Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid application login token and log in with full administrative privileges to Quantum Security Management and Multi-Domain Security Management servers (CWE-287, CVSS 4.0 9.3). Once authenticated, the attacker can rewrite security policies and configurations across managed gateways. It is confirmed actively exploited (CISA KEV) with publicly available exploit code, though Check Point reports only a very small number of affected customers, and the EPSS score is a modest 1.07% (61st percentile), consistent with targeted rather than mass exploitation.
Complete takeover of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by an unauthenticated remote attacker over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the 'Centralized Thirdparty Jars' component and carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation can significantly impact products beyond OPSS itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the perfect CVSS score and 'easily exploitable' vendor language make this a top-priority patch.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged attacker over HTTP through the Centralized Thirdparty Jars component. Because the flaw carries a scope change, successful exploitation can result in complete takeover of OPSS and significantly impact additional connected products, earning a near-maximum CVSS 3.1 base score of 9.9. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a high-priority patch.
Full compromise ("takeover") of Oracle Platform Security for Java (OPSS), a core security framework shipped inside Oracle Fusion Middleware, is possible by an unauthenticated remote attacker over HTTP against versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this 9.8 with full confidentiality, integrity, and availability loss and describes it as "easily exploitable," so it should be treated as a top-priority patch in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile (no authentication, no user interaction) makes it an attractive target once details or patches are reverse-engineered.
Remote takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, allows an unauthenticated attacker with HTTP network access to fully compromise the component. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, Oracle describes it as 'easily exploitable' via the Centralized Thirdparty Jars component. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
SQL injection in Xpoda No Code Platform (versions 4.3.1.0 through build 20260722) allows remote unauthenticated attackers to inject arbitrary SQL commands, per the CVSS PR:N/UI:N vector. Full read/write access to the backing database is achievable, threatening data confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; notably, the vendor was contacted by TR-CERT but did not respond, so no fixed version exists.
We are tasked with synthesizing a comprehensive analysis for CVE-2025-50329 from multiple intelligence sources. The output must be a single JSON object with specific fields. We must use all data provided: description, CVSS, EPSS, tags, SSVC, CPE, references, etc. And follow precision rules. Let's review the input data: - CVE ID: CVE-2025-50329 - Description: "An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and execute arbitrary code via the powerarc.exe." - CVSS: 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CWE: CWE-693 (Protection Mechanism Failure) - EPSS: 0.36% (percentile 28%) - low - Tags: RCE, N A (maybe "N/A"?) - SSVC: Exploitation: none, Automatable: yes, Technical Impact: total - CPE: cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* - this is weird, maybe placeholder. - Affected versions EUVD: ["n/a n/a"] - References: - https://www.powerarchiver.com/ (vendor site) - https://github.com/OV-0-VO/Public-references/blob/main/CVE-2025-50329.md (a GitHub reference, likely a PoC/advisory) - https://github.com/OV-0-VO/Public-references/commit/20437207859288ad1502fed2caebc38be27a3450 (commit diff) - Source code evidence from GitHub: shows a diff in CVE-2025-50329.md. The diff shows a fix: "When extracting files from an archive that bears Mark-of-the-Web, PowerArchiver" - the original line had a trailing space? Actually the diff shows a line change on line 15+4: the original had a space at end? It's unclear. But the important part is the description in the diff context: "When extracting files from an archive that bears Mark-of-the-Web, PowerArchiver" - suggests the vulnerability is related to Mark-of-the-Web handling during extraction, leading to code execution? The commit just removed a trailing space, but the file content itself might have more info. We can view the GitHub file to see the full description. But we only have this diff snippet. We'll infer from the CVE description and tags. Additional info: The CVE description mentions "escalate privileges and execute arbitrary code via the powerarc.exe". No explicit mention of authentication, but CVSS says PR:N so unauthenticated. No mention of KEV, so no active exploitation. No POC tag? Tags include "RCE, N A" - maybe "N A" means "not applicable"? Possibly "no auth"? Not sure. The GitHub repo "Public-references" could contain a proof-of-concept or at least a reference. Given that there's