SQL injection in PROCON-WEB SCADA's GetGridData endpoint allows remote unauthenticated attackers to execute arbitrary SQL commands, compromising the SCADA system's confidentiality, integrity, and availability. No evidence of active exploitation or public exploit code was found at time of analysis, but the vulnerability's network-accessible, low-complexity nature makes exploitation trivial once exposed.
We are instructed to synthesize data from multiple intelligence sources into a comprehensive analysis, returning a JSON object with specific fields. We must use all provided data, cross-reference, and produce original synthesis. Every field must be a plain text string, not arrays or objects. Let's extract the relevant information: - CVE ID: CVE-2026-67174 - Description: DOM-based XSS in Pivotick's generic UI element resolution and icon-rendering utilities. The `tryResolveHTMLElement` function treated resolved strings as HTML markup via `innerHTML`, allowing untrusted data to inject arbitrary HTML/SVG. Used by headers, property panels, extra panels, tooltips. `createIcon` inserted unsanitized `svgIcon` markup. Attack vector: unauthenticated attacker can provide crafted graph, property value, rendering result, or SVG icon to execute JS in another user's browser when content is displayed/interacted with. Impact: access victim's info, manipulate graph data/state, perform actions with victim's privileges. - CVSS Score: 9.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N). Note: It says UI:N but description involves user interaction (displayed/interacted with). CVSS 4.0 has UI:N meaning no user interaction? Actually in CVSS 4.0, UI (User Interaction) measures whether the vulnerability can be exploited solely at the initiative of the attacker, or whether a separate user must perform some action. Here UI:N suggests exploitation requires no user interaction beyond the attacker sending a malicious payload and the victim simply viewing the page. However, the description says "when the affected content is displayed or interacted with" — this could be interpreted as the victim viewing the page, which is passive and counts as UI:N in CVSS 3.1 (R) but in CVSS 4.0 UI:N is for no user interaction at all? I need to check: In CVSS 4.0, UI:N means the vulnerability can be exploited without any action from any user other than the attacker. If the victim just views a p
Privilege escalation in pglogical allows a publisher to execute functions as superuser on the subscriber by exploiting default expression evaluation during replication of rows with missing columns. This affects deployments where non-superuser roles are permitted to create subscriptions, such as managed PostgreSQL services. No public exploit is known, and the path is distinct from CVE-2026-50736.
SQL injection in pglogical's queue mechanism allows a publisher to execute arbitrary SQL as superuser on the subscriber, potentially breaking tenant isolation in shared deployments. An attacker who can direct a PostgreSQL subscription to an endpoint they control sends crafted DDL queue messages that the subscriber’s apply worker executes without sanitization, escalating from a role permitted to use pglogical to full superuser. Exploitation requires non-default delegation of subscription creation in managed environments, as default installations restrict this to superusers.
Authorization bypass in HashiCorp's terraform-mcp-server (versions 0.3.0 through 1.0.x) lets an attacker who obtains another user's MCP session identifier execute their own tool calls under the victim's Terraform credentials when the server runs in streamable-HTTP stateful transport mode. Rooted in a session fixation weakness (CWE-384), the flaw carries a CVSS 8.9 with a scope change, meaning cross-user credential misuse against managed infrastructure. No public exploit identified at time of analysis; EPSS is low (0.27%) and CISA SSVC records exploitation as none, indicating no observed active exploitation.
Unauthenticated remote attackers can extract sensitive information from the igloohome Smart Lock Mobile App source code to bypass authentication and access backend services. This affects version 3.2.3 and earlier, with a CVSS score of 5.3 (medium) and no known exploits or active exploitation.
Code injection in datamodel-code-generator 0.17.0–0.60.1 allows attackers who control a schema’s default_factory value to inject arbitrary Python expressions into generated models, achieving remote code execution when the target imports the poisoned module. The vulnerability affects all supported input types (JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, XSD) and output model types (Pydantic v2, dataclass, msgspec). Public exploit code exists; the issue is fixed in version 0.60.2.
