UNC path injection in TeamDavid Webbox's !ArcEntryMove archive function causes the server to initiate outbound SMB connections to attacker-controlled infrastructure, exposing the server's NTLM authentication material (Net-NTLMv2 hashes). All TeamDavid deployments through Rollout 524 are affected, with the confidentiality impact occurring on subsequent systems - the attacker's SMB listener - rather than the Webbox host itself. No public exploit has been identified at time of analysis, but the attack technique is fully commoditized via tools such as Responder and Impacket; exploitation feasibility is further complicated by a contradictory authentication requirement in the source data that warrants vendor clarification.
UNC path injection in Tobit Laboratories AG TeamDavid's Webbox messaging component allows attackers to coerce the server into initiating outbound SMB connections to attacker-controlled hosts, exposing NTLM authentication credentials. The server processes @@INCLUDE directives containing Windows UNC paths (e.g., \\Server\Share) without validation across email, fax, and SMS composition features. Captured NTLM hashes can be cracked offline or relayed to authenticate against other internal services; the CVE description explicitly states the pathname parameter vector is exploitable without authentication, conflicting with the PR:L designation in the CVSS 4.0 vector. No public exploit or CISA KEV listing has been identified at time of analysis, but this attack class (NTLM coercion via UNC injection) is well-understood and widely tooled.
Stored XSS in Sonatype Nexus Repository 3 enables an authenticated user holding blob store management permissions to inject arbitrary JavaScript into a blob store name, which later executes in the browser of any user who views the system health-check status page. The CVSS 4.0 vector's SC:H/SI:H scores underscore that the subsequent-system impact is high - an attacker-controlled script running in a victim's session can exfiltrate credentials or perform privileged actions on their behalf. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Sonatype has released a fix in version 3.95.0.
Session injection in the Datadog Android app (versions prior to 5.9.2) allows any zero-permission co-installed application to hijack the victim's Datadog identity by delivering crafted OAuth tokens directly to an unguarded exported activity, which auto-logs the victim in under an attacker-controlled identity without backend token validation. The vulnerability stems from AppActivity being declared android:exported='true' with no permission guard, accepting and persisting arbitrary UserSession data deserialized from intent Bundle extras. SSVC assessment lists exploitation as none and no public exploit has been identified, but the zero-permission precondition dramatically lowers the attacker capability bar.
Integer overflow in p11-kit's RPC message parser on 32-bit systems allows a local attacker, or any principal with access to a reachable RPC channel, to crash the p11-kit process via a heap out-of-bounds write, resulting in Denial of Service. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Path traversal in Phoca Commander (a Joomla file manager extension by phoca.cz) versions 1.0.0 through 6.1.3 allows high-privileged authenticated users to write uploaded files to arbitrary filesystem locations outside the intended upload directory, achieving high integrity impact on the underlying server. The CVSS 4.0 vector (PR:H/SI:H) confirms that while exploitation requires administrator-level Joomla access, a successful attack can affect the server filesystem beyond the Joomla webroot - enabling PHP shell planting or overwriting sensitive configuration files. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is known at time of analysis.
Tenant isolation bypass in SuperTokens Core v6.0.0 through v11.4.0 enables an authenticated user in one tenant to access sessions, data, and API endpoints belonging to separate tenants on the same instance. The flaw represents a failure of authorization enforcement at the multi-tenancy boundary layer - the core authentication service does not adequately scope API operations to the requesting tenant's namespace. No public exploit code has been identified at time of analysis, but the confidentiality impact is rated high given that cross-tenant session hijacking and user data exfiltration are within scope for a successful attacker.
