Command injection in GL.iNet GL-MT3000 router firmware (all versions through 4.4.5) allows unauthenticated remote attackers to execute arbitrary OS commands via the nas-web RPC wrapper's add_user function at /cgi-bin/glc. The vendor has confirmed the vulnerability exists following early disclosure, and a public proof-of-concept exploit is hosted on GitHub, materially lowering the barrier to exploitation. No patched firmware version is identified in the available data; the CVSS 4.0 score of 8.9 with E:P reflects unauthenticated network exploitability with a confirmed public exploit.
Remote code execution in Perspective 5.0.0 exposes any network-reachable PolarsVirtualServer backend to arbitrary OS command execution via Python eval() injection. The server passes client-supplied expression strings to eval() with only __builtins__={} cleared - a well-known insufficient sandbox - enabling attackers to traverse Python's loaded class hierarchy to reach subprocess.Popen through crafted TableValidateExprReq or TableMakeViewReq protobuf messages. A public exploit is confirmed by VulnCheck, and five vulnerabilities were disclosed simultaneously in the researcher's blog post, suggesting a broader attack surface in this release. No KEV listing is identified, but the published PoC substantially lowers the exploitation barrier.
Property injection via the unauthenticated POST /api/v1/prediction/:id endpoint in Flowise allows remote unauthenticated attackers to overwrite session-critical fields (chatId, sessionId, chatHistory) and inject arbitrary values into the $flow.* template variable system of any public chatflow. Flowise versions up to and including 3.1.2 are affected; the fix was released in 3.1.3. Publicly available exploit code exists in the form of detailed curl-based proof-of-concept commands embedded in the public GitHub Security Advisory GHSA-6vh2-wg4h-4vwj, though active exploitation has not been confirmed by CISA KEV.
Remote unauthenticated file disclosure in perspective-dev/perspective 5.0.0 allows any network attacker to read arbitrary server-side files by injecting literal `../` path traversal segments into HTTP request URLs targeting the CWD static file handler. The sanitization routine strips only query-string parameters, leaving path-based traversal sequences intact and enabling escape from the configured asset root to retrieve sensitive files such as system credentials and application secrets. A publicly available proof-of-concept exploit exists per VulnCheck and researcher disclosure; combined with a wildcard Access-Control-Allow-Origin header on all responses, the vulnerability also enables cross-origin exfiltration through attacker-controlled web pages without any victim interaction.
Missing admin authorization on the embedding management API in Odysseus allows any authenticated non-admin user to overwrite or delete the server-wide embedding backend configuration, redirecting all subsequent embedding operations - including chat messages, RAG queries, memory entries, and vault text - in plaintext to an attacker-controlled URL. All deployments running any version prior to commit bf325f6 are affected. A public exploit and detailed write-up are available, and the CVSS 4.0 score of 8.7 (PR:L) reflects the low barrier to exploitation for any account holder.
Flowise's patch for CVE-2025-8943 is fully bypassed in versions up to and including 3.1.2, allowing unauthenticated remote code execution on default deployments via the npm_config_yes environment variable. The prior mitigation blocked the -y and --yes flags on npx and denied four specific environment variable names by exact string match, but npm natively reads its configuration from any npm_config_* prefixed variable, making npm_config_yes=true semantically equivalent to --yes. Any attacker who can submit a Custom MCP stdio server configuration - which requires no authentication on default Flowise deployments - can force npx to auto-install and execute an arbitrary package as the Flowise server process. No public exploit code has been identified at time of analysis, though the bypass technique is fully documented in the public GHSA advisory GHSA-xc48-889x-5qmw, making independent weaponization trivial.
Stored cross-site scripting in Open WebUI 0.10.0-0.10.2 allows any authenticated user to craft a math block that causes a KaTeX RangeError (stack overflow from deeply nested braces), forcing the KatexRenderer.svelte error fallback to inject unescaped HTML directly into the DOM via Svelte's `{@html}` directive. Any user who subsequently views the message - including administrators - executes attacker-controlled JavaScript on the Open WebUI origin, enabling session token theft from localStorage and full account takeover. A detailed, weaponizable proof-of-concept is publicly documented in the vendor GHSA advisory, including demonstrated administrator session exfiltration; no CISA KEV listing has been identified at time of analysis.
