Remote command injection in GL.iNet GL-MT3000 router firmware (versions 4.4.0 through 4.4.5) allows unauthenticated network-reachable attackers to execute arbitrary OS commands by supplying a crafted filename argument to the ovpn-client.check_config function exposed via the /cgi-bin/glc CGI endpoint. The vendor confirmed the vulnerability's existence, and a public proof-of-concept exploit is published on GitHub (StrTzz123/iot_vul), materially lowering the bar for exploitation. The CVSS 4.0 score of 8.9 with exploit maturity E:P reflects a high-priority, real-world risk of complete device compromise with no authentication or user interaction required.
Remote command injection in GL-iNet GL-MT3000 firmware through version 4.4.5 allows unauthenticated network attackers to execute arbitrary OS commands via crafted package name input to the plugins.install_package or plugins.remove_package functions exposed through the /cgi-bin/glc CGI endpoint. The CVSS 4.0 vector confirms no authentication, no complexity barriers, and full confidentiality, integrity, and availability impact on the vulnerable system. A public proof-of-concept exploit is available on GitHub, no public exploit identified in CISA KEV at time of analysis, but the combination of unauthenticated network access and live exploit code makes this a high-urgency issue for any deployment with an internet-exposed management interface.
Command injection in GL.iNet GL-MT3000 firmware up to version 4.4.5 exposes the device to full remote compromise through its modem management CGI endpoint. The vulnerable remove_profile function within modem.so accepts unsanitized input via /cgi-bin/glc, enabling arbitrary OS command execution without authentication. A public proof-of-concept exploit is hosted on GitHub, materially lowering the barrier for opportunistic exploitation; no vendor-released patch has been confirmed at time of analysis.
Unauthenticated remote command injection in GL-iNet GL-MT3000 firmware (versions 4.4.0 through 4.4.5) allows network-adjacent or remote attackers to execute arbitrary OS commands by sending a crafted request to the /cgi-bin/glc CGI endpoint with a manipulated port argument passed to the s2s.enable_echo_server function. The vendor has confirmed the vulnerability, the CVSS 4.0 base score is 8.9 with full high-impact ratings across confidentiality, integrity, and availability, and a public proof-of-concept exploit is available on GitHub, materially lowering the exploitation bar. No public CISA KEV listing exists at time of analysis, but the combination of unauthenticated network access and a published PoC makes active exploitation a near-term realistic risk.
Command injection in GL.iNet GL-MT3000 firmware up to version 4.4.5 allows remote attackers to execute arbitrary OS commands through the `set_upgrade` function exposed via the `/cgi-bin/glc` CGI endpoint in `modem.so`. The CVSS 4.0 base score of 8.9 (with E:P reflecting public exploit availability) reflects high confidentiality, integrity, and availability impact on the affected device. A public proof-of-concept exploit has been disclosed on GitHub and the vendor has confirmed the vulnerability's existence, making this an active remediation priority for any network exposing the GL-MT3000 management interface.
Remote command injection in GL-iNet GL-MT3000 firmware (up to version 4.4.5) allows unauthenticated network attackers to execute arbitrary OS commands on the device by supplying a malicious public_key argument to the server.set_peer function exposed via the /cgi-bin/glc CGI endpoint of the WireGuard server native plugin (wg-server.so). The vendor has confirmed the vulnerability following coordinated disclosure, and a public proof-of-concept exploit is available on GitHub, materially lowering the barrier to exploitation. No publicly confirmed KEV-listed active exploitation is identified at time of analysis, though the combination of unauthenticated network access, high-impact command execution, and available POC makes this an urgent remediation priority for any deployment.
Remote command injection in the GL-iNet GL-MT3000 travel router (firmware 4.4.0-4.4.5) allows unauthenticated network-adjacent or internet-exposed attackers to execute arbitrary OS commands by supplying a maliciously crafted `private_key` argument to the WireGuard server public key generation endpoint at `/cgi-bin/glc`. The vendor has confirmed the vulnerability, and a public proof-of-concept exploit is available on GitHub, significantly lowering the barrier to exploitation. No active exploitation has been confirmed by CISA KEV, but the combination of PR:N attack profile and public POC warrants urgent remediation on any internet-exposed device.
