has been identified at time of analysis, but the integrity impact is concrete: clients receive silently misdirected responses that appear to pass through legitimate operator-controlled policy, undermining the core DNSSEC trust guarantee for affected deployments.
OS command injection in umijs umi's GIT File Helper enables arbitrary shell command execution against developer workstations during project builds. All umi 4.6.x releases through 4.6.63 are affected via the getFileCreateInfo and getFileLastModifyInfo functions in packages/utils/src/getFileGitIno.ts, which invoke child processes with shell: true and pass unsanitized file paths directly to the shell. A public proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been identified, and umi 4.6.64 fully remediates the issue.
Symlink-following vulnerability (CWE-59) in systemd-tmpfiles allows a local, low-privileged user to redirect privileged file write operations to an attacker-controlled path on affected Red Hat Enterprise Linux systems. The flaw resides in the path resolution logic within chase.c, where a safety check incorrectly treats all transitions away from the root user as inherently safe - failing to detect attacker-placed symlinks at tmpfiles.d target path components. Exploitation is constrained by high attack complexity requiring a specific non-default tmpfiles.d configuration, and no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/prescription.php` endpoint to database manipulation via the unsanitized `editid` parameter, exploitable by remote authenticated users. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for exploitation. No CISA KEV listing is present; the CVSS 4.0 score of 2.1 reflects low impact across all dimensions, likely constrained by the database user's privileges or the limited data scope accessible through this endpoint.
OS command injection in Syncfusion ej2-javascript-ui-controls through version 33.2.3 allows a local attacker with low-privilege access to execute arbitrary operating system commands via unsanitized input passed to the child_process.exec function referenced in package.json. This is a build-time or script-execution sink, meaning exploitation is most likely during npm script invocation in developer workstations or CI/CD pipelines rather than in end-user browsers. A public proof-of-concept exists (GitHub issue #215); no CISA KEV listing is present, and the CVSS 4.0 score of 4.8 reflects limited real-world impact constrained to the local system.
OS command injection in oclif up to 4.23.16 allows a local attacker who can control the jitPlugins configuration to execute arbitrary shell commands through the JIT Plugin Entry Handler's unsafe use of child_process.exec. The root cause is that plugin names from the oclif.jitPlugins field in package.json are interpolated directly into shell command strings passed to exec(), enabling shell metacharacter injection. A public exploit exists (GitHub issue #2051) and a patch has been released replacing exec() with cross-spawn's argument-array-based spawn().
Cache confusion in Next.js App Router's server-side fetch patch leaks confidential POST response bodies across unrelated requests targeting the same URL. Applications on Next.js 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 that call `fetch(new Request(init), aDifferentInit)` server-side are at risk of cross-user data exposure - one user's POST response (potentially containing session tokens, PII, or financial data) may be returned to a different user's request. No public exploit has been identified at time of analysis, and Pages Router deployments are explicitly unaffected.
Atlas Search integration in MongoDB's sharded topology exposes a per-user access control bypass to authenticated low-privileged users. The `$search` and `$searchMeta` aggregation pipeline stages rely on internal routing fields that are intended to be injected exclusively by the trusted mongos router during sharded query planning; due to insufficient input validation (CWE-20), an authenticated client can supply these fields directly and circumvent the access controls normally enforced per-user. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 6.0 reflects the combination of high confidentiality impact against a sharded-only attack surface requiring authenticated access.
MongoDB Server terminates abnormally during outbound TLS handshake when a remote peer delivers a malformed OCSP response, producing a denial-of-service condition against the database process itself. OCSP stapling validation is enabled by default for all outgoing TLS connections, meaning no operator misconfiguration is required to expose this attack surface - any MongoDB server initiating TLS connections is potentially reachable. No public exploit code exists and no CISA KEV listing is present at time of analysis, but the default-enabled feature combined with the adjacent-network attack vector makes this a credible operational risk for MongoDB clusters traversing partially trusted or shared network segments.
Counter exhaustion in NLnet Labs Unbound 1.20.0 through 1.25.1 enables a remote attacker to degrade DNS resolution service by triggering a missing decrement in the serve-expired discard-timeout code path. The reply-address counter for duplicate in-flight queries is never decremented when the discard-timeout branch fires under a specific non-default misconfiguration, allowing an attacker controlling a slow authoritative zone to drive the counter to its maximum and cause silent query drops for legitimate clients. No public exploit identified at time of analysis; however, the vulnerability is exploitable remotely with no authentication required once the misconfiguration is in place.