Unauthenticated remote denial-of-service in Perspective 5.0.0 crashes the server process by exploiting missing field validation in the VirtualServer protocol dispatcher. Attackers send syntactically valid but semantically incomplete protobuf messages - such as ViewToArrowReq without a viewport or MakeTableReq without a data field - triggering Rust unwrap() calls on None values at nine distinct code sites, each causing an immediate SIGABRT process abort. No public exploit is confirmed actively exploited (no CISA KEV listing), but a publicly available proof-of-concept exists via a researcher blog post, and the attack requires no authentication against a network-accessible endpoint.
Remote code execution in LAMP Rapid Development Platform (dromara lamp-cloud) through version 5.6.2 allows low-privileged authenticated attackers to inject arbitrary Groovy code into message template script fields processed by the GlueFactory component, resulting in OS command execution on the backend server with the privileges of the Java process. The GlueFactory compiled and ran these scripts via GroovyClassLoader with no sandboxing, AST restrictions, or class whitelisting in place. A publicly available exploit exists via GitHub issue #408, and CVSS 4.0 rates this 8.7 with full confidentiality, integrity, and availability impact on the vulnerable system.
Unauthenticated SSRF with non-blind response reflection and OAuth2 secret exfiltration in Flowise affects all versions through 3.1.2. The OAuth2 token refresh endpoint is intentionally whitelisted from authentication but issues server-side HTTP POST requests to a credential-stored URL without SSRF controls, allowing any caller who knows a credential UUID to redirect the server to an attacker-controlled host and receive the full response body. A working proof-of-concept was confirmed against the flowiseai/flowise:latest container, with the exploit also exfiltrating client_secret and refresh_token values in the outbound POST body to the attacker server. No public exploit is independently confirmed as widespread, but the PoC is detailed and functional.
Cross-tenant billing manipulation in Flowise's enterprise API allows any authenticated user to perform unauthorized Stripe subscription operations against other organizations by supplying an arbitrary victim subscriptionId to the /update-subscription-plan and /update-additional-seats endpoints. All Flowise enterprise deployments running versions prior to 3.1.3 are affected, with impact including unauthorized plan downgrades, seat-count inflation (inflating victim billing), and service disruption across tenants. No public exploit code or CISA KEV listing exists at time of analysis, but the vulnerability is mechanically straightforward given knowledge of a target organization's Stripe subscription identifier.
Broken access control in Flowise's GET /api/v1/upsert-history API endpoint exposes the entire server-wide upsert history - exceeding 100MB per response - to any authenticated user, leaking sensitive infrastructure credentials including Qdrant server URLs, collection names, and vector pipeline configuration across all tenants and workspaces. The vulnerability is confirmed in flowise <= 3.1.2 and publicly documented in GHSA-fr6g-7cq8-fg82 with a working curl-based proof-of-concept, meaning any account holder on a multi-tenant deployment can harvest cross-tenant vector store configuration for reconnaissance or targeted follow-on attacks against exposed backends. Vendor-released patch flowise@3.1.3 is confirmed available and addresses missing workspace-scoping enforcement across multiple API controllers.
OAuth token exchange in Open WebUI 0.8.0-0.10.x enables full, silent account takeover when ENABLE_OAUTH_TOKEN_EXCHANGE=True because the endpoint accepted provider access tokens minted for any OAuth client without verifying the issuing client identity. The endpoint validated tokens exclusively via the provider's userinfo endpoint, which confirms token validity but never returns the client a token was issued to, allowing an attacker who captures a victim's token from any co-registered application to exchange it for a valid Open WebUI session - including administrator sessions with no role gating. A proof-of-concept is confirmed by the upstream advisory; no active exploitation is recorded in CISA KEV, and the CVSS 8.1 score reflects high confidentiality and integrity impact tempered by a required victim interaction step.