Remote command injection in GL.iNet GL-MT3000 routers (firmware 4.4.0-4.4.5) allows unauthenticated network attackers to execute arbitrary OS commands by supplying crafted shell metacharacters in the Hostname argument to the ovpn-client.get_recommend_config function exposed via the /cgi-bin/glc CGI endpoint. The vendor has confirmed the vulnerability's existence, and a public proof-of-concept exploit is hosted on GitHub, materially lowering the exploitation barrier. No public exploit identified as confirmed actively exploited (CISA KEV) at time of analysis, but the PR:N/UI:N posture combined with a live PoC makes opportunistic exploitation against internet-exposed travel routers a credible near-term risk.
Injection vulnerability in GL-iNet GL-MT3000 (Beryl AX) firmware through version 4.4.5 exposes the plugins.set_config function via /cgi-bin/glc to remote exploitation with no authentication or user interaction required per the CVSS 4.0 vector. Successful exploitation yields high confidentiality, integrity, and availability impact on the device, consistent with OS command or argument injection against the native plugin handler. A proof-of-concept exploit is publicly available on GitHub and the vendor has confirmed the vulnerability, though no patch has been released at time of analysis.
OS command injection in ClearOS 7.9's Log Viewer component allows authenticated attackers to execute arbitrary commands as the webconfig user and immediately escalate to full root access via default NOPASSWD sudo privileges. The vulnerable parameter (`filter`) in `File.php` is interpolated directly into a shell command without sanitization, making exploitation trivial once credentials are obtained. A public proof-of-concept exploit is available via lazytitan.ro and documented by VulnCheck; no CISA KEV listing is present, so confirmed widespread active exploitation has not been established at time of analysis.
OS command injection in Telenia Software TVox allows authenticated high-privilege attackers to execute arbitrary operating system commands via the unsanitized `pid` parameter in `action_audio.php`. Affected deployments span TVox 26.x through 26.5.3 and 24.x through 24.9.21, running on an Apache/PHP stack where successful exploitation yields command execution as the `apache` system user. A publicly available proof-of-concept exploit exists (KarmaInSecurity KIS-2026-15, confirmed by VulnCheck), though no CISA KEV listing is present, indicating active exploitation is not yet confirmed at scale.
HttpTransferCache key collision in Angular's Server-Side Rendering subsystem enables cache poisoning by exploiting identical serialization of scalar comma-separated query parameters and semantically distinct repeated query parameters against the same endpoint. Angular SSR applications using client-side hydration across versions 20.x, 21.x, and 22.x - and 19.x with no available patch - are at risk of having security-sensitive HttpClient responses silently replaced by earlier attacker-influenced cached responses, bypassing trusted backend authorization calls entirely. Vendor patches 22.0.2, 21.2.19, and 20.3.27 are confirmed available; no public exploit code and no CISA KEV listing exist at time of analysis.
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the entire database, including credential hashes, CRM records, and application configuration data. The flaw exists in LeadDataGrid.php where the rotten_lead[in] query parameter is unsafely concatenated directly into a Laravel havingRaw() call without parameterized binding, enabling time-based and boolean-based blind injection. A public exploit writeup is available (jivasecurity.com), and the vendor has released a confirmed fix in v2.2.4; no CISA KEV listing at time of analysis, but the low exploitation barrier for any authenticated user makes this an urgent upgrade priority.
Certificate path building in python-cryptography before 49.0.0 is exploitable as a denial-of-service vector by attackers who can supply crafted X.509 chains containing duplicate self-signed intermediate certificates. The Rust-based `build_chain_inner` function explores issuer candidates recursively without deduplicating previously analyzed entries, causing computational work to grow exponentially with the number of duplicates present - empirically exceeding 5 seconds per rejection in testing. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the fix shipped in 49.0.0 bounds path-building via a global signature-check budget.
