We are tasked to synthesize data about CVE-2026-65711 into a JSON object. We must use all provided data: description, CVSS (especially the CVSS:4.0 vector, note this is CVSS 4.0 not 3.1), EPSS, KEV (not mentioned, assume no KEV), POC (publicly available), CPE, tags, SSVC, ENISA references. We need to output each field as a plain text string, not array/object. First, parse the data: - Description: sysPass through version 3.2.11 contains OS command injection, authenticated admins can set malicious backup path, the FileBackupService builds a tar command via string concatenation with siteBackupPath without escapeshellarg(), passing to exec(). Injected commands persist and execute on every backup trigger. - CVSS Score: 8.6 (note this is likely a CVSS 4.0 score, not 3.1). Provided vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Interpretation: Network attack vector, Low attack complexity, No attack requirements, Privileges Required High, No user interaction, Vulnerable component confidentiality high, integrity high, availability high, subsequent system none. Environmental metrics all X (not defined). So base score 8.6 is derived from those base metrics. - CWE: CWE-78 (OS Command Injection). - Multi-source: EPSS: 2.41% (percentile 82%): This is relatively high, indicating a moderate likelihood of exploitation in next 30 days. Percentile 82% means it's higher than 82% of all CVEs. POC/Exploit: Publicly available (so there is a PoC). Reported by: VulnCheck. CPE: cpe:2.3:a:nuxsmin:syspass:*:*:*:*:*:*:*:* (all versions up to 3.2.11) Tags: Command Injection, Syspass. SSVC: Exploitation: poc, Automatable: no, Technical Impact: total. (So SSVC says PoC exists, not automatable, total technical impact.) ENISA EUVD ID: EUVD-2026-48717, affected versions: sysPass 0 ≤3.2.11. References: - gist.github.com (exploit) - vulncheck advisory - NVD detail No KEV mentioned. So it's not in CISA KEV. So exploitation status: publicly available exploit code exists, but not confirmed actively exploited by CISA. We must produce a comprehensive analysis with all fields. Now for each field: 1. product_name: "sysPass" (3 words? Actually one word, it's the product name) 2. summary: 2-3 sentence plain-language. Start with impact verb and product. "Authenticated OS command injection in sysPass 3.2.11 allows administrators to execute arbitrary commands..." but we need to incorporate all data. Mention that it's authenticated, the mechanism (backup path), EPSS moderate, PoC exists. Not KEV, but publicly available PoC. So: "Authenticated command injection in sysPass up to version 3.2.11 permits administrators with configuration privileges to execute arbitrary OS commands by setting a crafted backup path. The vulnerability resides in FileBackupService's unsanitized string concatenation when building a tar command, allowing injected commands to persist across backup runs. Exploit code is publicly available, and EPSS indicates a 2.41% exploitation probability (82nd percentile)." 3. technical_context: Explain underlying technology: sysPass is a PHP-based password manager. The backup functionality uses PHP exec() to call tar, constructing the command by directly concatenating the user-supplied path. The CWE-78 is OS command injection. Use CPE to identify affected product: cpe:2.3:a:nuxsmin:syspass:*:*:*:*:*:*:*:* (all versions). Root cause is lack of escapeshellarg() or similar sanitization before passing to exec(). 4. risk_assessment: Use CVSS 4.0 vector: AV:N, PR:H, AC:L, UI:N, High impact on confidentiality, integrity, availability. So it's a high-privilege, network-accessible command injection. EPSS 2.41% suggests moderate real-world exploit probability. SSVC: exploitation: PoC (public exploit), not automatable, total technical impact. So risk: It's a critical vulnerability if an admin account is compromised, but it requires high privileges, which limits attack surface unless there is another way to gain admin access. Note: CVSS score 8.6, but PR:H. So it's not a remote unauthenticated RCE; it's post-authentication. However, if admin accounts are weak or another vulnerability grants access, it's severe. The SSVC "not automatable" might indicate it's not easily scripted, but PoC exists, so manual exploitation is possible. The high score is justified given total compromise. Contrast: EPSS moderate, not extremely widespread. We'll say: While CVSS base score is high (8.6), the requirement for administrative privileges significantly reduces the risk in environments with strong admin credential management. The publicly available PoC increases urgency for patching. 5. affected_products: "sysPass versions up to and including 3.2.11 are affected. The product is identified by CPE cpe:2.3:a:nuxsmin:syspass:*:*:*:*:*:*:*:*. Vendor advisory available at VulnCheck (link)." 