We need to produce a comprehensive analysis in JSON format for CVE-2026-17524. The provided data includes description, CVSS, CWE, patch status, CPE, tags, references, EUVD info, and source code diff. We'll synthesize these into the required fields. Let's analyze: - CVE ID: CVE-2026-17524 - Description: Versions of zip-lib before 1.1.0 vulnerable to Directory Traversal via caching mechanism for path validation during extraction. Attacker can bypass security checks (isOutsideTargetFolder) that only checks and caches path status when initial directory symlink is created during first extraction. - CVSS Score: 8.7 (CVSS 4.0 vector given) - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - Patch: Available from vendor (references point to GitHub commit fixing issue) - Reported by: snyk - CPE: cpe:2.3:a:n/a:zip-lib:*:*:*:*:*:*:*:* (note: vendor is "n/a", product is "zip-lib") - Tags: Path Traversal, Zip Lib - ENISA EUVD ID: EUVD-2026-49687, affected versions: zip-lib 0 <1.1.0 - References: snyk advisory, GitHub commit, GitHub issue #14 - Source code evidence: Commit diff shows changes in fs.ts and unzip.ts. The fix involves ensuring folder creation returns symbolic link info and tracks symlink folders in EntryContext; the isOutsideTargetFolder function now checks symlinkFolders. This confirms the vulnerability and the fix. Now, for fields: product_name: "zip-lib" (the specific npm package). Short, 1-3 words. Could also be "zip-lib (npm)" but product_name should be plain "zip-lib". summary: Need 2-3 sentences, original synthesis, not copied. Start with impact verb and product: "Directory traversal in zip-lib before 1.1.0 allows attackers to write files outside the intended extraction directory by exploiting a flawed caching mechanism that only validates symlink paths during initial directory creation." Mention affected product, what attacker can do, exploitation status (no KEV, no POC known? Actually no POC info in provided data;
Missing authorization in the insert path of an unspecified product's configuration table enables a low-privileged remote attacker to gain administrator privileges, leading to full system access. The specific affected product and version are not disclosed in the limited advisory information; no data on active exploitation or patch availability is provided.
Privilege escalation in the WP Password Policy plugin for WordPress up to version 3.7.1 allows authenticated attackers with subscriber-level access to escalate to Administrator by submitting a crafted POST request to the password-reset form endpoint. The vulnerability results from missing authorization checks and nonce verification in the `get_user()` function of the `Module_Password_Hint` class, which unconditionally calls `set_role()` with an attacker-supplied role. At time of analysis, no active exploitation or public exploit code was identified.
Heap-based buffer overflow in the schreibfaul1 ESP32-audioI2S library (version 3.4.5) exposes ESP32-based audio devices to remote code execution when they parse malicious HTML entities in streamed content. The flawed htmlToUTF8() decoder rearranges string data with memmove/memcpy without checking remaining buffer space, so an attacker who controls the HTML the device fetches (e.g. a web-radio stream or its metadata) can force an out-of-bounds heap write leading to code execution, memory disclosure, or a crash. Publicly available exploit code exists per the CISA SSVC 'poc' status, but the flaw is not listed in CISA KEV and carries a low EPSS score of 0.27% (19th percentile), indicating no evidence of widespread active exploitation yet.
Unauthenticated configuration manipulation and information disclosure in Arris BGW210‑700 gateways running firmware 2.7.7 and earlier arises because the server fails to enforce authentication on /cgi-bin/*.ha management endpoints, relying only on client‑side JavaScript gating. Any LAN‑adjacent attacker can read sensitive configuration data, modify persistent device settings, or invoke diagnostic operations. No active exploitation or public proof‑of‑concept is known, but the missing server‑side checks make exploitation trivial once network adjacency is gained.