Code injection in WebsiteBaker CMS before 2.13.10 allows an authenticated administrator to plant a PHP webshell that is subsequently exploitable by unauthenticated remote attackers. The Droplets editor's save_droplet handler writes the Code field verbatim - without any content sanitization - to a publicly accessible PHP file inside the modules directory. Once an admin submits malicious PHP, any unauthenticated user can trigger full remote code execution by issuing a direct HTTP request to the predictable file path. A public proof-of-concept exploit exists; no CISA KEV listing at time of analysis.
WebsiteBaker CMS before 2.13.10 exposes remote code execution through an unrestricted file upload flaw (CWE-434) in its module installation feature, allowing authenticated administrators to plant a PHP webshell that any unauthenticated internet user can subsequently trigger via direct HTTP request. The CVSS 4.0 vector scores 8.6 with PR:H, reflecting the administrator credential requirement, but the two-phase attack model means post-upload exploitation requires zero authentication. A public proof-of-concept has been published on Medium; the vulnerability is not currently listed in the CISA KEV catalog.
OpenEMR through 8.2.0 exposes an OAuth2 password grant pathway that fully bypasses multi-factor authentication for any user with valid credentials, because the unauthenticated dynamic client registration endpoint allows an attacker to mint a first-party OAuth2 client and exchange legitimate credentials for an API access token without triggering the MFA challenge enforced on the normal web login interface. Any organization using OpenEMR's MFA controls to protect sensitive patient health information (PHI) is exposed: the control is structurally bypassed at the OAuth2 layer regardless of how MFA is configured in the web UI. A detailed public proof-of-concept writeup from JivaSecurity documents the full exploit flow, confirmed by VulnCheck advisory; no KEV listing has been observed at time of analysis.
SQL injection and arbitrary file write in OpenEMR through 8.2.0 expose the full application database to compromise by any user holding admin or super ACL privileges. The backup configuration import feature at backup.php passes uploaded SQL files directly to a shell_exec invocation of the mysql binary without sanitization, enabling unrestricted DDL and DML execution including credential hash extraction, ACL table manipulation, backdoor account injection, and - under permissive MySQL FILE privilege settings - webshell deployment to the filesystem. A publicly available proof-of-concept exists per VulnCheck and a JivaSecurity exploit writeup; no CISA KEV listing is present, so active exploitation is not confirmed, though the low technical barrier post-authentication makes opportunistic insider exploitation realistic.
Unauthenticated OAuth2 dynamic client registration in OpenEMR through 8.2.0 allows any network attacker to self-register a malicious OAuth2 client with system-level FHIR scopes by supplying a self-generated RSA keypair in the jwks field, bypassing all access controls on a critical endpoint. Once an OpenEMR administrator approves the registered client - a step that healthcare staff routinely perform for EHR interoperability integrations - the attacker authenticates via the client_credentials grant using a self-signed JWT and obtains access tokens covering all FHIR resources across every patient in the system. A publicly available proof-of-concept exploit and technical writeup from JivaSecurity confirm the attack chain; this CVE is not currently in CISA KEV but carries an 8.6 CVSS 4.0 score and exposes PHI at scale.
SQL injection in the LogMyTrip WordPress plugin (≤1.9) lets unauthenticated remote attackers extract data from the underlying WordPress database by injecting malicious SQL through an unsanitized cookie value on any page rendering a plugin shortcode. A proof-of-concept is publicly available via WPScan, and the CVSS Scope:Changed rating reflects the injection crossing the application boundary into the database tier. Despite high CVSS (8.6) and a public exploit, EPSS sits at 0.19% (9th percentile) and SSVC records no observed exploitation, suggesting limited real-world targeting consistent with this plugin's niche footprint.