6. remediation: Vendor-released patch? The description says "through version 3.2.11" implying that version is vulnerable, but no mention of a fix version. The references are an exploit gist and a VulnCheck advisory. No mention of an official patch. So no vendor patch identified? But we should check: The CVE was assigned, maybe a fix is in a later version. Since the description says "through version 3.2.11", maybe 3.2.12 or 3.3.0 exists? We have no data. So we must state: No official patched version confirmed. Workaround: Since the injection is via backup path set by admin, a compensating control: restrict admin access to trusted users only; disable backup functionality if not needed; implement input validation at web application firewall (WAF) to block command injection patterns in the backup path parameter. However, the description says the path is admin-configurable, so likely only admins can set it. So limiting admin accounts is key. If patch not available, maybe monitor. But it's better to say: Upgrade to a patched version once released. As of analysis, no patched version identified. Use network segmentation to restrict access to the sysPass admin interface. 7. exploit_scenario: An attacker who obtains administrative credentials (via phishing, brute force, or another vulnerability) logs into the sysPass admin panel, navigates to the backup settings, and sets the backup path to a value like "/tmp/backup; id > /tmp/pwned". When a backup is triggered (automatically or manually), the injected command executes as the web server user, leading to full command execution and potential lateral movement. 8. exploitation_conditions: Specific conditions: The attacker must have administrative privileges to configure the backup path. The backup functionality must be enabled and triggered (manually or via scheduled task). No other special conditions: the vulnerability exists in the default code path when processing backups. The attack is remote (network), requires authentication as an admin (PR:H), no user interaction beyond setting the malicious path. So: "Requires administrative authentication to sysPass; the backup feature must be enabled and triggered. No additional non-default configurations are required." 9. attack_chain: Using kill chain, we have a 4-step: Access (obtain admin credentials or session) → Exploit (set malicious backup path via admin interface) → Execution (trigger backup, injecting command) → Impact (execute arbitrary OS commands as web user). So: "Gain administrative access to sysPass → Set malicious backup path in settings → Trigger backup operation → The injected OS command executes via exec()" Actually, the injection persists, so it's: "Gain admin access → Inject command in backup path → Wait for or trigger backup → Execute arbitrary commands". But the chain can be: "Authenticate as admin → Navigate to backup configuration → Insert shell metacharacters into backup path → Save configuration → Trigger backup → Execute command". For brevity, we can combine. So: "Obtain admin credentials → Set backup path to include command injection → Initiate backup → Malicious command executes as web server user". That's 4 steps. It's a simple chain. 10. confidence_notes: Based on data: CVE assigned, VulnCheck advisory confirms vulnerability, exploit PoC publicly available. CVSS vector provided by NVD/NIST? Actually the CVSS vector came with the data, likely from NVD. So confirmed by NVD. Patch status unknown; no official fix version mentioned. The CVE description states "through version 3.2.11" so likely later versions may patch it but not confirmed. So: "Vulnerability confirmed by NVD and VulnCheck advisory. Public PoC exploit exists. No patched version identified in available data." 11. prevalence: sysPass is a self-hosted password manager, not as widely deployed as commercial alternatives. It's likely used by small to medium organizations or individuals. So prevalence: low? Possibly medium? It's an open-source project, some enterprise use but not ubiquitous. I'd say low. However, the SSVC says "not automatable" and EPSS 2.41% indicates some scanning? I'll estimate low. But prevalence basis: "open-source password manager, niche deployment". Could be medium if commonly used, but compared to WordPress or Apache, it's low. So "low". 12. prevalence_basis: "self-hosted password manager, modest community adoption". Short. 