Unauthorized permanent deletion of chat history in Open WebUI 0.10.x allows any authenticated write-collaborator on a shared folder to destroy the folder owner's chats, messages, and entire subfolder subtree via the DELETE /api/v1/folders/{id} endpoint. The flaw stems from a split authorization check that enforced ownership for root folders but accepted write-grant access for subfolders, while the cascade deletion itself ran under the owner's identity - meaning the collaborator's lower-privilege check granted them the owner's destructive reach. No public exploit has been identified at time of analysis, and exploitation requires a non-default configuration, but the impact is irreversible data destruction with no recovery path.
PHP code injection in the Create Block Theme WordPress plugin (before 2.10.0) enables a multisite subsite administrator to execute arbitrary server-side code by exploiting insufficient output escaping when the plugin writes user-supplied text into generated PHP pattern files. The vulnerability leverages a capability boundary mismatch unique to WordPress multisite: subsite admins hold the capability gating pattern file generation but are denied the capability normally required for PHP file editing, creating an unintended privilege escalation path to full remote code execution. A public proof-of-concept is available via WPScan, though EPSS sits at 0.15% (5th percentile), indicating exploitation is currently targeted rather than widespread.
Command injection in H3C NX15 firmware V100R017 permits network-accessible, authenticated attackers to execute arbitrary operating system commands via the /api/esps API endpoint by manipulating the reload.reload_config function parameter. The vulnerability, classified as CWE-77 (Command Injection), carries a CVSS 4.0 score of 7.3 and affects this specific H3C networking device firmware version. A public proof-of-concept exploit - titled 'service_add_root_rce' - has been published to GitHub, indicating root-level code execution is achievable; no vendor patch has been identified at time of analysis.
Command injection in H3C NX15 firmware V100R017 allows authenticated remote attackers with high privileges to execute arbitrary OS commands by supplying a maliciously crafted value in the `esps.apcm.version` argument of a DELETE request to the `/api/esps` API endpoint. The exploit has been publicly disclosed on GitHub, raising the risk for exposed devices with reachable management interfaces. No active CISA KEV listing exists, but the publicly available proof-of-concept lowers the bar for motivated attackers who already hold administrative credentials.
Command injection in H3C NX15 firmware V100R017 allows authenticated remote attackers to execute arbitrary OS commands via the `workMode` parameter in the `/api/esps` IPv6 WAN configuration endpoint, likely yielding root-level device takeover based on the published PoC repository name. A public proof-of-concept exploit is available on GitHub (E:P confirmed in the CVSS 4.0 vector), significantly lowering the skill bar for anyone who already holds administrative credentials. No vendor patch has been identified at time of analysis, and no CISA KEV listing exists, indicating no confirmed widespread active exploitation.
Command injection in H3C NX15 V100R017 allows authenticated remote attackers to execute arbitrary OS commands as root via the /api/esps management endpoint. The vulnerability exists in the Add function's handling of the esps.filter.url parameter, which is passed unsanitized to a system command (CWE-77). A public proof-of-concept exploit demonstrating root-level remote code execution is available on GitHub, elevating real-world risk beyond the theoretical - though exploitation requires high-privilege credentials, and no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Server-Side Request Forgery in Open WebUI versions 0.9.6 through 0.10.x allows any authenticated user to exfiltrate HTTP responses from internal network services - including cloud instance metadata endpoints and container-local APIs - by submitting a crafted URL that triggers unvalidated sub-resource requests through the Playwright browser loader. The `SafePlaywrightURLLoader` component validated only the top-level navigation request; all subsequent requests issued by page JavaScript bypassed the address check entirely, and the resulting DOM content was returned directly to the requester via the normal web-search or RAG ingestion pipeline. No public exploit or CISA KEV listing is confirmed at time of analysis, though a proof-of-concept was reported against version 0.10.2; the vulnerability is limited to the non-default Playwright loader configuration.
Command injection in GL.iNet AX1800 router firmware up to version 4.8.3 allows a low-privileged authenticated remote attacker to execute arbitrary OS commands via the `remove_rule` RPC endpoint. The vulnerable parameter `args.id` in `/usr/share/gl-ngx/oui-rpc.lua` is passed unsanitized to a shell command, enabling full device takeover. No public KEV listing exists, but a proof-of-concept exploit is publicly available on GitHub, meaningfully lowering the barrier to exploitation.