Privilege escalation in Telenia Software TVox allows any process running as the apache OS user to obtain full root-level command execution without a password, by exploiting a misconfigured vendor-supplied sudoers entry in /etc/sudoers.d/telenia that grants NOPASSWD execution of /bin/nice. Affected branches are 26.x up to and including 26.5.3, and 24.x up to and including 24.9.21. A public exploit is available via KarmaInsecurity advisory KIS-2026-16; no CISA KEV listing has been confirmed, though the trivial exploitation complexity and available proof-of-concept materially elevate real-world risk for any environment where the TVox web tier is reachable.
PKCS#7 EnvelopedData decryption in the Python cryptography library (versions 44.0.0-49.x) leaks a Bleichenbacher oracle through four distinguishable error messages and timing side-channels during RSA PKCS#1 v1.5 key unwrapping, exposing the exact recovered plaintext length in one case. An attacker who can submit crafted EnvelopedData to an auto-decrypting service - such as an S/MIME gateway or mail filter that reflects outcomes at high volume - can adaptively recover the content-encryption key and decrypt intercepted messages. No public exploit has been identified at time of analysis, and exploitation requires very specific deployment conditions; the fix in version 50.0.0 applies RFC 3218 indistinguishability by substituting a random key on any failure.
PHP object injection via unsafe deserialization in the ChamaWP WordPress plugin (versions before 1.0.13) enables unauthenticated network attackers to achieve remote code execution, contingent on the presence of a suitable gadget chain within the broader WordPress installation. The CVSS vector (PR:N, UI:N) confirms no authentication or user interaction is required, though the AC:H rating reflects the dependency on exploitable gadget chains from co-installed plugins or libraries. A public proof-of-concept exists per WPScan, with EPSS at 0.22% (13th percentile), indicating low current automated exploitation activity despite code availability - this suggests targeted rather than widespread opportunistic exploitation at time of analysis.
SQL injection in the sm page duplicator WordPress plugin (versions through 1.0.0) allows authenticated users holding the Editor role or above to execute arbitrary SQL against the WordPress database by exploiting an unsanitized stored value consumed during the page duplication workflow. A publicly available exploit exists via WPScan, though EPSS at 0.16% (5th percentile) signals limited observed exploitation activity and the vulnerability is not listed in CISA KEV. The high CVSS score of 8.1 reflects the potential for full database read and write access, tempered in practice by the requirement for a privileged authenticated account.
Command injection in the GL.iNet GL-MT3000 router's Network Lua RPC Plugin allows authenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the `switch` argument of the `network.switch_info` or `network.switch_status` RPC methods. Firmware versions 4.4.0 through 4.4.5 are confirmed affected, with the vendor acknowledging the vulnerability following coordinated disclosure. A public proof-of-concept exploit has been published on GitHub (E:P reflected in the CVSS 4.0 vector), no public exploit identified as confirmed actively exploited (CISA KEV), though the low complexity and available PoC materially lower the bar for exploitation.
Trust-boundary bypass in the ip-address npm library (all versions through 10.3.0) enables SSRF filter evasion in Node.js applications that use Address4 classification methods to block internal destinations. The library decodes leading-zero octets as decimal (e.g., '012' → 12) while system resolvers interpret the same notation as octal (e.g., '012' → 10), causing Address4.isPrivate() and related methods to return false for RFC 1918 addresses expressed in octal shorthand, while the underlying fetch connects to the private host. A functional proof-of-concept is included in the vendor advisory; no CISA KEV listing is present at time of analysis, but exploitation requires no special configuration and rides the ordinary URL-parsing code path.
Remote command injection in GL.iNet GL-MT3000 router firmware (versions 4.4.0-4.4.5) allows an authenticated network attacker to execute arbitrary OS commands by manipulating the `module` argument of the `logread.get_system_log` RPC function in the Logread Lua plugin. The vendor confirmed the vulnerability following coordinated disclosure, and a public proof-of-concept exploit is available on GitHub. No publicly available exploit confirms CISA KEV-level active exploitation at time of analysis, though the combination of a PoC and a widely used consumer router creates meaningful opportunistic risk.