13. assessed_cvss_vector: We need to produce our own CVSS 3.1 base vector. The provided CVSS is 4.0. We can map the 4.0 base metrics to 3.1 as best we can. CVSS 4.0 has AV:N, AC:L, AT:N, PR:H, UI:N, VC:H, VI:H, VA:H. The 3.1 equivalents: AV:N, AC:L, PR:H, UI:N, S:C? Wait, in CVSS 4.0, scope is not explicitly present; instead we have vulnerable and subsequent system metrics. The attack vector is network, complexity low, privileges high, user interaction none. For scope: in CVSS 4.0, high impact on vulnerable system, low on subsequent. But in 3.1, scope is determined by whether the vulnerable component and impacted component are the same. Here, the vulnerability is in the web application (the vulnerable component) and execution happens on the same machine, so likely the vulnerable component and the impacted component are the same. However, it might be argued that the vulnerable component is the web app, and the impact is on the underlying OS, which is a different component. Typically for command injection in web apps, CVSS 3.1 sets Scope: Changed if the web app's security context is different from the OS command. Many CVSS 3.1 vectors for command injection use S:C. But we need to be consistent. The provided 4.0 set SC:N means subsequent system (after scope change) has no impact? Wait, no: In CVSS 4.0, VC:Vulnerable component confidentiality, VI, VA are high. SC: Subsequent system confidentiality, integrity, availability are all N. This means the vulnerable component (web app) suffers high impact, while the subsequent system (maybe the OS) has none? That doesn't make sense for OS command injection. The CVSS 4.0 user guide says: Vulnerable component is the thing that contains the vulnerability; Subsequent system is the component that suffers the impact if it's different. Here, the vulnerable component is the web application (sysPass). The impact is on the OS where commands are executed. If the web app and OS are considered separate, then the vulnerable component (web app) might have no confidentiality, integrity, availability impact because the exploit doesn't alter the web app itself, but rather the OS. But the injection lets an attacker execute commands as the web server user, which could read files (confidentiality), modify files (integrity), or disrupt service (availability) on the OS. The web app's own data may be accessible too. I think traditional CVSS 3.1 would set Scope Changed and impact on the OS as the target, with Conf/Integ/A
We are tasked to produce a JSON analysis for CVE-2026-66027 based on the provided data. The analysis must synthesize all the information, cross-reference, and produce a coherent summary, technical context, risk assessment, affected products, remediation, exploit scenario, exploitation conditions, attack chain, confidence notes, prevalence, prevalence basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. We have: - CVE: CVE-2026-66027 - Description: broken access control in message queue API of Suna before 0.9.102, allowing authenticated attackers to access/manipulate other users' queue resources. Can read pending prompt queues, read/delete individual sessions, inject prompts into another user's session queue, causing background drainer to forward malicious messages to victim's running AI agent with victim's credentials. - CVSS Score: 8.7 (base score based on CVSS 4.0 vector given: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N) - CWE: CWE-862 (Missing Authorization) - Multi-source: EPSS 0.26% (percentile 17%) so low exploitation probability. POC/Exploit: Publicly available. Patch: Available from vendor. Reported by VulnCheck. - CPE: cpe:2.3:a:kortix-ai:suna:*:*:*:*:*:*:*:* (so product is Suna from kortix-ai). - Tags: Authentication Bypass, Suna - SSVC: Exploitation: poc, Automatable: no, Technical Impact: total. - ENISA EUVD ID confirms affected versions: suna 0 <0.9.102. So all versions before 0.9.102 are affected. - References: - exploit: https://github.com/geo-chen/oss/blob/main/suna.md (likely a writeup) - release: https://github.com/kortix-ai/suna/releases/tag/v0.9.102 - pull request: https://github.com/kortix-ai/suna/pull/4373 (security fix PR) - patch commit: https://github.com/kortix-ai/suna/commit/7536a7d47fc93abcb66e677fcc993b390c81296a - vulncheck advisory: https://www.vulncheck.com/advisories/suna-broken-access-control-via-message-queue-api - NVD link: https://nvd.nist.gov/vuln/detail/CVE-2026-66027
Missing object-level authorization in sysPass through 3.2.11 allows API token holders to enumerate account metadata, overwrite passwords, and delete any account across the vault without per-account access controls. A public proof-of-concept is available, though EPSS indicates low exploitation probability (0.22%).
Authenticated administrators can execute arbitrary OS commands on Microweber CMS through 2.0.20 by injecting unsandboxed Twig expressions into mail templates. The vulnerability allows full server compromise once an admin injects a payload, which auto-executes on every mail dispatch event. Public exploit code exists, though no active exploitation is confirmed.