SQL injection in Postgrex (elixir-ecto's PostgreSQL driver) versions 0.19.3 through 0.22.3 allows an attacker who controls the :comment option passed to Postgrex.stream/4 or Ecto.Repo.stream/2 to close the SQL comment delimiter with */ and inject arbitrary SQL clauses into the streamed statement, executing them under the existing database connection's role. The root cause is a missing call to the comment_not_present!/1 guard in stream/4, an oversight absent from every other execution path in the library. No public exploit code has been identified and no active exploitation appears in the CISA KEV catalog; the CVSS 4.0 vector (AV:L, AT:P) signals that exploitation requires specific, non-default application architecture.
Authorization bypass in the kata-agent's ttRPC API allows an untrusted host to invoke two mem-agent methods unconditionally, circumventing the OPA/Rego-based AgentPolicy that forms the security boundary in Confidential Containers (CoCo) deployments. Affected are kata-containers versions prior to 4.0.0 when the mem-agent feature is explicitly enabled (disabled by default). The untrusted host can force in-guest memory operations - swap, aggressive eviction, or compaction - causing attacker-controlled availability and performance degradation of the confidential workload; the description explicitly rules out memory disclosure and code execution. No public exploit or CISA KEV listing has been identified at time of analysis, but the bypass is architecturally significant because it violates the CoCo threat model's fundamental assumption that the host is untrusted.
File and directory information exposure in SourceCodester Online Clothing Store allows unauthenticated remote attackers to retrieve Dreamweaver metadata files from the publicly accessible /_notes/ directory. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or special preconditions are required. A publicly disclosed proof-of-concept exists (E:P), documented via a Medium article detailing directory listing and Dreamweaver metadata exposure; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Out-of-bounds kernel memory read in SonicWall Global VPN Client's SWIPsec.sys driver allows a local, low-privileged attacker to crash the host system. Affected versions are 4.10.8.1108 and earlier, running on Windows where the IPsec kernel driver is loaded by the VPN client. No public exploit identified at time of analysis, and EPSS probability stands at a very low 0.16% (5th percentile), indicating no signs of active or widespread exploitation interest.
Kernel null pointer dereference in Imagination Technologies Graphics DDK allows a local non-privileged user to crash the host system via crafted GPU system calls. Multiple release branches are affected, including DDK 26.1 RTM1, 25.1-25.3 RTM, 24.2 RTM2, 23.2 RTM2, and 1.18 RTM2. An attacker with a local shell account on a device running the affected kernel driver can trigger platform instability or a full denial of service - no exploit has been publicly identified at time of analysis, and EPSS probability is extremely low at 0.15% (5th percentile).
Six exported Android App Widget configuration activities in the Datadog Android application (versions prior to 5.9.2) allow a co-installed zero-permission malicious app to brute-force sequential App Widget IDs and trigger automatic Datadog session login for the victim, exposing live operational data - dashboards, SLOs, on-call schedules, incident details - as a visual side-channel. Exploitation is constrained by three simultaneous preconditions and data exfiltration is limited to screen-visible disclosure only, with no programmatic return path. No public exploit has been identified at time of analysis; SSVC rates exploitation as none with partial technical impact.
Server-Side Request Forgery (SSRF) in Revenue Administration Türkiye's E-Signature (versions 2.4.4.0 through before 2.5.1.0) enables network-accessible attackers to coerce the application server into making arbitrary outbound HTTP requests by inducing a user to interact with crafted content. The partial confidentiality and integrity impact (C:L/I:L per CVSS) indicates an attacker could reach internal services or read limited internal responses, but cannot fully compromise the host. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch to version 2.5.1.0 is available per TR-CERT advisory.
Arbitrary code execution in the Ruby LSP VS Code extension prior to version 0.10.4 is achievable by any attacker who can deliver a malicious repository to a developer. Workspace-level settings in `.vscode/settings.json` were trusted by the extension to configure the Ruby executable path, version manager binaries, and Bundler Gemfile - all of which the extension invokes at startup - allowing an attacker-controlled repository to redirect those invocations to arbitrary binaries. The Ruby LSP gem and language server clients in other editors are explicitly not affected; no public exploit has been identified at time of analysis, and a vendor fix is available in version 0.10.4.