Cross-site scripting in the Angular compiler's i18n pipeline allows arbitrary JavaScript injection into localized application builds when event-handler attributes such as `onerror` or `onclick` are marked for translation using `i18n-on*` template directives. Angular's standard `validateAttribute()` and `validateProperty()` guards block binding to event-handler attributes at runtime, but the `I18nMetaVisitor` code path in `packages/compiler/src/render3/view/i18n/meta.ts` contained no equivalent restriction, enabling a lower-trust translation file to replace a benign handler with executable JavaScript at compile time. Patched versions 22.0.1, 21.2.19, and 20.3.27 are available; no public exploit has been identified at time of analysis.
Command injection in GL.iNet GL-MT3000 firmware versions 4.4.0 through 4.4.5 allows an adjacent, low-privileged attacker to execute arbitrary OS commands by manipulating the `record_size` argument in the `logread.set_config` RPC function of the Logread Lua plugin. A proof-of-concept exploit has been publicly released on GitHub, and the vendor confirmed the vulnerability exists following early disclosure. While not yet listed in CISA KEV, the combination of low attack complexity, public exploit code, and full high-impact confidentiality/integrity/availability compromise makes this a credible and actionable risk for any network where GL-MT3000 devices are deployed.
Remote denial-of-service in the brace-expansion npm library (all active version lines prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9) allows unauthenticated attackers to either crash the Node.js process via an uncatchable out-of-memory error with a ~25 KB crafted input, or stall the event loop for over two minutes with a ~400 KB padded-sequence input. Both attack paths bypass the incomplete mitigation introduced in version 5.0.8 for CVE-2026-14257, meaning applications that already patched that predecessor vulnerability remain fully exposed. Publicly available proof-of-concept code is included in the GitHub security advisory; no CISA KEV listing is present at time of analysis.
Memory exhaustion via malformed binary attachment packets in the socket.io-parser npm library allows unauthenticated remote attackers to crash or hang Socket.IO servers. By sending crafted packets that declare a large number of pending binary attachments, an attacker causes the server's Decoder to allocate and hold buffers indefinitely, exhausting Node.js heap memory. The vendor advisory (GHSA-2m8v-j782-fhvr) confirms the impact and vendor-released fixed versions are available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Wavlink's lighttpd-based web interface allows network-adjacent authenticated attackers to achieve arbitrary code execution on at least thirteen SOHO router and range-extender models running firmware through 20260609. The vulnerable code path is the strcpy call within upload.cgi, which copies the HTTP_COOKIE request header into a fixed-size stack buffer without length validation. Publicly available exploit code exists on GitHub (0xcc12138/WAVLINK-vul); no CISA KEV listing is present, but the disclosed POC materially lowers the exploitation barrier for opportunistic actors targeting consumer networking gear.
Host confusion in GuzzleHttp Guzzle before 7.15.2 and 8.0.1 allows remote attackers who can influence a fetched URI to bypass application-level host validation and reach network hosts the application intended to block, including loopback and internal addresses. The divergence occurs because PHP's filter_var() and Guzzle's own host checks operate on the literal URI text while libcurl independently percent-decodes and IDNA-maps the authority before resolving and connecting, meaning the application and transport disagree on which host is being contacted. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog, but any application that implements SSRF mitigations via URI host inspection before passing a user-supplied URL to Guzzle is directly undermined.
Out-of-bounds heap read in aiohttp's C HTTP response parser (versions ≤ 3.14.2) allows an attacker-controlled server to crash the client application via a malformed chunked HTTP response, causing denial of service. The flaw exists only when the compiled C extension is active - the default installation mode - and is triggered during error-message construction in aiohttp/_http_parser.pyx when the llhttp error-position pointer is materialized as a raw pointer rather than a bounded offset into the Python bytes buffer. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Privilege escalation in Razer RzUpdateService 1.10.14.0 allows a local low-privileged user to gain SYSTEM-level access by manipulating the lpThreadParameter argument processed by the service's Named Pipe Handler. The service, which runs at elevated Windows privilege, fails to enforce proper privilege boundaries when handling named pipe input (CWE-269), enabling a local user to leverage the service's execution context against the underlying system. A public proof-of-concept is confirmed available; the vulnerability is not currently listed in CISA KEV, though the low attack complexity combined with the published POC elevates real-world risk in environments with Razer hardware deployed.