Missing authentication in Universal Software Inc. UKBS through version 28072026 allows adjacent network attackers to access restricted critical functionality without credentials, resulting in complete compromise of confidentiality, integrity, and availability. The vendor has confirmed the product is no longer supported, leaving all installations permanently vulnerable. No active exploitation or public exploit code has been reported.
Privilege escalation in IBM OpenBMC firmware allows any authenticated ReadOnly user to grant themselves full administrator access over the BMC interface on affected IBM Power Systems servers. The flaw spans two firmware release trains - FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 - across more than a dozen IBM Power9 and Power10 server models. No public exploit code or active exploitation has been identified; EPSS is 0.17% (7th percentile) and SSVC classifies exploitation as none, but the consequence of BMC administrator access is severe given the out-of-band control it provides over physical infrastructure.
Authenticated OS command injection in ELECOM WAB series routers and access points allows authenticated attackers to execute arbitrary OS commands via the Restore Settings function. Full device compromise is possible, but no active exploitation or public exploit code is known at this time. The vulnerability is rated high severity (CVSS 8.6) but requires administrative credentials to exploit.
Authenticated OS command injection in ELECOM wireless LAN routers and access points allows an attacker with administrative credentials to execute arbitrary operating system commands on the device. Exploitation requires logging into the product's WebUI; no public exploit or active exploitation has been reported at this time. The vulnerability is confirmed by the vendor and JPCERT/CC, with a CVSS 4.0 score of 8.6 (High).
Privilege escalation in Xen hypervisor due to lock acquisition unfairness in platform operations allows authenticated control-domain users to bypass XSM/Flask permission checks. An attacker with low-privileged authenticated access can exploit the race condition to execute privileged operations, potentially gaining full control of the system. The vulnerability carries a CVSS 8.8 rating but has no known active exploitation or public exploit code.
We need to produce a JSON object with all the fields described. The CVE is CVE-2026-62426, affecting Xen hypervisor (based on description and references). The provided data: description, CVSS vector 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), CWE-412, Tags (Python, Information Disclosure - might be noise? Xen isn't Python), SSVC says exploitation none, automatable no, impact total. ENISA EUVD. References: xenbits advisory, nvd, oss-security. I'll extract info. Key points: - The description: Xen hypervisor uses system-wide locks for sysctl and platform ops. The lock acquire lacks fairness, and with XSM/Flask, lock is acquired before permission checking, leading to potential denial-of-service or possibly privilege escalation? The CVE-2026-62426 is specifically the sysctl issue. CVSS indicates high impact to CIA, PR:L (low privileges needed), AV:N, so attacker with low privileges (maybe a guest user? Xen sysctl is from dom0 or management toolstack) can exploit to gain high impact. But the description mentions locks and fairness; this sounds like a locking flaw that could allow a local attacker to cause denial of service or perhaps escalation. CWE-412 is "Unrestricted Externally Accessible Lock", which fits. But the CVSS says AV:N? That's network vector. How is sysctl accessed? In Xen, sysctl is a hypercall interface typically available to Dom0, the control domain, which is a privileged VM. So the attack vector might be from a compromised Dom0 or a guest with access? Actually, sysctl is accessible from dom0 kernel or toolstack, not directly from network. However, the CVSS says AV:N, which may be misassigned. Possibly the vulnerability allows a remote authenticated user with low privileges (like a management network user) to trigger the lock contention and cause DoS or something else? But C/I/A are all H, so complete compromise. That seems odd for a locking unfairness bug. Let's read the advisory from xenbits (reference). Since I don't have the actual content, I'll inf