Open redirect in the Webbox component of TeamDavid (Tobit Laboratories AG's Microsoft 365 alternative) enables unauthenticated network attackers to craft URLs on the trusted TeamDavid domain that silently redirect visiting users to arbitrary external sites by supplying an unsanitized value in the 'replyUrl' parameter. All versions through Rollout 524 are affected per the CPE listing. This issue was disclosed as part of a coordinated report of 22 CVEs in the David platform by InfoGuard and reported to NCSC.ch; no confirmed active exploitation or public exploit code has been identified at time of analysis.
HTTP header injection in Tobit Laboratories AG TeamDavid's Webbox component allows unauthenticated network attackers to manipulate HTTP response headers by embedding URL-encoded newline characters via the unsanitized 'cType' URL parameter, enabling open redirect attacks and potential HTTP response splitting. All Webbox deployments through Rollout 524 are affected, as catalogued by NCSC.ch and detailed in InfoGuard's research covering 22 CVEs in the TeamDavid platform. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis; the CVSS 4.0 score of 5.3 reflects medium severity gated by required user interaction.
Open redirect and HTTP response header injection in the Webbox component of TeamDavid (by Tobit Laboratories AG) allow unauthenticated network attackers to manipulate 302 redirect responses by supplying encoded characters in user-controlled URL parameters. Using URL-encoded dots (%2e), an attacker can steer victims toward attacker-registered lookalike TLD domains (e.g., redirecting from a .com application to an attacker-owned .company domain), while URL-encoded line feeds enable HTTP response splitting to inject arbitrary headers. No public exploit or CISA KEV listing has been identified at time of analysis; this CVE is one of 22 disclosed against the David product suite by infoguard.ch researchers.
Reflected XSS in the Webbox component of Tobit Laboratories AG's TeamDavid collaboration platform (marketed as a secure Microsoft 365 alternative) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The vulnerability is exploitable via three distinct injection points: the URL path, the `EntryInfo` query parameter, and the `!templateName=entryMail` parameter. Disclosed as part of a coordinated batch of 22 CVEs in TeamDavid by InfoGuard Labs and reported through NCSC.ch; no public exploit code or active exploitation has been identified at time of analysis.
HTTP header injection in TeamDavid's Webbox component allows unauthenticated remote attackers to inject arbitrary HTTP response headers by embedding line feed (LF) characters in request body data sent to the link storing endpoint (//ServerClient_celink.htm). The injected data is appended unsanitized to the Location header of the 302 redirect response, enabling an attacker to control response headers against any user who interacts with a crafted link. This flaw is one of 22 CVEs disclosed by InfoGuard Labs in the David platform (marketed as a secure M365 alternative); no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in Tobit Laboratories AG TeamDavid's Webbox email interface allows any network-reachable attacker to embed malicious JavaScript within an email body; the payload executes in the browser context of any Webbox user who opens the message. All TeamDavid versions through Rollout 524 are affected per NCSC.ch disclosure and NVD CPE data. No public exploit identified at time of analysis and no CISA KEV confirmation, though the attack technique is trivial and requires no authentication from the sender.
Cross-site scripting in the ShareOpenly WordPress plugin (versions prior to 1.2.1) allows JavaScript injection into every visitor's browser via an unescaped `$url` variable concatenated directly into an HTML href attribute on all singular posts and pages where the sharing link is rendered. The root cause is the absence of WordPress's mandatory `esc_url()` function on a URL constructed from `home_url( add_query_arg( array(), $wp->request ) )`, meaning any plugin, theme, or server configuration that taints that base URL via a `home_url` filter can introduce HTML-special characters or a `javascript:` URI scheme into the rendered page without sanitization. No public exploit has been identified at time of analysis; vendor-released patch version 1.2.1 is available and confirmed.