a GitHub reference, likely a public PoC exists. The SSVC says exploitation=none, but automatable=yes, which could mean it's easy to automate. EPSS is 0.36% (low) suggests low likelihood of exploitation in the wild right now. However, the CVSS is critical 9.8, so there is a tension: high CVSS, low EPSS. No KEV listing. We need to construct the JSON. Let's break down each field: product_name: "Power Archiver" (from ConeXware, Inc Power Archiver version 22.00.11 and before). So simply "Power Archiver". summary: Must be original synthesis, not copying description. Start with impact verb and product. So: "Remote code execution in Power Archiver 22.00.11 and earlier allows unauthenticated attackers to escalate privileges and execute arbitrary code via the powerarc.exe executable." Mention EPSS low, no KEV, PoC possibly available? The references suggest a GitHub advisory with details, so likely PoC. Should mention "publicly available exploit code exists" if we infer that. But precision rule: "If POC=YES but no KEV: 'publicly available exploit code exists'". We don't have explicit POC=YES, but the GitHub reference likely is a PoC repo. The commit message doesn't reveal exploit code, just a diff of the markdown file. But the file itself might contain PoC. Since it's from a repository named "Public-references" and the CVE ID is in the title, it's reasonable that the public reference includes exploit details. However, we must be careful: we only have the diff snippet, which just shows a change to the markdown file. The full file might describe the vulnerability and maybe a PoC. But we can't be certain there's a functional exploit. The SSVC says "Exploitation: none", meaning no evidence of exploitation. So I'll assume no active exploitation, but there might be a public technical write-up with possibly PoC details. The precision rule for "publicly available exploit code exists" would be if POC=YES. The input doesn't explicitly say POC=YES. I'll instead say "A technical write-up is publicly available; no exploit code has been confirmed" or something. But the instruction says: "If POC=YES but no KEV: 'publicly available exploit code exists'". Since POC flag isn't given, I'll use "no public exploit identified at time of analysis" as per rule: "If neither: 'no public exploit identified at time of analysis'". That would be conservative. However, the GitHub reference might be a PoC; the file name "CVE-2025-50329.md" could contain steps to reproduce. But the diff only shows a line about Mark-of-the-Web extraction. It's not a functional exploit. So I'll stick with "no public exploit identified at time of analysis". But we can note the existence of a technical write-up. The summary can mention "A proof-of-concept may be available" but the precision rule forbids speculation. I'll avoid claiming exploit code exists. So summary: "Remote code execution in Power Archiver 22.00.11 and earlier allows remote attackers to escalate privileges and execute arbitrary code. The flaw is reachable over the network without authentication. EPSS predicts low exploitation probability, but the vulnerability is easily automatable and has total technical impact." I'll incorporate that. technical_context: Underlying technology: Power Archiver is a file compression utility. The vulnerability likely stems from improper handling of Mark-of-the-Web when extracting archive files, leading to a protection mechanism failure (CWE-693) that allows arbitrary code execution. The CPE string is cpe:2.3:a:n/a:n/a, which seems generic, so we'll note that specific product CPE is missing but the affected product is Power Archiver versions up to 22.00.11. The exact root cause: When extracting files from archives that bear Mark-of-the-Web, PowerArchiver fails to apply proper security restrictions, allowing unsigned code to execute with elevated privileges. The attack vector is through the powerarc.exe executable. Since it's a remote attack (AV:N), the method likely involves sending a malicious archive to a user or a server that processes archives with PowerArchiver, leading to code execution. So educational: Mark-of-the-Web is a Windows mechanism that flags files downloaded from the internet; bypassing it can lead to arbitrary code execution. risk_assessment: Use all signals. CVSS 9.8: network, low complexity, no privileges, no user interaction, scope unchanged, high impact. EPSS 0.36% (28th percentile) suggests low likelihood of exploitation in the wild currently. No KEV listing, so not actively exploited. SSVC: exploitation none, automatable yes, technical impact total. The low EPSS despite high CVSS indicates that while theoretically critical, real-world exploitation is not widespread, perhaps due to limited deployment footprint or other factors. The SSVC automatable=yes with exploitation=none suggests that it could be exploited automatically if motivated attackers target it. The missing CPE data (n/a) indicates no precise product matching, which may affect vulnerability scanners' ability to detect it. POC status unknown. The risk assessment should contrast CVSS with EPSS and mention that it's a critical-severity but not actively exploited, so prioritize based on asset exposure. I'll state that the vulnerability is severe but currently