We are tasked with synthesizing data about CVE-2026-14328 into a comprehensive analysis. The user provided a description, CVSS, CWE, tags, references, and multi-source intelligence note. Our output must be a JSON object with specific fields. Let's go step by step. First, I need to extract product name. The CVE is about "Eazy Plugin Manager - Powerful Plugin Management Solution for WordPress plugin for WordPress". That's a complex name. The product_name should be 1-3 words, specific. The plugin is called "Eazy Plugin Manager" (maybe the slug is "plugins-on-steroids"? from references, the plugin folder is "plugins-on-steroids", but the description says "Eazy Plugin Manager - Powerful Plugin Management Solution for WordPress". So the product is the Eazy Plugin Manager WordPress plugin. I'll use "Eazy Plugin Manager" as the product name. Confirm: references show paths like "plugins.trac.wordpress.org/browser/plugins-on-steroids/tags/4.4.1/...", so the plugin slug is "plugins-on-steroids" but the marketed name is "Eazy Plugin Manager". For product_name, use "Eazy Plugin Manager" (or "Eazy Plugin Manager for WordPress"? The requirement says 1-3 words, so likely "Eazy Plugin Manager". I'll use "Eazy Plugin Manager". Summary: Must not copy description, but original synthesis. Include impact, affected product, attacker capabilities. Mention if actively exploited, POC, EPSS. Input doesn't have KEV status or EPSS score explicitly. The user didn't provide EPSS or KEV. The description says "authenticated attackers, with Subscriber-level access and above". That's PR:L per CVSS vector (PR:L). So it requires a low-privileged user. No mention of exploitation in the wild, no KEV. POC? Not explicitly, but maybe from Wordfence advisory they might have details. The references are code links and the Wordfence threat intel page. I can't assume POC exists unless stated. The input just says "Tags: WordPress, Privilege Escalation". So I'll state "no public exploit identified at time of ana
Heap-based buffer overflow in ESP32-audioI2S 3.4.5’s ID3v2 APIC frame parser lets remote attackers execute arbitrary code or crash vulnerable devices by supplying a crafted MP3 file. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed.
Heap-based buffer overflow in the connecttospeech() function of schreibfaul1 ESP32-audioI2S version 3.4.5 allows remote attackers to achieve arbitrary code execution by supplying an overly long speech text string. The flaw arises because the library performs URL encoding of attacker-controlled input and appends it to a fixed-size heap buffer without length validation, leading to a heap overflow. A public proof-of-concept exploit is available, but active exploitation has not been confirmed.
Heap-based buffer overflow in ESP32-audioI2S 3.4.5 allows remote attackers to cause denial of service, information disclosure, or arbitrary code execution via a crafted MP3 file. Public exploit code is available but no active exploitation is confirmed.
SuperPlane before 0.27.0 allows authenticated viewers to bypass organization scoping via the CanvasService gRPC handler, accessing and manipulating resources across tenants without authorization. Attackers can read execution histories and event payloads containing secrets, inject queue items or canvas events, and delete canvases in other organizations. No public exploit is known and it is not reported in the CISA KEV catalog at this time.