Authenticated attackers can bypass access controls in sysPass 3.2.11 and earlier to access, download, or delete any account file attachment, regardless of their ACL permissions, by exploiting missing authorization checks in AccountFileController. Public exploit code is available, but the EPSS score of 0.22% indicates low likelihood of widespread exploitation.
Authenticated SQL injection in Likeshop up to 3.0.5 allows admin-level users to extract arbitrary database contents via the adjustAccount endpoint. The vulnerability stems from unsanitized POST parameters (money, integral, growth, earnings) concatenated directly into raw SQL queries. Exploit code is publicly available, though no active exploitation has been reported by CISA.
Local code injection in NLTK versions prior to 3.9.3 allows an attacker with low privileges who can invoke the collocations module via the command line to execute arbitrary Python code. A publicly available proof-of-concept exploit demonstrates passing a crafted argument to the BigramAssocMeasures.eval() call, enabling arbitrary code execution including OS commands. The vulnerability has been patched in NLTK 3.9.3.
Account takeover in CAFEHAUS API plugin for WordPress allows unauthenticated attackers to arbitrarily reset any user password via a missing authorization endpoint. Versions up to 1.0.0 are affected, enabling complete site compromise by setting an administrator password and logging in. While a public proof-of-concept exists, no widespread exploitation has been confirmed by KEVCISA.
Unauthorized REST endpoint in WowOptin Popup Maker for WordPress (versions <1.4.38) allows unauthenticated attackers to disable all site opt-in forms and insert arbitrary template-based rows into the database. Public exploit code is available, though no active exploitation is reported. EPSS indicates a very low likelihood of widespread attack.
Unauthenticated privilege escalation in Paid Membership Plugin for WordPress before 4.16.18 allows an attacker to register an account with an elevated role such as Editor or Author, bypassing the configured restriction because the registration handler's role acceptance logic differs from the UI parser. The lack of a nonce on the public handler enables exploitation without user interaction. A public proof-of-concept exists, but no active exploitation has been reported via CISA KEV, and the EPSS score is low at 0.13%.
Message content overwrite in Open WebUI's chat completion API allows any authenticated user to modify messages in channels they do not belong to, including private and DM channels. By crafting a request with a `channel:`-prefixed chat_id and a target message_id, an attacker can overwrite a message's content while retaining the original author attribution, effectively impersonating the victim. A publicly available proof-of-concept exploit exists, and the vulnerability affects versions 0.9.5 through 0.9.9.
Cloudreve versions earlier than 4.17.0 contain an incorrect authorization flaw in the OAuth scoping of admin storage policy routes. An attacker with a bearer token scoped only to Admin.Read can send a request to the vulnerable endpoint and overwrite OneDrive storage policy credentials, violating the intended scope boundary. A publicly available proof-of-concept exists, and the vendor has released a patched version.
Privilege escalation in sysPass 3.2.11 allows authenticated users with the PUBLICLINK_CREATE profile flag to decrypt passwords of arbitrary vault accounts and store them in public links, enabling unauthenticated retrieval if the link hash is obtained. No active exploitation is confirmed, but public exploit code exists; EPSS probability is low (0.18%).
Privilege escalation in Weintek cMT3092X HMI and EasyWeb allows authenticated non-privileged users to modify cookies to gain elevated privileges. Affected firmware versions before 20210218 and EasyWeb versions before v2.1.20 are susceptible, with no public exploit code or active exploitation reported. EPSS probability is low (0.32%), indicating limited real-world exploitation likelihood.
Privilege escalation in Weintek cMT3092X HMI allows a low-privileged user to modify authentication tokens, gaining full administrative control over the device. The vulnerability affects firmware prior to 20210218 and EasyWeb prior to v2.1.20. No active exploitation is known and public exploit code has not been identified; EPSS indicates a low likelihood of exploitation.
Plaintext storage of user account passwords in Weintek cMT3092X HMI firmware and EasyWeb exposes credentials to any network-based attacker with low-privileged authenticated access. Successful exploitation leads to full confidentiality compromise as stored passwords can be read directly. No active exploitation or public exploit code has been identified, and a vendor patch is available.