low-risk due to no known exploitation; organizations should still patch. affected_products: Write paragraph listing product, version, and advisory. From description: "ConeXware, Inc Power Archiver v.22.00.11 and before". So version 22.00.11 and earlier. The CVE references include vendor site powerarchiver.com and a GitHub advisory. I'll link to the GitHub advisory as the reference. So: "Power Archiver by ConeXware, Inc, version 22.00.11 and all prior versions are affected. The vendor advisory or confirmation is available at the GitHub reference: https://github.com/OV-0-VO/Public-references/blob/main/CVE-2025-50329.md. The CPE identifier is reportedly cpe:2.3:a:n/a:n/a, which does not precisely identify the product, but the vendor's website is https://www.powerarchiver.com." That should work. remediation: Start with primary fix: upgrade to a version later than 22.00.11, but the specific fixed version is not provided in the data. I'll check references: no mention of a patch version. The vendor site may have updates, but not given. So I'll state "Vendor-released patch: exact fix version not confirmed in the advisory; update to the latest version of Power Archiver beyond 22.00.11 as provided by ConeXware." If no patch, suggest workarounds: Disable automatic extraction of archives from the internet, ensure Mark-of-the-Web protections are enforced, or avoid opening untrusted archives. Since the vulnerability involves Mark-of-the-Web bypass, ensuring Windows security settings are enabled and not using PowerArchiver for untrusted archives could mitigate. Actionable: "Until a patched version is applied, users should avoid extracting archives from untrusted sources with PowerArchiver, and ensure that the 'Unblock' option is not used for files flagged with Mark-of-the-Web." Or use alternative extraction tools. I'll write: "Upgrade to the latest version of Power Archiver (beyond 22.00.11) as soon as a fix is available. In the interim, disable automatic extraction when downloading archives, avoid opening archives from untrusted sources with PowerArchiver, and consider using Windows built-in extraction tools that enforce Mark-of-the-Web properly. Monitor the vendor's website for an official advisory." I can cite the GitHub advisory as a reference for details. But the GitHub reference is not an official advisory, it's a public reference. The vendor website powerarchiver.com is the official source. I'll say: "No official patch version specified; refer to the vendor's website (https://www.powerarchiver.com) for updated versions." I'll note that the GitHub reference contains technical details. So remediation paragraph: "Upgrade Power Archiver to a patched version beyond 22.00.11 once released by ConeXware. As no fixed version number is confirmed in the vulnerability disclosure, consult the vendor's website for the latest update. For immediate mitigation, cease using Power Archiver to extract files from untrusted archives, particularly those bearing the Mark-of-the-Web, and rely on Windows' built-in extraction tools or other archivers that enforce security markings. Alternatively, block PowerArchiver's network access if feasible, but note this may impair legitimate functionality." exploit_scenario: "An attacker crafts a malicious archive file containing executable content and sends it to a victim, perhaps via email or a download link. When the victim extracts the archive using a vulnerable version of PowerArchiver, the Mark-of-the-Web is ignored, allowing the executable to run with elevated privileges, leading to code execution and system compromise." That's a realistic scenario. No PoC confirmed, but the description implies. exploitation_conditions: The CVE description says "via the powerarc.exe". The diff snippet mentions "extracting files from an archive that bears Mark-of-the-Web". So the condition is: user must extract a specially crafted archive using PowerArchiver on a Windows system where Mark-of-the-Web is present. No authentication required. So specific conditions: "Victim must extract a malicious archive file using Power Archiver 22.00.11 or earlier on a Windows system where the archive carries the Mark-of-the-Web. No authentication or special configuration is required." The limiting factor: requires user interaction (UI:N, but actually the user must open the archive). Wait, CVSS says UI:N, which means no user interaction is required. That seems contradictory to the extraction process. Possibly the attack can be triggered automatically when PowerArchiver processes an archive without user interaction, e.g., as a service? The description just says "via the powerarc.exe" — maybe it's a network-accessible service
Arbitrary PHP code execution in the Regular Labs Sourcerer extension for Joomla versions 1.0.0 through 12.2.8 allows remote attackers with article editing access to execute arbitrary code on the server. The flaw stems from missing Super User checks in the Free edition and inconsistent permission enforcement across article owners, PHP/CSS/JavaScript settings, tag attributes, and file includes in the Pro edition. No public exploit or active exploitation is confirmed at this time, and the EPSS score indicates low exploitation probability (0.19%), though the CVSS base score is 9.8.