Remote unauthenticated termination of Unbound 1.22.0 through 1.25.1 is possible via a crafted DNS-over-QUIC (DoQ) connection that exploits a signed-to-unsigned integer conversion error when Unbound mishandles the NGTCP2_ERR_STREAM_DATA_BLOCKED error condition. The flaw propagates an implicit conversion of the C literal `-1` to a 64-bit unsigned integer (0xFFFFFFFFFFFFFFFF), which exceeds the 62-bit QUIC varint ceiling and triggers a libngtcp2 assertion that aborts the entire resolver process. Exploitation is deterministic - a single QUIC connection with one crafted transport parameter and one DNS query is sufficient - though the attack surface is constrained to deployments compiled with assertions enabled and DoQ actively configured. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Crash-triggering memory corruption in Unbound's DNSCrypt subsystem allows any unauthenticated network client to kill the DNS resolver with a single UDP packet. Affected versions 1.7.0 through 1.25.1, compiled with DNSCrypt support, miscount valid key slots when the dnscrypt-provider-cert list outnumbers dnscrypt-secret-key entries, leaving tail slots filled with libsodium's 0xdb debug pattern; iterating beyond valid bounds then dereferences that garbage. No public exploit has been identified at time of analysis, and no KEV listing exists, but the trigger condition is trivially constructable - one 68-byte UDP datagram.
Denial of service in NLnet Labs Unbound 1.10.0 through 1.25.1 allows a remote attacker controlling any delegated DNS zone to crash the resolver daemon via a NULL pointer dereference. The vulnerable path is activated only when both the serve-expired feature and a response-ip or RPZ CNAME redirect rule are configured simultaneously; the serve-expired-client-timeout callback's two-pass CNAME alias loop resets alias_rrset on the second pass without resetting partial_rep, causing an eventual null dereference and process crash. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the network-accessible attack surface makes it a meaningful availability risk for any resolver running these co-configured features.
Memory corruption via use-after-free in NLnet Labs Unbound 1.25.0-1.25.1 can cause a DNS resolver crash under specific, non-default configurations when the server is under load. The flaw originates from a regression introduced in a fix enabling 'respip' and 'dns64' module interoperability: subqueries receive a shallow copy of the active view name, and if the parent query is evicted (jostled) before the subquery completes, the dangling reference causes memory corruption. No public exploit code exists and no confirmed active exploitation (CISA KEV) has been identified; the vendor explicitly describes crash likelihood as low due to dependence on memory layout and allocator behavior.
Use-after-free in NLnet Labs Unbound 1.15.0 through 1.25.1 crashes the DNS daemon via a dangling pointer to a freed TLS server name string in the DNS-over-TLS forwarding path. A remote attacker with knowledge of the target resolver's configuration can trigger the crash by sustaining query pressure against the configured DoT zone while inducing a transient upstream connection failure, causing denial of service. No public exploit code exists and this vulnerability has not been confirmed as actively exploited, but the network-accessible attack surface (PR:N) makes it relevant to operators running internet-facing recursive resolvers with DoT forwarding.
Fatal application termination in NLnet Labs Unbound's libunbound library (up to and including 1.25.1) can be triggered remotely when the 'unwanted-reply-threshold' feature is enabled. An attacker controlling or able to spoof responses from an authoritative nameserver can flood the resolver with wrong-transaction-ID UDP datagrams until the threshold is crossed, causing libunbound to invoke 'libworker_alloc_cleanup' - a function absent from the internal allow list - resulting in a fatal exit that crashes the embedding application. Notably, standalone Unbound is unaffected because its counterpart function 'worker_alloc_cleanup' is correctly registered; only applications embedding libunbound are at risk. No public exploit code or CISA KEV listing has been identified at time of analysis.
Parameter tampering in the DialogHandler component of Progress Telerik UI for ASP.NET AJAX (all versions prior to 2026.2.708) allows unauthenticated remote attackers to manipulate server-side dialog behavior, establishing a foothold for chained exploitation of downstream application components. The CVSS vector specifies High integrity impact with no required privileges (PR:N), making the DialogHandler endpoint a meaningful attack surface in any deployment where it is network-accessible. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the vendor's explicit mention of chained exploitation elevates the practical risk beyond the moderate base score of 5.9.
Denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 causes server termination when DNS-over-QUIC (DoQ) is enabled and the resolver operates under high concurrency. Unbound incorrectly passes realtime clock values to libngtcp2 where monotonic timestamps are required; under load, the resulting assertion failure in libngtcp2 abruptly kills the Unbound process. No public exploit code exists and no active exploitation has been reported, but the self-termination of a DNS resolver constitutes a severe availability impact for any infrastructure depending on it.