Unauthorized data modification in Weintek EasyWeb allows authenticated low-privilege attackers to alter read‑only data, compromising system integrity. Affected versions are EasyWeb prior to v2.1.20 and cMT3092X firmware prior to 20210218. No active exploitation is known, and low EPSS score indicates limited real‑world risk.
Apache Thrift C++ library's THeaderTransport::readString() fails to properly validate info-header length, allowing an out-of-bounds read. An attacker sending a specially crafted Thrift message can trigger this to read beyond the buffer, potentially leaking sensitive memory contents. Remote unauthenticated exploitation is possible against any service using vulnerable bindings, and the issue is fixed in version 0.24.0.
Denial of service vulnerability in Apache Thrift Rust bindings prior to 0.24.0 allows remote attackers to exhaust memory by sending crafted binary protocol messages that lack a string size limit when the non-strict path is used. Successful exploitation can crash the affected service. No active exploitation or public exploit code is currently reported.
Denial of service in Apache Thrift through an integer overflow in the TProtocol::checkReadBytesAvailable() function affects C++ and c_glib bindings before 0.24.0. Attackers can send crafted messages to crash the service. No known active exploitation or public exploit code.
Denial of service in Apache Thrift Node.js server bindings before 0.24.0 allows remote attackers to exhaust server CPU resources via crafted requests that trigger quadratic-time processing in the receive transport. No active exploitation or public exploit is known at
Data amplification vulnerability in Apache Thrift's TZlibTransport allows remote attackers to exhaust server resources by sending highly compressed data that decompresses to disproportionate sizes. Affecting all language bindings before version 0.24.0, the flaw enables denial of service via ZIP-bomb-style attacks. Upgrading to Thrift 0.24.0 provides a fix.
Denial of service vulnerability in Apache Thrift's TCompactProtocol implementation allows remote attackers to trigger infinite loops when processing malformed varint input, affecting Python, Go, PHP, and Java bindings before version 0.24.0. Exploitation can exhaust CPU resources, making the service unresponsive; no active exploitation or public exploit code is known at this time.
Remote code execution and credential exfiltration in Snowflake libsnowflakeclient versions before 2.9.2 stem from three distinct flaws in the C client library: a stack-based buffer overflow (CWE-121) and an out-of-bounds write in the file-download path, plus improper validation of connection parameters. A lower-privileged principal sharing an internal stage can plant a file with crafted encryption metadata that corrupts memory in a higher-privileged victim process, while the connection-parameter flaw can redirect outbound authentication requests carrying credentials and tokens to an attacker endpoint. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV; the vendor fixed all issues in 2.9.2, which users must manually install.
Authenticated users with variable write permission on Devolutions PowerShell Universal 2026.2.2 and earlier can execute arbitrary PowerShell code on the server by injecting malicious variable values that are not escaped in the configuration file. No public exploit or active exploitation is known (EPSS 0.29%, SSVC exploitation: none), but the vulnerability has a critical CVSS score and the vendor has released a patch in version 2026.2.3.
Code injection in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to inject malicious PowerShell code. By crafting parameter names that are unsafe concatenated into a script invocation, an attacker can execute arbitrary commands on the underlying host. No public exploit or active exploitation is currently known, and EPSS indicates low exploit probability (0.29%).
Memory corruption in Apache NimBLE BASS service allows a nearby, paired attacker to exploit an integer underflow during parsing of Add Source or Modify Source PDUs, leading to a stack buffer overflow or arbitrary out-of-bounds read. This can result in full device compromise. No active exploitation or public exploit is known, and EPSS indicates low exploitation probability, but a vendor patch is available.
Out-of-bounds memory access in the Linux kernel’s iwlwifi wireless driver allows a remote attacker on the same WiFi network to corrupt kernel memory, potentially leading to code execution or system crash. The flaw occurs in Block Acknowledgment session handlers where the sta_mask field is not checked before being used to index an array, causing a wrap-around when the mask is zero. Affected are kernel versions prior to 6.18.38 and 7.1.3; no active exploitation or public exploit code is known at this time, and EPSS indicates a low probability of exploitation.