Authorization bypass in Cal.com DIY allows any authenticated user to create webhooks on arbitrary teams by injecting an unvalidated teamId, enabling exfiltration of sensitive booking data including organizer/attend
Authenticated arbitrary file upload in the Page Builder CK extension for Joomla (vendor joomlack.fr) allows a low-privileged authenticated user to upload a malicious file and achieve remote code execution on the host. The flaw (CWE-434) carries a CVSS 4.0 base score of 9.4 driven by high confidentiality, integrity, and availability impact plus subsequent-system impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in Check Point Quantum Security Management and Multi-Domain Security Management lets an unauthenticated remote attacker (CVSS:3.1 PR:N) run administrative commands directly on the Management Server, and potentially pivot to command execution on the managed Security Gateways it controls. It affects a broad range of releases (R77.30 through R82.10) up to specific Jumbo Hotfix Takes, but real-world exploitability hinges on the Management Server being network-reachable without firewall protection or without a restrictive Trusted Clients policy. At time of analysis there is no public exploit identified and no CISA KEV listing, so this is a high-severity but not-yet-weaponized issue.
Remote code execution in Fujitsu openFT managed file transfer software (Linux and Oracle Solaris variants) before version 12.1D00 lets remote attackers run arbitrary code without authentication (pre-auth RCE) over the network. The flaw is a CWE-94 code injection carrying a CVSS 4.0 base score of 9.3, and the CVSS vector confirms it needs no privileges and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the pre-auth, network-reachable nature makes it a high-priority patch target.
DOM-based cross-site scripting in Unblu Spark, reachable via an open-redirect flaw (CWE-601), lets remote attackers execute arbitrary JavaScript in a victim's browser after luring them to a crafted link. When Spark runs with com.unblu.identifier.siteEmbeddedSetup=true it shares the host application's origin, so injected script inherits full access to the host app's cookies, DOM, and same-origin APIs, expanding the blast radius well beyond Unblu itself and driving the CRITICAL 9.3 (CVSS 4.0) rating for on-prem embedded deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory corruption in MongoDB standalone mongod servers running with compute mode enabled allows remote attackers to crash the process (denial of service) or trigger undefined behavior by supplying maliciously crafted BSON data that is mishandled during aggregation pipeline processing (CWE-122 heap overflow). Only servers explicitly started in the non-default compute mode are affected. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the vendor rates it CVSS 4.0 9.2 (Critical) despite high attack complexity and a required precondition.
Persistent authentication bypass in Question2Answer through 1.8.8 lets an attacker holding a stolen 'Remember me' (qa_session) cookie keep authenticated access to an account even after its password is reset via the forgot-password flow. The reset handler qa_finish_reset_user() fails to clear the user's sessioncode field, so previously issued persistent cookies remain valid - defeating the primary account-recovery defense used after a compromise. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix is an upstream GitHub pull request rather than a tagged release.
Predictable persistent login keys in IP Login extension for Joomla allow unauthenticated attackers to compromise accounts. Versions 1.0.0 through 6.2.5 generate keys using a non-cryptographic random generator with insufficient entropy, enabling brute-force guessing. No public exploit is known, but the low-entropy PRNG makes key prediction feasible.
Content tags in the Articles Anywhere and Modules Anywhere extensions for Joomla can ignore access controls, enabling unauthenticated remote attackers to view restricted or unpublished articles and modules. The vulnerability stems from improper authorization enforcement when ignore
Wildcard CNAME proof validation bypass in PowerDNS Recursor allows a malicious or compromised authoritative DNS server to serve crafted responses that defeat DNSSEC validation for wildcard-expanded CNAME records, undermining the integrity guarantees DNSSEC is meant to provide. Affected versions span the 5.2.x, 5.3.x, and 5.4.x release trains, all patched on July 22, 2026. The vendor classifies this as Low severity; no public exploit code and no confirmed active exploitation have been identified at time of analysis.