OS command injection in OpenWrt's luci-app-dockerman grants any authenticated user holding only the read ACL full root-level code execution on the affected router. The vulnerable run_ttyd handler in the ucode docker_rpc.uc backend constructs a shell command from attacker-controlled request fields (id, cmd, uid) and passes them unsanitized to system() within the rpcd root context, reachable via a simple HTTP POST to /ubus. Only LuCI master and openwrt-25.12 snapshots after the JS-to-ucode backend conversion are affected; upstream patch commits exist but no released patched snapshot version was confirmed as of the advisory, and no public exploit is identified at time of analysis.
Stack-based buffer overflow in the Wavlink WL-NU516U1 NAS device's nas.cgi password change handler allows remote unauthenticated attackers to potentially execute arbitrary code by supplying an oversized User1Passwd argument to the change_password function. Affecting the MT7628 firmware variant (708c073-mt7628), this carries a CVSS 4.0 score of 8.9 with full confidentiality, integrity, and availability impact and no privileges or user interaction required. A public proof-of-concept has been published and a vendor-released firmware patch is available as of 2026-07-13; no confirmed CISA KEV listing at time of analysis.
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects authenticated network attackers (PR:L per CVSS). The CWE-126 flaw allows an authorized attacker to corrupt memory and execute arbitrary code within the browser process over a network channel. No active exploitation is confirmed (not listed in CISA KEV, SSVC exploitation=none), and EPSS of 1.00% at the 59th percentile reflects above-median but still modest real-world exploitation probability.
Remote code execution via use-after-free in Microsoft Excel affects multiple product lines including Microsoft 365 Apps for Enterprise, Excel 2016, and Office 2019/LTSC 2021/LTSC 2024. An unauthenticated remote attacker can exploit this memory corruption flaw by convincing a target user to open a specially crafted Excel workbook, resulting in arbitrary code execution under the context of the victim process. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though the low-complexity, no-privilege network attack vector makes it an attractive phishing payload candidate.
JSON-LD signature validation in Misskey's ActivityPub federation layer accepts fraudulent federated activities due to a TOCTOU flaw where the JSON-LD parsing context used during signature verification is not shared with the context used during subsequent message processing. Affected are all self-hosted Misskey instances running versions 12.37.0 through 2026.5.3. A remote, unauthenticated attacker operating or spoofing a federated server can craft payloads that pass signature checks yet resolve to malicious content during processing, resulting in high integrity impact across the instance and potentially propagating to federated peers; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthenticated network attacker via a missing authorization check (CWE-862), requiring only that the victim interact with attacker-controlled content. The CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impact with no privilege requirement, though user interaction is necessary. No active exploitation has been confirmed by CISA KEV, and SSVC currently rates exploitation status as none, suggesting this has not yet been weaponized at scale despite its serious technical impact classification.
Uncontrolled decompression in Apache NiFi 1.5.0 through 2.10.0 exposes the REST API to unauthenticated denial-of-service attacks via crafted gzip payloads. The Jersey encoding filter enforces its configurable size limit against the compressed form of the request body rather than the decompressed output, enabling a classic zip-bomb condition that can exhaust JVM heap memory. No public exploit has been identified at time of analysis, but the CVSS 4.0 supplemental metadata flags the attack as automatable (AU:Y) with Amber utility, indicating meaningful real-world risk against organizations with network-accessible NiFi REST API endpoints.
Server-side request forgery in CTI-Transmute's evaluation report PDF-generation pipeline allows an attacker who can inject content into a CTI evaluation report to coerce the application server into fetching arbitrary internal or filesystem resources. The vulnerability arises because user-controlled fields - conversion names, descriptions, and comments - flow through a Markdown-to-HTML conversion and are then rendered to PDF by WeasyPrint with its default unrestricted URL-fetching behavior intact, meaning crafted file:// or http(s):// references embedded in that content are fetched by the server process at render time. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but a patch commit is available from the MISP project.
