GNU tar's incremental restore path contains a TOCTOU race condition in dumpdir 'X' rename handling, allowing a local attacker with write access to a backed-up directory to redirect file operations outside the intended extraction root during a privileged restore. Successful exploitation can result in arbitrary file creation, rename, or overwrite - enabling privilege escalation on systems running Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images. No public exploit is identified at time of analysis, and no CISA KEV listing exists; the CVSS score of 4.4 reflects the constrained attack prerequisites including a required race window and administrator-initiated restore.
Incomplete cleanup of cached print job data in Sharp and Toshiba Tec multifunction printers exposes previously printed documents to subsequent physical users of the same device. Affecting all versions per CPE data (cpe:2.3:a:sharp_corporation:sharp_mfps and cpe:2.3:a:toshiba_tec_corporation:toshiba_tec_mfps), the flaw (CWE-459) means internal caches are not wiped after a print job completes, allowing the next person who physically accesses the device to potentially retrieve another user's data. No public exploit code exists and the vulnerability has not been added to CISA KEV, consistent with the low CVSS score of 2.4 and a physical-access attack vector.
Authorization bypass in Apache NiFi 2.0.0-2.10.0 allows authenticated users holding write access to one Parameter Context to delete Assets belonging to a separate, restricted Parameter Context they are not authorized to modify. The REST API's asset deletion endpoint validated permissions against the caller-supplied Parameter Context Identifier without confirming that the targeted Asset Identifier is actually recorded as belonging to that context - a broken object-level authorization (BOLA/IDOR) flaw. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog; impact is confined to multi-tenant NiFi deployments with differentiated per-context authorization policies.
Insufficient permission checks in Misskey's Direct Messages (Chat) feature expose DM data points to authenticated users who lack authorization to access them, across versions 2025.3.2 through 2026.5.3. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), where the server fails to validate account permissions before returning DM-related data via API. No public exploit or CISA KEV listing exists; the vendor patched this in version 2026.5.4 alongside four additional CVEs.
OS command injection in the Wavlink WL-NU516U1 router's admin password handler allows a remote, low-privileged authenticated attacker to execute arbitrary operating system commands via the set_sys_adm function in adm.cgi. The affected firmware version is 708c073-mt7628, and a public proof-of-concept exploit has been disclosed on GitHub. No CISA KEV listing exists, but the vendor has responded promptly and released a patched firmware dated 2026-07-13.
Path traversal in danpros HTMLy up to version 3.1.1 enables remote authenticated attackers to delete arbitrary files via the Delete Username endpoint. The PHP `unlink()` function in `/system/htmly.php` accepts a user-controlled `File` argument without path sanitization, allowing traversal outside the intended directory. A public proof-of-concept exploit exists (CVSS 4.0 E:P); no vendor patch is available as the vendor was unresponsive to disclosure, leaving installations permanently exposed without manual mitigation.