Cross-workspace OAuth2 credential isolation failure in Flowise prior to version 3.1.3 enables two distinct attack classes: authenticated users can initiate OAuth2 flows against credentials owned by other workspaces, and - more critically - unauthenticated attackers can forge OAuth2 callbacks to overwrite tokens or trigger token refreshes for any credential system-wide by exploiting a whitelist that bypasses all authentication on the /callback and /refresh endpoints. The root cause is that all three OAuth2 handlers query the Credential table by credential ID alone, omitting the workspaceId isolation enforced elsewhere in the codebase. No public exploit has been identified at time of analysis, and the issue is fixed in Flowise 3.1.3.
SSRF protection bypass in Flowise (npm/flowise ≤ v3.1.2) allows complete circumvention of all IPv4 CIDR deny rules via IPv4-mapped IPv6 addresses, rendering the SSRF fix introduced in v3.0.13 for CVE-2026-31829 entirely ineffective. An attacker who controls DNS for a hostname referenced in a Flowise chatflow HTTP component can set a AAAA record to `::ffff:169.254.169.254` or any RFC1918 target; Flowise resolves the address, the `isDeniedIP()` kind mismatch silently skips all IPv4 CIDR checks, and the request reaches cloud IMDS endpoints or internal services. A publicly available proof-of-concept script (poc_ssrf_bypass.js) confirms the bypass against ipaddr.js@2.2.0; no CISA KEV listing has been identified at time of analysis.
Missing authorization on the `/api/v1/files` endpoint in Flowise allows any authenticated API key holder within an organization to enumerate and permanently delete files belonging to other workspaces. The route is guarded only by a plan-level feature gate (`feat:files`) with no `checkPermission` enforcement, meaning an API key scoped to an unrelated permission such as `tools:view` has full read and delete access to organization-wide file storage. Publicly available exploit code exists in the form of a fully reproducible curl-based proof-of-concept included in the GitHub Security Advisory GHSA-wp74-f5hh-5f3r. The fix in version 3.1.3 disables the endpoint entirely rather than adding proper authorization.
Denial of service in Perspective 5.0.0 allows low-privileged remote attackers to render the server permanently unresponsive by submitting a crafted TableMakeViewReq message containing expression columns with unbounded for or while loop constructs. Because the Tornado IOLoop evaluates the expression once per table row with no iteration cap, deadline enforcement, or cancellation mechanism, a single malicious request stalls the entire event loop and blocks all connected clients. A publicly available proof-of-concept exploit exists, and the vulnerability is part of a batch of five CVEs disclosed against this version.
Cross-workspace IDOR in Flowise's OpenAI Assistants Vector Store API allows authenticated users of one workspace to access, use, and manipulate another workspace's stored OpenAI credentials. Flowise versions up to and including 3.1.2 pass the client-supplied `credential` query parameter directly to a database lookup (`findOneBy({ id: credentialId })`) with no ownership check against the caller's `workspaceId`, violating the multi-tenant isolation guarantee. An attacker with a valid Flowise account and `assistants:*` permissions can cause direct financial harm to victim workspaces via unauthorized OpenAI API billing and can read, modify, or delete the victim's vector stores and files. No public exploit code or CISA KEV listing is identified at time of analysis.
Flowise's DELETE /api/v1/chatflows/:id endpoint fails to enforce RBAC boundaries between flow resource types, allowing authenticated workspace members to delete flows they are not permitted to manage. Users holding only agentflows:delete can permanently destroy CHATFLOW resources, and users holding only chatflows:delete can destroy AGENTFLOW resources, in the same workspace. All Flowise installations prior to 3.1.3 are affected; no public standalone exploit tool exists, but the GHSA advisory (GHSA-p5w8-m249-4r4v) supplies a verbatim curl reproduction demonstrating the issue with minimal effort.