We need to produce a JSON analysis for CVE-2026-59248 based on the provided data. The input includes a description, CVSS 4.0 vector, CWE, tags, references, and source code evidence. We'll extract information accordingly. The CVE ID is CVE-2026-59248. Product: cowlib (but description says "ninenines cowlib", actually "cowlib" is the library name by ninenines). The product name should be the specific product affected: cowlib. So product_name: "cowlib". Could also be "cowlib HTTP parser". Keep short, 1-3 words. "cowlib" works. Summary: Original synthesis. Mention that HPACK/QPACK integer decoding in cowlib lacks limits, allowing remote unauthenticated attacker to exhaust memory via HTTP/2 or HTTP/3, causing DoS. Impact: memory exhaustion, Erlang VM crash. Mention if actively exploited? No KEV data, no POC explicitly stated, but the description suggests it's easy to trigger. EPSS not provided (none given). So we can say "no public exploit identified". Need to note EPSS unknown. Since EPSS not in data, we can't assess its probability. But we can say EPSS data not available. So summary: "Memory exhaustion in ninenines cowlib 2.0.0 before 2.19.0 allows remote unauthenticated HTTP/2 or HTTP/3 attackers to exhaust server memory and cause denial of service via crafted HPACK/QPACK integers." That's a concise summary. Technical context: Explain underlying tech: HPACK (HTTP/2 header compression) and QPACK (HTTP/3), integer decoding with variable-length encoding using prefixed integers. Erlang's immutable integers cause bignum allocations with growing size, quadratic memory allocation from many continuation octets. CWE-770: Allocation of Resources Without Limits. Affects cowlib, used by Cowboy, RabbitMQ management plugin, etc. Give context. Risk assessment: CVSS 4.0: 8.7, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H (VA:H implies high availability impact on vulnerable system). No EPSS score. No KEV. No POC? At least not in provided data; but the commit adds a test that triggers it
Inadequate authorization
HTTP response smuggling in IBM WebSphere Application Server 9.0, 8.5, and Liberty versions 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to poison intermediate caching proxies by exploiting improper handling of non-standard HTTP version tokens. Successful exploitation leads to high confidentiality and integrity impact through cache poisoning, potentially enabling information disclosure and malicious content injection into proxied responses. A vendor patch is available, though no public exploit code or active exploitation has been reported at this time.
HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.7 allows remote attackers to poison request queues, potentially leading to unauthorized information disclosure and cache poisoning. The flaw stems from improper handling of TRACE requests, with a CVSS base score of 8.7 but no evidence of active exploitation or public exploit code at the time of analysis.
Privilege escalation in Anchore Enterprise's user management API allows authenticated attackers to modify user permissions, granting write access to read-only users. Versions 5.11.0 through 5.27.1 and 6.0.0 are affected; patches are available in 5.27.2 and 6.0.1. No public exploit or active exploitation has been reported.
Server-side request forgery in HashiCorp terraform-mcp-server before 1.1.0 allows unauthenticated remote attackers to redirect Terraform API requests and steal server-side authorization tokens via the streamable-HTTP transport. The vulnerability, tracked as CVE-2026-14869, permits an attacker to control the destination of outbound requests, leading to token exposure. No public exploit or active exploitation has been reported at this time.
We need to produce a JSON object according to the detailed instructions. The CVE is CVE-2026-18084, BlackBerry UEM Management Console, XSS, CVSS 4.0 given, CVSS 3.1 not provided, we need to independently assess CVSS 3.1 and 4.0 vectors, prevalence, etc. First, extract from input: - product_name: "BlackBerry UEM" (precisely "UEM" or "BlackBerry UEM Management Console" but description says "BlackBerry UEM Management Console of BlackBerry UEM" so product is BlackBerry UEM, specific component Management Console). We need 1-3 words, so "BlackBerry UEM" is fine. - summary: must synthesize from multiple sources. Description: Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console allows Cross-Site Scripting (XSS). Affects UEM: 12.23.0 QF8 or earlier. CVSS 4.0: 8.6, vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N. CWE-79. Tags: XSS, Uem. Reported by blackberry. CPE: cpe:2.3:a:blackberry:uem:*:*:*:*:*:*:*:* References: https://support.blackberry.com/pkb/s/article/141208. No KEV, POC status unknown. So we need to write summary: start with specific impact and product. "Cross-site scripting in BlackBerry UEM Management Console (versions 12.23.0 QF8 and earlier) allows..." Actually, XSS impact: an attacker can inject malicious scripts into the web console that execute in users' browsers. Potential impact: stealing session cookies, performing actions as victim, etc. But the CVSS 4.0 VC:H/VI:H/VA:H suggests high impact to vulnerable system (confidentiality, integrity, availability), and SC:L/SI:L suggests low subsequent impact. So it's a stored or reflected XSS with high impact on management console itself. So summary: "Cross-site scripting in BlackBerry UEM Management Console (versions 12.23.0 QF8 and earlier) allows an unauthenticated attacker to inject malicious scripts via crafted input, potentially leading to unauthorized actions, data theft, or system compromise on the UEM server." Need to mention 'activel
Arbitrary command execution in WordPress Coding Standards (WordPressCS) before 3.4.1 lets attacker-controlled PHP source trigger code execution on the machine running the linter. The flawed WordPress.WP.EnqueuedResourceParameters sniff reconstructed the $ver argument of wp_enqueue_script()/wp_register_script() and passed it to eval(), so scanning a malicious file (for example a pull request in CI) with the WordPress or WordPress-Extra rulesets runs the attacker's payload. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but the technical impact is total and a patched release (3.4.1) is available.