Denial of Service in React Router 7.x (Framework Mode) allows unauthenticated attackers to send crafted requests to the manifest endpoint, causing heavy server load and degraded response times. This is a follow-up CWE-400 vulnerability to GHSA-8x6r-g9mw-2r78, affecting only Framework Mode applications using react-router versions 7.0.0 through 7.17.x. A patch is available in version 7.18.0.
Heap out-of-bounds write in FFmpeg's native PNG and APNG encoders (all versions through 8.1.2) allows remote attackers who can supply a crafted PNG image to cause deterministic heap corruption and a potential arbitrary code execution primitive. The root cause is `add_exif_profile_size()` underestimating the required output buffer when multiple EXIF IFD entries share a large value payload - canonical serialization expands the deduplicated entries back to full size, causing `png_write_chunk()` to write tens of thousands of bytes past the allocated boundary. No public exploit exists and EPSS places exploitation probability at 0.55%, but VulnCheck reports the heap corruption is deterministic, elevating the eventual RCE risk.
Heap-based buffer overflow in FFmpeg versions up to 8.1.2 via a crafted CAF file can allow remote code execution. Exploitation requires user interaction (opening a malicious file). No known active exploitation or public exploit exists, but the vulnerability carries a critical severity score (CVSS 8.8).
CPU exhaustion in bandit 1.11.0 to 1.12.0 allows unauthenticated remote denial-of-service via WebSocket fragment reassembly. An attacker can send millions of tiny continuation frames per connection, triggering quadratic (O(n²)) buffer length recalculation that pins a CPU core for minutes to hours without requiring any authentication. No active exploitation has been confirmed (KEV), but a public proof-of-concept exists, and the EPSS score is low (0.39%).
Client-side denial-of-service in libssh2 through 1.11.1 allows a malicious SSH server to crash any connecting client before authentication by triggering an integer underflow during AES-GCM cipher negotiation, causing an out-of-bounds read and a near-SIZE_MAX memcpy that immediately terminates the process.
Reflected Cross-Site Scripting in Loytec LWEB-802 versions prior to 5.0.8 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by enticing them to click a crafted link containing malicious project or mspParams parameters. No active exploitation has been observed in the wild and EPSS indicates a low probability of exploitation (0.36%). Vendor has released a fix in version 5.0.8.
Stored XSS in the OPC XML-DA server statistics endpoint of multiple Loytec building automation devices allows an unauthenticated remote attacker to inject and persistently store arbitrary JavaScript by supplying a crafted User-Agent header in a POST request to the /da endpoint. When an administrator subsequently views the statistics page, the payload executes in their browser, enabling session hijacking, credential theft, and unauthorized device reconfiguration. Affected products include LIP-ME20xC, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD running firmware through 8.4.16 on the LINX-A64 platform; no public exploit or KEV listing has been identified as of this analysis.
Remote denial-of-service in Loytec LINX-A64-based building automation controllers through firmware 8.4.18 allows an unauthenticated network attacker to crash the `linx_a64.exe` process and reboot the device by sending a single malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet carrying an invalid month value. The root cause is an out-of-bounds read (CWE-125) in `bacdt_datetime_to_tod` during datetime parsing, with no authentication barrier and no user interaction required. No public exploit or active exploitation has been identified at time of analysis, but the SSVC automatable classification means mass scanning and crashing of exposed BACnet devices is trivially scriptable.
Double-free heap corruption in libssh2's SFTP client allows a malicious SSH server to corrupt the memory of any authenticated client that opens an SFTP session. This vulnerability, present in libssh2 through 1.11.1, can be triggered via a crafted server response during the `sftp_open()` operation, leading to tcache poisoning and potential arbitrary code execution on the client. No active exploitation has been confirmed, and no public PoC is known at this time, though the EPSS score is low (0.29%).
Reflected XSS in Google Cloud Looker allows an unauthenticated remote attacker to execute arbitrary JavaScript in an authenticated user's browser via a specially crafted URL, with the worst-case consequence being full administrative account takeover. All Looker release branches prior to versions 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 are affected across both Looker-hosted and self-hosted deployments; Google has already applied mitigations to Looker-hosted instances, leaving self-hosted operators as the remaining exposure surface. No public exploit code or active exploitation has been identified at time of analysis, with EPSS at 0.27% and no CISA KEV listing, though SSVC rates technical impact as total given the admin-takeover potential.