Server-side request forgery in Open WebUI (pip/open-webui versions 0.9.0 through 0.10.x) allows any authenticated low-privilege user to reach internal cloud metadata endpoints, loopback-bound admin surfaces, and VPC-internal APIs by encoding IPv4 addresses inside the NAT64 well-known prefix `64:ff9b::/96`. The SSRF filter evaluates only whether the literal IPv6 address is globally routable - which NAT64 addresses are, by design - without unwrapping the embedded IPv4 destination before deciding to allow or block the request. Full response bodies, including AWS IAM role credentials from the instance metadata service, are returned directly to the caller. A proof-of-concept exists confirming exploitation against the unmodified v0.10.2 code path; no active exploitation in the wild has been confirmed by CISA KEV at time of analysis.
Silent authorization bypass in Eclipse Milo OPC UA server SDK versions 1.0.0-1.1.4 allows anonymous network clients to invoke protected methods, read role-permission metadata, and delete protected nodes. The defect is a missing field copy in `OpcUaServerConfig.copy()`: when servers construct their running configuration via this method, the configured `RoleMapper` is silently dropped, causing the `DefaultAccessController` to receive empty role ID lists for every session and skip all role-permission enforcement. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization controls in HAVELSAN Liman MYS (versions 2.2.3 through before 2.3.1) allow a low-privileged authenticated user to access and invoke functionality that should be restricted to higher-privileged roles, resulting in full confidentiality, integrity, and availability compromise of the managed system. The flaw stems from CWE-862 - the application fails to enforce ACL checks before granting access to privileged operations, effectively allowing privilege escalation within the platform. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network accessibility make this straightforward to exploit by any authenticated user.
SQL injection in Koha's circulation statistics report (reports/issues_stats.pl) exposes the entire Koha database to authenticated staff members holding the reports module permission. The vulnerability arises from direct string concatenation of at least six user-controlled HTTP parameters - PeriodTypeSel, PeriodDaySel, PeriodMonthSel, multiple Filter slots, and the Line and Column report-dimension identifiers - into raw SQL with no parameterized binding or whitelist validation, enabling extraction of the borrowers table (password hashes, two-factor TOTP secrets, personal data), api_keys, and active session tokens. No public exploit has been identified at time of analysis and SSVC rates exploitation as none, but vendor-released patches are available across all four active Koha release branches.
SQL injection in Koha's staff-facing report endpoint `reports/bor_issues_top.pl` enables any authenticated staff member holding the reports module permission to extract arbitrary data from the underlying database, including patron password hashes, two-factor authentication secrets, personal identifying information, API keys, and active session tokens. The vulnerability spans four concurrent release branches (24.11.x, 25.05.x, 25.11.x, 26.05.x) and is addressable by upgrading to patched releases issued by the Koha community. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates exploitation as 'none' and the attack as non-automatable.
SQL injection in Koha's reports module allows an authenticated staff user with the reports permission to execute arbitrary SQL against the Koha database via `reports/issues_avg_stats.pl`. The `Line` and `Column` HTTP parameters are inserted verbatim into SQL identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY) and Filter slots are concatenated raw into comparison predicates without parameterized queries, exposing the full Koha database to read and potential write operations. Sensitive tables including `borrowers` (password hashes, two-factor secrets, patron PII), `api_keys`, and `sessions` are all reachable; no public exploit identified at time of analysis and CISA KEV does not list this CVE.
SQL injection in Koha's reports/catalogue_stats.pl allows an authenticated staff user with the reports module permission to read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions. Affected releases span all Koha branches prior to 24.11.17, 25.05.12, 25.11.06, and 26.05.01, with vendor-released fixes now available. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the SSVC framework rates exploitation status as none and automatable as no, reflecting the authenticated staff-account prerequisite.
SQL injection in Koha's acquisitions statistics module exposes sensitive library patron data to authenticated staff. The reports/acquisitions_stats.pl endpoint interpolates nine user-controlled Filter parameters directly into SQL WHERE fragments without prepared-statement binding, giving any staff account holding the reports permission arbitrary read access to the Koha database - including borrower password hashes, two-factor secrets, API keys, and active session tokens. No public exploit or active exploitation has been identified, but the attack is straightforward for any insider or compromised staff account.