Uncontrolled memory consumption in HashiCorp Consul's agent HTTP API endpoints allows unauthenticated remote callers to force the agent to allocate substantial memory before a request is finally rejected. Both Community Edition and Enterprise versions 1.3.0 through 2.0.2 are affected, covering a multi-year release window. No public exploit has been identified and the vulnerability is absent from CISA KEV, but the zero-authentication, low-complexity network attack path makes it straightforward to trigger for any attacker with network access to the Consul agent API port.
Uncontrolled cache growth in HashiCorp Consul's Connect CA roots endpoint allows unauthenticated remote callers to expand the agent's Connect CA roots cache indefinitely, overriding any operator-applied cache-disable configuration. Both Consul Community Edition and Consul Enterprise are affected from version 1.2.0 through 2.0.2. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS 5.3 Medium rating reflects limited availability impact with no confidentiality or integrity exposure.
JEXL expression sandbox bypass in Sonatype Nexus Repository 3's Content Selector feature allows authenticated users holding the nexus:selectors:create permission to traverse Java object properties outside the intended sandbox scope, disclosing internal JVM metadata such as class and classloader names. The vendor description explicitly confirms this does not permit method invocation, object construction, or code execution - making the 'RCE' intelligence tag a misclassification. Fixed in version 3.95.0; no public exploit or active exploitation has been identified at time of analysis.
Field-level permissions bypass in Frappe framework allows authenticated users to read restricted DocType field values via the document follow timeline feature. Frappe deployments on the v16 branch prior to 16.23.0 and the v15 branch prior to 15.112.0 are affected, including ERPNext and other applications built on Frappe. An authenticated low-privileged user can access historical change values for fields protected by Frappe's permlevel system simply by viewing the document follow timeline - no public exploit has been identified and the vulnerability is not listed in CISA KEV.
Scheduled task configuration overwrite in Sonatype Nexus Repository 3 enables a low-privileged authenticated user - holding permission to create at least one scheduled task type - to corrupt the configuration of an unrelated existing task via mass assignment against the administrative UI. By injecting internal configuration keys into user-supplied task property values, the attacker causes the system to redirect its write operation onto a pre-existing task rather than creating a new one, disrupting or manipulating that task's behavior. No public exploit or active exploitation has been identified; vendor-released patch 3.95.0 resolves the issue.
Authenticated denial of service in HashiCorp Consul Community Edition and Consul Enterprise 1.18.0-2.0.2 allows a network attacker holding config-entry write permission to crash the Consul server agent by submitting a crafted service-router configuration entry. The flaw is rooted in a null pointer dereference (CWE-476) triggered along the Enterprise-to-Community Edition downgrade code path, meaning only deployments undergoing or having undergone that transition are exploitable. No public exploit code or active exploitation confirmed by CISA KEV has been identified; vendor-released patches are available and confirmed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Unrestricted access to the Document Follow API (update_follow) in Frappe framework allows any authenticated user to follow or unfollow arbitrary documents without authorization checks, constituting an Insecure Direct Object Reference (IDOR) flaw classified under CWE-639. Frappe versions prior to 16.20.0 (v16 branch) and 15.112.0 (v15 branch) are affected, enabling authenticated attackers to subscribe to change notifications for documents outside their authorization scope. No public exploit code exists and no active exploitation has been identified at time of analysis.
The email configuration verification endpoint in Sonatype Nexus Repository 3 (CE and Pro editions through 3.94.1) allows authenticated users holding the nexus:settings:update permission to submit arbitrary host and port values, causing the server to probe internal or restricted network addresses via Server-Side Request Forgery. Differences in server responses - connection timing, error codes, and success signals - act as a side channel revealing which internal hosts and ports are reachable from the Nexus server, enabling internal network enumeration. No public exploit has been identified at time of analysis, and vendor-released patch version 3.95.0 resolves the issue.