Cross-site request forgery in CTI-Transmute's administrative user deletion endpoint enables unauthenticated remote attackers to delete arbitrary user accounts by inducing an authenticated administrator to follow a crafted link. The /account/delete/<id> endpoint accepted HTTP GET requests for an irreversible state-modifying operation, allowing any web page or email to silently trigger deletions using the victim's active session. No public exploit has been identified at time of analysis, though the attack requires no attacker credentials and depends solely on social engineering a logged-in administrator.
Unauthenticated path traversal in OpenWrt's luci-app-bmx7 package exposes arbitrary files on affected routers via the bmx7-info CGI endpoint. Attackers can supply directory traversal sequences in the CGI query string to escape the configured runtimeDir and read any file readable by the CGI process, including credentials, network configuration, or cryptographic keys stored on the device. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the unauthenticated network attack vector (CVSS 4.0: 8.7) presents a low barrier to opportunistic exploitation against exposed management interfaces.
Uncontrolled resource consumption in CTI-Transmute's unauthenticated /activity_timeline endpoint allows remote attackers to exhaust database, CPU, and memory resources by submitting arbitrarily large values for the `days` query parameter. All versions of the MISP project's CTI-Transmute tool are affected until the upstream patch is applied; the fix clamps the parameter to a 1-1,095 day range. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 (VA:H, PR:N, AC:L) reflects that this is a trivially reachable denial-of-service with no authentication barrier.
Path traversal in Grav CMS versions before 2.0.11 enables authenticated editors to disclose arbitrary server-side files to unauthenticated visitors through the image watermark feature. The function ImageMedium::watermark() forwards unsanitized editor-controlled input to the resource locator, whose file:// scheme handler normalizes paths using only lexical '..' collapsing - never verifying containment within the media sandbox - so a crafted Markdown image directive causes the CMS to composite a traversed file into a cached image served at a public, unauthenticated URL. No public exploit has been identified at time of analysis; however, the high confidentiality impact and ease of exploitation once editor access is obtained make this a priority patch for multi-tenant Grav deployments with untrusted editors.
Uncontrolled memory allocation in Bouncy Castle for Java's HSS public-key parser allows remote unauthenticated attackers to exhaust JVM heap memory by supplying a crafted public key with an arbitrarily large HSS level count (L value), causing denial of service during signature verification. All three product lines are affected: bc-java before 1.85, bc-lts-java before 2.73.12, and BC-FIPS (bc-fja) before 2.0.2/2.1.3 depending on series. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the AV:N/AC:L/PR:N attack profile and Bouncy Castle's ubiquity as a Java crypto dependency make this a credible availability risk for any service accepting external HSS/LMS key material.
Authentication bypass in Admidio's forum module before version 5.0.11 enables unauthenticated network-accessible attackers to read private forum topics and posts that administrators intended to restrict to logged-in members. The flaw stems from `modules/forum.php` failing to validate the login-only configuration state before serving content, meaning a direct HTTP request with read-only parameters is sufficient to circumvent the access gate. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV, but the mechanistic simplicity of the bypass - a direct module access with no authentication - means exploitation requires minimal skill once a vulnerable, login-only-configured instance is located.
CPU exhaustion in Bouncy Castle for Java allows remote attackers to cause denial of service by supplying X.500 distinguished name attribute values densely packed with RFC 4514 special characters or leading/trailing spaces. The root cause is a quadratic-time O(n²) escaping algorithm in `IETFUtils.valueToString()` that inserts backslashes into the buffer being actively scanned - triggerable through `X500Name.toString()`, `.equals()`, or `.hashCode()`, methods commonly invoked during TLS certificate and LDAP DN processing. No public exploit has been identified beyond the vendor's own regression test, and this vulnerability is not listed in CISA KEV, though the CVSS 4.0 score of 8.7 with AV:N/PR:N signals meaningful exposure for Internet-facing Java services.