Privilege escalation in Liman MYS (HAVELSAN Inc.) versions 2.2.3 through pre-2.3.1 enables authenticated low-privilege users to gain administrator-level access via missing server-side authorization checks (CWE-862). The platform, a centralized Linux server management system used primarily in Turkish government and enterprise environments, fails to verify whether the requesting user has rights to perform privileged operations before executing them. No public exploit identified at time of analysis, but the CVSS 8.8 score with network vector and low privilege requirement makes this a high-priority patch target for any organization running the affected versions.
Race condition in the Linux kernel's KVM nVMX (nested VMX) subsystem allows a low-privileged local attacker to trigger a use-after-free via shadow VMCS teardown, with potential for full hypervisor compromise. The flaw arises because free_nested() releases the shadow VMCS page while vmcs01 still holds a dangling pointer; if the vCPU migrates to another physical CPU before the pointer is cleared, __loaded_vmcs_clear() executes VMCLEAR against the freed page, corrupting kernel memory. No public exploit code exists and no active exploitation is confirmed (EPSS 0.16%, 5th percentile), but the S:C scope change in the CVSS vector and the C:H/I:H/A:H impact triad indicate this could enable a guest-to-host escape under the right conditions.
Shadow MMU ordering flaw in the Linux kernel KVM x86 subsystem allows a low-privileged guest process to corrupt the hypervisor's page table state by triggering invalid root population during shadow page reclamation. Kernels from 5.9 through multiple unpatched stable branches permit child shadow pages to be created under an invalidated parent root, violating a core MMU invariant and potentially enabling guest-to-host privilege escalation. No public exploit has been identified and EPSS is low (0.16%), but the confirmed scope change to the host hypervisor makes this a high-priority patch for any KVM-based multi-tenant or cloud virtualization environment.
Server-side file-write and server-side request forgery (SSRF) in Django's GeoDjango spatial lookups expose authenticated staff users as an attack surface capable of writing arbitrary files to disk or issuing outbound network requests as the Django process user. Affected are Django 5.2 (before 5.2.17) and 6.0 (before 6.0.8), where the Django admin changelist's standard filter mechanism made the flaw reachable by any staff account holding view permissions on a model with a spatial field. Depending on the GDAL raster driver available on the server, file writes can escalate to remote code execution. No public exploit is identified at time of analysis; patched releases Django 5.2.17 and 6.0.8 were issued August 4, 2026.
Denial of service in OpenSIPS SIP server versions prior to 3.6.6 allows an unauthenticated remote attacker to crash worker processes by sending a SIP request containing a malformed SDP bandwidth line that omits the required colon delimiter. The crafted payload triggers a null pointer dereference (CWE-476) in the SDP parsing layer; when dialog or QoS modules subsequently clone the corrupted SDP state, the worker process terminates abnormally. No active exploitation is confirmed at time of analysis, though publicly readable patch commits expose the exact byte-level trigger, significantly lowering the barrier to exploit construction.
Denial of service in OpenSIPS versions 3.4.0 through 3.6.5 and 4.0.0-beta allows remote attackers to crash the server with a single crafted SIP PUBLISH request targeting the presence module. The crash stems from a NULL pointer dereference in handle_publish() triggered when enable_sphere_check=1 is configured: get_content_type() is invoked without first calling parse_content_type_hdr(), leaving Content-Type parsing state uninitialized and producing a segmentation fault via either a NULL parsed sub-pointer or a NULL content_type pointer. No public exploit has been identified at time of analysis, but the attack mechanics are fully described in the vendor advisory (GHSA-h3ww-hchh-x2g9), and the fix is available in 3.6.6 and 4.0.0-rc1.
Memory exhaustion in jackson-core's non-blocking async parser allows remote unauthenticated attackers to exhaust JVM heap by streaming JSON integer digit sequences in small chunks without ever sending a terminator byte. The prior fix for GHSA-72hv-8253-57qq (CVE-2026-18401) failed to insert a `validateIntegerLength()` call on the `NOT_AVAILABLE` return path inside `MINOR_NUMBER_INTEGER_DIGITS`, allowing the internal `TextBuffer` accumulator to grow bounded only by `maxStringLength` (20 MiB default) rather than `maxNumberLength` (1000 chars default) - a ~20,000x amplification yielding approximately 40 MiB of heap pressure per connection due to Java's 2-byte char representation. Reactive frameworks that feed inbound HTTP or gRPC bytes incrementally to the async parser - Spring WebFlux/Reactor, Quarkus, Helidon, and Vert.x - are the primary risk surface; no public exploit identified at time of analysis.