Header injection in the cluster-proxy service-proxy component of Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE) allows an authenticated hub principal to escalate to cluster-admin across all managed spoke clusters. The service-proxy forwards Kubernetes impersonation group headers to spoke clusters without stripping caller-supplied values first; because the spoke ServiceAccount holds unrestricted impersonation rights, an injected Impersonate-Group header (e.g., system:masters) is honored by every downstream cluster API server. No public exploit has been identified at time of analysis, and EPSS sits at 0.23%, though SSVC rates technical impact as total given the blast radius across the entire managed fleet.
We are tasked with synthesizing data from multiple sources about CVE-2026-10610 into a comprehensive analysis in JSON format. The output must be a JSON object with the specified fields, all strings, and no arrays or objects. Let's extract relevant data: - CVE ID: CVE-2026-10610 - Description: "Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user." - CVSS Score: 8.5 (CVSS 4.0 score, base score 8.5) - CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CWE: CWE-269 (Improper Privilege Management) - EPSS Score: 0.14% (percentile 4%) - Reported by: ESET - CPE: cpe:2.3:a:eset_spol._s.r.o.:eset_endpoint_security_for_macos:*:*:*:*:*:*:*:*, cpe:2.3:a:eset_spol._s.r.o.:eset_cyber_security_for_macos:*:*:*:*:*:*:*:* - Tags: RCE, Privilege Escalation, Eset Endpoint Security For Macos, Eset Cyber Security For Macos - SSVC: Exploitation: none, Automatable: no, Technical Impact: total - ENISA EUVD ID: EUVD-2026-48558 - Affected versions (EUVD): - ESET Endpoint Security for macOS 0 ≤8.0.7200.0 - ESET Endpoint Security for macOS 9.0 ≤9.0.5400.0 - ESET Endpoint Security for macOS 8.1 ≤8.1.200.0 - ESET Cyber Security for macOS 0 ≤9.0.5300.0 - ESET Endpoint Security for macOS 9.1 ≤9.1.2500.0 - References: - [cveorg] (None) https://support.eset.com/en/ca8977-eset-customer-advisory-local-privilege-escalation-vulnerability-in-eset-security-applications-for-macos-fixed - [vuldb] (advisory) https://vuldb.com/vuln/382896 - [euvd] (advisory) https://nvd.nist.gov/vuln/detail/CVE-2026-10610 We also have "Reported by: ESET" likely meaning the vulnerability was reported by ESET, and the product is ESET's own software. Now, we need to produce fields. Let's go through each: 1. product_name: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPre
Local privilege escalation in ESET Endpoint Security and Cyber Security for macOS allows a low-privileged local attacker to write arbitrary files with controlled content as root, leading to full system compromise. The vulnerability affects multiple versions of the macOS security applications and is addressed in a vendor patch. No active exploitation has been reported, and the EPSS score is low at 0.12%, but exploitation would give an attacker complete control over the system.
Out-of-bounds read in KVM's x86 Hyper-V paravirtualization layer allows a guest attacker with L2 nested VM control to read host kernel memory or trigger a hypervisor crash. The VP (Virtual Processor) ID field from the enlightened VMCS is used without bounds validation in `hv_is_vp_in_sparse_set()` when servicing paravirtual TLB flush hypercalls for L2 guests; the TLFS defines a maximum of 4096 VP IDs (64 banks × 64 vCPUs), but an L2 guest can supply an arbitrary value, causing an out-of-bounds array read confirmed by a KASAN use-after-free splat in the commit. No public exploit code exists at time of analysis, and EPSS sits at 0.16% (5th percentile), reflecting niche real-world exposure.