We need to produce a JSON object with multiple fields. Let's analyze the input. CVE ID: CVE-2026-48388 Description: Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the installer. Exploitation of this issue required user interaction in that a victim must have been running the installer. Scope is changed. CVSS Score: 8.6 CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CWE: CWE-427 Multi-source: Reported by Adobe. CPE: cpe:2.3:a:adobe:adobe_photoshop_installer:*:*:*:*:*:*:*:* (all versions?). Tags: Adobe, RCE, Adobe Photoshop Installer. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. ENISA EUVD ID. Affected versions from EUVD: ["Adobe Photoshop Installer 0 ≤N/A"] - weird, maybe that's not precise. References: cveorg link (None?) and euvd advisory NVD link. Now, we must fill out all fields. No arrays, no nested JSON, plain text strings. product_name: 1-3 words ONLY. Affected product is "Adobe Photoshop Installer". So "Adobe Photoshop Installer". That's 3 words. Could also be just "Photoshop Installer" but better to include "Adobe". I'll output "Adobe Photoshop Installer". summary: 2-3 sentence plain-language synthesis. Not copying description. Should start with specific impact and product, e.g., "Arbitrary code execution in Adobe Photoshop Installer allows..." but careful: it's the installer, not Photoshop itself. The vulnerability is uncontrolled search path element (DLL hijacking). The attacker places a malicious library in a directory searched by the installer, and when the victim runs the installer, arbitrary code executes in the current user context. User interaction required. Use all data: SSVC says not exploited (none), not automatable, total impact. EPSS? None provided. KEV? Not mentioned.
Arbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerability. A local attacker can craft a malicious file that, when opened by a victim, causes Bridge to load and execute a malicious DLL from an attacker-controlled location, leading to full system compromise in the context of the current user. No active exploitation or public exploit code is known at time of analysis, and EPSS data is not available.
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows an attacker to bypass security constraints and run code with the current user's privileges. No active exploitation or public proof-of-concept has been reported, but the vulnerability carries a high CVSS score due to scope change and full system impact.
Identity header smuggling in OpenShift Container Platform 4.x allows authenticated low-privilege users to escalate privileges by injecting forged identity headers that upstream applications may trust. The oauth-proxy fails to strip underscore-variant headers, enabling WSGI and PHP frameworks to normalize them into the legitimate identity, potentially overriding the true authenticated user. No known active exploitation or public exploit code has been identified.