Unauthenticated remote denial-of-service in Eclipse Milo 0.6.0-1.1.4 allows any network-accessible client to exhaust the OPC UA server's off-heap direct memory pool by repeatedly sending incomplete UASC message chunks and disconnecting before message assembly completes. The UASC server-side asymmetric handler and ChunkDecoder fail to invoke ReferenceCountUtil.safeRelease() on retained Netty ByteBuf objects when the channel lifecycle ends, causing unbounded off-heap memory accumulation. No authentication is required and no special server configuration is necessary; the fix commit is publicly available on GitHub, serving as an effective blueprint for exploitation, though no standalone POC tool or CISA KEV listing has been identified at time of analysis.
OS command injection in Lenovo XClarity Orchestrator (LXCO) 2.2.0 enables an authenticated low-privileged attacker to execute arbitrary operating system commands with elevated privileges under a specific, undisclosed circumstance. LXCO is an enterprise data center orchestration platform that manages Lenovo server and chassis infrastructure, making successful exploitation highly impactful to infrastructure availability, integrity, and confidentiality. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the Lenovo advisory.
Authorization bypass in Eclipse Milo's OPC UA Call service (versions 1.0.0-1.1.4) permits unauthenticated or low-privileged OPC UA clients to invoke server-side methods they are explicitly denied access to. The server correctly computes per-method authorization for a mixed batch CallRequest but then dispatches the original unfiltered batch - including denied methods - to address-space handlers, rendering the authorization check effectively inert. No active exploitation is confirmed and no public exploit code has been identified, but the attack requires only standard OPC UA client tooling and zero authentication, making exploitation trivially accessible to any network-reachable client.
Memory exhaustion in Veeam Service Provider Console (VSPC) allows unauthenticated remote attackers to deplete host memory and cause a denial of service, with no authentication or user interaction required. The CVSS 4.0 score of 8.7 reflects the network-accessible, zero-prerequisite nature of exploitation (AV:N/AC:L/AT:N/PR:N/UI:N) with high availability impact confined to the vulnerable system. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low exploitation barrier makes any internet-exposed VSPC instance a realistic target.
Unauthenticated arbitrary file read in Veeam ONE exposes sensitive server-side files to remote attackers without requiring any credentials, user interaction, or special configuration. The flaw, rooted in CWE-287 (Improper Authentication), enables a network-accessible authentication bypass that returns host filesystem content directly to the attacker. Exfiltrated files - likely including configuration data, database connection strings, or stored credentials - can then be used to escalate privileges locally, extending the impact beyond the initial confidentiality breach. No public exploit or active exploitation confirmed at time of analysis.
Code injection in the LINE Android app (prior to version 26.7.2) allows an attacker who controls a LINE profile to embed malicious script content in profile templates, which executes with the app's full privileges when a victim views that profile. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact against the vulnerable system, with network-accessible, zero-privilege exploitation requiring only passive victim interaction. Critically, LY Corporation has deployed a server-side mitigation that protects even unpatched Android clients; no public exploit has been identified at time of analysis and no CISA KEV listing exists.
Remote code execution in Veeam ONE, the enterprise backup monitoring and analytics platform, is achievable by high-privileged authenticated users via a network-accessible code injection flaw (CWE-94). The vulnerability carries a CVSS 4.0 score of 8.6 with full confidentiality, integrity, and availability impact on the vulnerable system, reported through HackerOne and detailed in Veeam KB4892. No public exploit code or CISA KEV listing has been identified at time of analysis, moderating near-term mass-exploitation risk despite the critical impact class.
Unrestricted file upload in freo2 (by refirio) versions prior to 2.0.0-alpha-14 enables highest-privilege administrative users to upload executable files and trigger arbitrary OS command execution on the underlying server. Reported by JPCERT and covered under JVN#52865575, this is a post-authentication code execution path requiring no user interaction once admin access is established. No public exploit code or CISA KEV listing has been identified at time of analysis.