We are tasked with producing a comprehensive analysis of CVE-2026-12504 in JSON format. We have description, CVSS 4.0 vector, CWE, EPSS, CPEs, tags, SSVC, affected versions from EUVD, and references. No KEV status mentioned, so not in KEV. EPSS is low. The description says: Improper Authentication due to PAM configuration allows local attacker to authenticate as uid=0 without password and get root shell via /etc/passwd entry with empty password. So this is a local privilege escalation via a misconfigured PAM allowing passwordless root login if there is a root entry with empty password. The vulnerability is in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD through 8.4.16 on LINX-A64. So it's a very specific product line, likely industrial or building automation devices. CVSS 4.0: AV:L, AC:L, AT:N, PR:H, UI:N, VC:H, VI:H, VA:H, SC:N, SI:N, SA:N. So local attack, low complexity, requires high privileges (PR:H), no user interaction. That matches concept: to add an entry to /etc/passwd, you need high privileges, then you can get root. So the vulnerability is that if a root entry with empty password exists, you can log in as root without password. This is improper authentication in PAM config. SSVC: exploitation none, automatable no, technical impact total. So no active exploitation, not automatically exploitable, total impact if exploited. EPSS 0.13% (low). No POC mentioned. So low risk. No KEV. We must synthesize data from multiple intel sources: we have NVD description, EPSS, CWE, CPEs, tags, SSVC, EUVD affected versions, references. We'll write fields as paragraphs. Use all data to add value. We'll cross-reference. We'll note that the vulnerability is in PAM configuration, likely a default configuration that permits empty password for root, conflicting with security expectations. Affected are many Loytec building automation products running on LINX-A64 architecture. The attacker must already have high privileges (probably root) to add such an en
A local privilege escalation flaw in the ltsudo binary on Loytec LIP-ME201C and related L-Series building automation controllers allows an attacker with superadmin group membership to reset the password of any LARM user, including the larmapp service account, via the set-passwd subcommand. This can lead to full compromise of LINX-A64-based devices running firmware up to version 8.4.16. Exploitation requires local access and high privileges; no active exploitation or public exploit code is currently known, and EPSS indicates a very low probability of exploitation.
TLS hostname verification bypass in Apache Thrift C++ bindings allows man-in-the-middle interception of Thrift RPC communications. The vulnerability resides in the TSSLSocket matchName() function's handling of wildcard certificates per RFC 6125, permitting an attacker with a crafted certificate to impersonate a legitimate server. Upgrading to version 0.24.0 fixes the flaw; no active exploitation or public exploit has been identified at this time.
Una
Out-of-bounds heap read in the Linux kernel mac80211 WiFi stack allows an adjacent wireless attacker with no authentication to trigger a slab-out-of-bounds read by sending a crafted 802.11be negotiated TTLM element with a sparse link-map presence bitmap. Affected kernels from 6.9 through 6.12.91, 6.18.33, and 7.0.10 advance the TTLM parser cursor for every TID regardless of whether a presence bit is set, reading past the validated element allocation. The raw read bytes are gated by valid_links before any driver state change, limiting direct policy impact; the primary risk is kernel crash (availability). No public exploit or CISA KEV listing exists; EPSS is 0.17%.
Denial of service in the Linux kernel's x86/ftrace dynamic trampoline mechanism causes a kernel panic when CONFIG_CALL_DEPTH_TRACKING is enabled on retbleed-affected platforms (e.g., Skylake) using retbleed=stuff. An attacker with local privileged access to configure ftrace can trigger a crash by setting up a kprobe event and invoking the traced function. No active exploitation or public exploit has been reported, and the EPSS probability is 0.16% (5th percentile), indicating low real-world risk.
TLS certificate validation is entirely disabled in epa4all (med-united, all releases prior to 2026-05-20), allowing any network-adjacent attacker positioned on the path between the epa4all service and its healthcare backends to intercept and modify sensitive traffic using a self-signed certificate. For Konnektor and IDP connections, this exposes smartcard PIN operations and OIDC authentication exchanges in plaintext; for the ePA Aktensystem backend, the absent transport-layer verification directly enables the chained VAU-protocol MITM attack documented in the related advisory GHSA-vvh7-x6c7-46gh. No public exploit has been identified and no KEV listing exists; the vendor released a fix in the 2026-05-20 tag.
Privilege escalation in the Wpify Woo WordPress plugin (versions ≤ 5.4.16) lets authenticated Shop Manager users overwrite arbitrary WordPress options and promote themselves to Administrator. The vulnerable SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) forwards attacker-controlled 'option' and 'data' values straight into update_option() with no allowlist or sanitization, gated only by the manage_woocommerce capability. Reported by Wordfence with a CVSS of 8.0; no public exploit identified at time of analysis and not listed in CISA KEV.