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitrary code." CVSS Score 8.3 (but note vector is CVSS:4.0, not 3.1, although score provided as 8.3, which is moderate? Actually CVSS 4.0 base score 8.3 is high, not critical). Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N. CWE N/A. Multi-source: Reported by SamsungMobile, CPE: cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:* (no version bound). Tags: RCE, Buffer Overflow, Samsung Mobile Devices. References: [cveorg] (None) https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=07. No KEV status mentioned, no EPSS, no POC availability in input. So exploitation status: "no public exploit identified at time of analysis". No patch version explicitly given except "prior to SMR Jul-2026 Release 1", which implies fix in that release. So patch status: "Vendor-released patch: SMR Jul-2026 Release 1". However, we need to check if the patch version is exact. The description says "prior to SMR Jul-2026 Release 1", meaning the fix is in that release. So we can state the patched version is "SMR Jul-2026 Release 1". But we need to be precise: "SMR Jul-2026 Release 1" is a version string for Samsung Mobile devices security maintenance release. So remediation: upgrade to SMR Jul-2026 Release 1. No workarounds mentioned. No EPSS, so risk assessment must note the CVSS 4.0 vector but we need to produce an assessed CVSS 3.1 vector as well? The output includes "assessed_cvss_vector" (3.1) and "assessed_cvss40_vector". I need to independently assess the vulnerability based on description and conditions. The description: Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitrary code. The CVSS 4.0 provided: AV:N, AC:L, AT:P, PR:N, UI:N, VC:N
Denial of service in rouille 0.1.6 through 3.6.2 allows remote unauthenticated attackers to crash the server
Cross-site scripting in Pivotick via the per-node style.svgIcon property allows an attacker who can influence graph data to execute arbitrary JavaScript in the context of the embedding application. Affects Pivotick versions up to 1.4.0. No active exploitation or public exploit reported at time of analysis, but the CVSS 4.0 base score is 8.2.
Uncontrolled recursion in Pivotick's graph traversal and JSON viewer allows remote attackers to crash the user's browser tab by supplying crafted graph data with long paths, deep nesting, or circular references. No confidentiality or integrity impact exists - only client-side denial of service. A patch replaces recursive algorithms with iterative implementations and adds depth/cycle guards.
Silent traffic redirection in Appium Java Client 8.2.1 to 10.1.0 allows an unauthenticated rogue Appium server to redirect all session commands to an attacker-controlled endpoint when directConnect is enabled. The client does not validate the destination host, enabling network pivoting and credential theft. Publicly available exploit code exists, and a vendor-released patch (version 10.1.1) is available.
Improper session expiration in IBM Aspera Faspex 5 allows remote unauthenticated attackers to access sensitive data. The vulnerability, tracked as CVE-2026-14996, affects versions 5.0.0 through 5.0.15.4 and stems from insufficient session invalidation (CWE-613). Attackers who obtain a valid session token can reuse it after the intended lifetime, compromising confidentiality of file transfer data with limited integrity impact.
We need to produce a JSON object with all fields as plain text strings. We have extensive data: CVE description, CVSS vector 3.1, CWE-918 (SSRF), EPSS not provided but we need to estimate? The prompt says "synthesize data from multiple intelligence sources about a CVE into a comprehensive analysis". The sources include references, EPSS, KEV status, patch availability, CPE strings, and tags. In the provided data, I see no EPSS or KEV. So we should note that EPSS is unknown/missing, KEV status not present. Patch is available: fixed in 0.61.0. CPE is pkg:pip/datamodel-code-generator. Tags: Python, SSRF. We need to produce a JSON object. Let's map each required field. 1. **product_name**: "1-3 words ONLY. The specific product or service name affected." It's a Python package: datamodel-code-generator. So product_name = "datamodel-code-generator". 2. **summary**: "2-3 sentence plain-language summary... Do NOT copy or paraphrase the Description... Start with the specific impact verb and product". So: "Server-side request forgery (SSRF) in datamodel-code-generator allows unauthenticated remote attackers to reach internal services via the --url CLI option, exfiltrating responses into generated Python code. The vulnerability affects versions 0.9.1 through 0.60.2 when the [http] extra is installed, and can be triggered by following redirects to private networks. No public exploit activity is confirmed, but a proof-of-concept exists and the vulnerability has been patched in version 0.61.0." We need to mention EPSS and KEV: none. So "no public exploit identified at time of analysis" (since KEV is not true). But we have PoC, so "publicly available exploit code exists". The summary should incorporate that. 3. **technical_context**: Explain underlying technology, CWE-918 (SSRF), how httpx is used, http.get_body implementation, etc. Include CPE data: pip/datamodel-code-generator. Mention that the vulnerability arises from insufficient validation of URLs in the HTTP fetcher, wit