Polkit privilege escalation in PortProtonQt 0.1.12 through 1.3.0 allows any local unprivileged user to modify system NetworkManager connections and mount or unmount arbitrary block devices without authorization. The vulnerable Polkit rule (ru.linux_gaming.PortProtonQt.rules) identifies trusted callers by inspecting process command lines via 'ps', a method trivially defeated by command-line spoofing or PID recycling races. A shell script reproducer confirmed by SUSE researchers achieves exploitation reliably and consistently. No public exploit is independently published but a working reproducer exists; no CISA KEV listing at time of analysis.
DNS cache poisoning risk in NLnet Labs Unbound 1.4.22 through 1.25.1 arises because the SO_REUSEPORT load balancing mechanism structurally leaks the secret entropy value - UDP source port randomization - that defends against Kaminsky-style attacks. Each worker thread is assigned a disjoint subset of source ports at startup, so an adjacent-network attacker who can observe Unbound's outgoing UDP queries to authoritative name servers can infer the thread-to-port-subset mapping and substantially reduce the port space to guess during a cache poisoning attempt. Proof-of-concept exploit code exists (CVSS 4.0 E:P); no confirmed active exploitation or CISA KEV listing has been identified.
Shell sandbox bypass in the optional @n8n/computer-use package for n8n exposes the full host filesystem and network to any privileged user who can invoke a computer-use workflow on Linux or Windows, because sandboxing was only implemented for macOS. Affected are n8n versions before 2.29.8 and 2.30.x before 2.30.1; standard n8n installations without the @n8n/computer-use package are entirely unaffected. No public exploit has been identified at time of analysis, but the subsequent-system impact is rated High across confidentiality, integrity, and availability in the vendor-sourced CVSS 4.0 vector.
Denial of service in Unistal Protegent 360 v2.0.0.4 allows a local low-privileged attacker to crash the system by exploiting uncontrolled resource consumption via the sub_13828 function. A proof of concept is publicly available, but no active exploitation has been reported, and EPSS score indicates a low likelihood of widespread attacks.
Mark-of-the-Web bypass in BandiZip 7.37 allows remote attackers to craft archives that, when extracted, fail to propagate zone identifiers to extracted files, letting malicious executables run without security warnings. A public proof-of-concept is available; the EPSS exploitation probability is low (0.39%).
Stored cross-site scripting (XSS) in multiple Regular Labs Joomla extensions allows an authenticated content author to inject arbitrary JavaScript. The script executes in visitors' browsers, potentially stealing session tokens or performing actions on their behalf. No active exploitation or public exploit code has been identified; EPSS score indicates very low likelihood of exploitation.
Unauthenticated information disclosure in IBM Sterling B2B Integrator and Sterling File Gateway allows remote attackers to read sensitive data by sending a specially crafted HTTP request that bypasses authentication controls. Affected deployments span versions 6.2.0.0 through 6.2.2.0_1 across both products, covering a wide span of the 6.2.x release train. No public exploit or active exploitation has been identified at time of analysis; IBM has released a patch and published an advisory.
Quota bypass in NLnet Labs Unbound 1.22.0 through 1.25.1 allows a remote unauthenticated client to cause the resolver to send more upstream DNS packets per query than the operator-configured 'max-global-quota' limit. A single crafted query for a deeply nested hostname under a DNSSEC-signed parent zone triggers excessive recursive DNSSEC validation traffic, effectively neutralizing a security control designed to suppress upstream amplification. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated denial-of-service in Progress Telerik UI for ASP.NET AJAX (all versions prior to 2026.2.708) is possible because the internal LayoutBuilder control parses client-submitted XML without disabling DTD processing, exposing recursive XML entity expansion (CWE-776, 'Billion Laughs'). Any network-reachable attacker can send a crafted HTTP request containing a self-referencing DTD payload to cause exponential memory and CPU exhaustion on the server-side process. No public exploit code or CISA KEV entry has been identified at time of analysis, but the low attack complexity and absence of authentication make this a straightforward DoS primitive once the target endpoint is located.
Cache-clearing denial-of-service in NLnet Labs Unbound through 1.25.1 allows a remote attacker who controls a DNS delegation to indefinitely and repeatedly flush Unbound's message and rrset caches without sending a single spoofed packet. The attack exploits a logic flaw in how the iterator processes in-bailiwick glue records containing the unspecified address 0.0.0.0/::0: on Linux, such queries are routed via loopback and answered by 127.0.0.1, creating an IP mismatch that the unwanted-reply counter tallies until the configured threshold triggers a defensive cache clear - which resets the counter, enabling the loop to continue indefinitely. No public exploit identified at time of analysis; CVSS 3.1 scores this 5.3 (Medium) with Low availability impact and no confidentiality or integrity impact.