Stored cross-site scripting in HAPI FHIR's scan command allows an attacker who controls an Implementation Guide or FHIR profile to inject arbitrary JavaScript into generated scan.html reports. All versions of org.hl7.fhir.core, ca.uhn.hapi.fhir:org.hl7.fhir.validation, and ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli prior to 6.9.11 are affected. When a developer or CI pipeline scans the malicious IG and subsequently opens or publishes the resulting HTML report, the injected payload executes in the viewer's browser context - no public exploit or CISA KEV listing exists at time of analysis, but the fix commit and advisory are public.
Plaintext SQLite database storage in the Datadog Android application exposes operationally sensitive monitoring metadata to anyone with physical access to the device or the ability to perform forensic acquisition. Two Room-managed databases - LocalNotificationDatabase and SearchRecentDatabase - store incident notification recipients, deeplinks, service names, and free-text search queries without at-rest encryption; no SQLCipher or equivalent openHelperFactory configuration was found in the codebase. Protection relies entirely on the Android application sandbox, which is insufficient for this class of data in high-risk deployment environments such as on-call engineering teams managing production infrastructure. No public exploit code exists and CISA has not added this to the KEV catalog.
SELinux label manipulation via TOCTOU race condition in the policycoreutils fixfiles script allows a local low-privileged attacker to corrupt SELinux mandatory access control labels on arbitrary system files, including security-critical targets such as /etc/shadow. The flaw affects fixfiles when run in relabel or restore mode across all supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained by both a required race condition win and the need for an administrator to actively invoke fixfiles.
Uncontrolled resource consumption in HashiCorp Consul and Consul Enterprise 1.17.0 through 2.0.2 allows authenticated network callers to unboundedly inflate the Consul agent's intention-match cache via the Connect authorization endpoint, defeating explicitly configured cache-disable operator settings. This CWE-770 flaw degrades service mesh authorization availability and undermines a deliberate operational control. No public exploit code or active exploitation has been identified; HashiCorp has released patches across all affected release lines.
Open redirect in the Home Assistant Android Companion App (prior to 2026.6.1) enables credential phishing attacks against new users via crafted homeassistant://invite deep links. Because no screen in the invitation or onboarding flow displays the parsed server hostname before the WebView commits to it, an attacker who delivers a malicious invite link can silently redirect the victim's onboarding session to an attacker-controlled server presenting a look-alike login page. No public exploit code has been identified at time of analysis; the CVSS score of 4.3 (C:L) understates real-world impact given that captured credentials yield full smart-home access.
Authorization bypass in HashiCorp Consul and Consul Enterprise versions 1.19.1 through 2.0.2 allows authenticated callers to delete arbitrary sessions via the transaction API without holding the required `session:write` ACL permission. Any principal with valid credentials and network access to the Consul server's API can silently circumvent access controls that are correctly enforced on the standard session deletion endpoint. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low privilege barrier and straightforward API path make targeted misuse plausible in multi-tenant or shared Consul deployments.
L7 intention authorization bypass in HashiCorp Consul Community and Enterprise editions 1.20.1 through 2.0.2 allows an authenticated mesh workload to reach HTTP paths that are explicitly blocked by path-based deny intentions, when the service proxy is configured with a custom public listener. The flaw undermines a core service mesh security control - path-based L7 intentions - without requiring unauthenticated access or elevated privileges beyond mesh workload enrollment. No public exploit code has been identified and this CVE is not listed in CISA KEV; the CVSS 4.2 Medium score accurately reflects the configuration-dependent, authenticated nature of the attack.
Adobe Genuine Software Integrity Service on local systems exposes an Incorrect Authorization flaw (CWE-863) enabling any local attacker - without elevated privileges - to bypass the service's integrity-verification controls and obtain unauthorized limited write access to areas the service is designed to protect. All tracked versions of the service are affected per the open-ended CPE range published by Adobe. No public exploit or CISA KEV listing has been identified at time of analysis, and exploitation is constrained to the local environment, reducing mass-exploitation risk while remaining a realistic threat from malware, shared-account misuse, or low-privileged insider scenarios.