We need to parse the input data and produce a JSON object with the specified fields. The description: "Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed." CVSS 3.1 vector: AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, score 8.2. CWE-426: Untrusted Search Path. Tags: RCE, Adobe Bridge. SSVC: exploitation none, automatable no, technical impact total. Patch: there is no explicit patch data in the input, but references point to Adobe advisory: https://helpx.adobe.com/security/products/bridge/apsb26-89.html. The version ranges affected: "Adobe Bridge 0 ≤16.0.5" and "Adobe Bridge 0 ≤15.1.6" (probably meaning versions up to but not including? The EUVD says "Adobe Bridge 0 ≤16.0.5" and "0 ≤15.1.6" which is ambiguous — likely affected versions up to, but not including? Actually, it says "0 ≤16.0.5" which might indicate versions from 0 up to 16.0.5, so 16.0.5 is affected. But typical phrasing "versions up to and including 16.0.5". The advisory APSB26-89 might have more details. We'll note that affected products are Adobe Bridge versions up to 16.0.5 and 15.1.6, and presumably patch versions are later: 16.0.6 and 15.1.7? But the advisory isn't fully spelled out in input. We'll extract from the EUVD data: "Adobe Bridge 0 \u226416.0.5" means "Adobe Bridge 0 ≤16.0.5". So version 16.0.5 and earlier are affected. The referenced advisory likely states patched version 16.0.6. So remediation: update to version 16.0.6 (or 15.1.7 for 15.x branch). We'll incorporate that. We have no KEV status, so no active exploitation confirmed. No POC mentioned, but no explicit statement, so we'll say no public exploit identified. SSVC exploitation none, automatable no, so not easily automated. EPSS not provided, bu
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim. Affected versions up to 15.1.6 and 16.0.5 are susceptible. Exploitation requires user interaction; a scope change can impact other system components, though no public exploit or active exploitation has been identified at time of analysis.
Authenticated customers of the FluentCart WordPress plugin can manipulate other users' subscriptions by exploiting missing ownership verification in payment-method endpoints. The vulnerability affects versions before 1.4.0 and allows an attacker with low privileges to change payment methods or cancel subscriptions if they know the target subscription identifier. Publicly available exploit code exists, but EPSS probability is low (0.13%) and no active exploitation in CISA KEV has been reported.
Denial of service and information disclosure in NVIDIA DCGM Exporter allows remote unauthenticated attackers to consume server resources and potentially read runtime profiling data. The vulnerability resides in the /debug/pprof endpoints, which lack resource limits, enabling concurrent profiling requests to exhaust CPU and memory. No active exploitation has been observed, but the attack vector is network-accessible without credentials, earning a CVSS 8.2 score.
Privilege escalation in Pterodactyl Wings allows authenticated subusers to upload arbitrary files without the required file.create permission by reusing lower-privilege panel-signed JWTs (e.g., from websocket authentication or file downloads). A public proof-of-concept demonstrates how a subuser with only websocket.connect can upload files to the server, potentially compromising its container. Patches introduce JWT scoping in Panel 1.12.3 and Wings 1.12.2.
Password overwrite and administrative unavailability on an unspecified
SQL injection in IBM Sterling B2B Integrator and File Gateway allows authenticated remote attackers to view, add, modify, or delete database contents. Affects versions 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1. No public exploit or active exploitation (KEV) known at time of analysis.
HTTP request smuggling in IBM WebSphere Application Server (versions 8.5 and 9.0) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) enables remote unauthenticated attackers to poison shared HTTP connections between a front-end proxy and the application server backend. The CVSS 8.1 score reflects full confidentiality, integrity, and availability impact (C:H/I:H/A:H) but is constrained by high attack complexity (AC:H), requiring a specific proxy-to-WAS pipeline configuration to exploit. No public exploit is identified at time of analysis; EPSS is very low at 0.21% (11th percentile) and SSVC confirms no known exploitation, though technical impact is rated total.