File disclosure in Tobit Laboratories AG's TeamDavid Webbox (through Rollout 524) allows authenticated network users to bypass server-side path filters using NTFS alternate data stream (ADS) notation, enabling access to highly sensitive files including other users' credential files containing plaintext passwords and the server's private key. The flaw exists in the Webbox messaging component where the proprietary '@@attach' directive, supplied via the 'scjob' form field, is processed without adequate path canonicalization - the filter blocking access to David configuration and user directories is bypassed entirely by ADS-encoded paths. No public exploit has been identified at time of analysis, though this vulnerability is part of a multi-CVE research disclosure of 22 issues in the David platform by Infoguard.
Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file on the underlying server by injecting the internal @@COMMENTFILE directive into the scjob form field of the messaging interface. All deployments through Rollout 524 are affected per NVD and NCSC.ch reporting. No public exploit has been identified at time of analysis, though this CVE is one of 22 vulnerabilities disclosed by infoguard.ch in the same research campaign, indicating broad systemic security weaknesses in the product.
Insecure Direct Object Reference (IDOR) in the Subscriptions for WooCommerce WordPress plugin before 2.0.1 allows any authenticated customer to read subscription records belonging to other customers by supplying an arbitrary subscription ID. The plugin fails to enforce ownership checks before returning subscription details - subscribed product, status, and date fields - exposing sensitive order metadata across tenant boundaries. A publicly available proof-of-concept exists per WPScan, but with an EPSS of 0.13% (3rd percentile) and no CISA KEV listing, mass exploitation is not currently observed.
Phoca Commander (Joomla file manager extension by phoca.cz, versions 1.0.0-6.1.3) exposes arbitrary server-side files through a path traversal flaw in its getSource function, allowing attackers with Joomla administrator credentials to read files outside the extension's intended directory scope - including sensitive configuration files, credentials, and system files. The CVSS 4.0 score of 8.2 reflects a high confidentiality impact on both the vulnerable system (VC:H) and subsequent systems (SC:H), meaning the disclosure can extend beyond the Joomla application boundary to the underlying server filesystem. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, making active exploitation unconfirmed at time of analysis.
Repeated denial-of-service resets in Aviation VHF Link Control X.25 protocol implementations can be triggered remotely over radio frequency by transmitting malformed or out-of-sequence frames. The resulting reset loop degrades communication availability and increases workload for pilots or air traffic controllers, with potential for reduced situational awareness during critical flight operations. No public exploit has been identified at time of analysis, but the radio-frequency attack vector means any actor with appropriate VHF transmitting equipment and protocol knowledge within range could attempt exploitation without authenticating to the target system.
Denial-of-service via spoofed broadcast control frames over radio frequency can simultaneously disconnect multiple aircraft from air traffic control datalink communications, causing controller overload and delayed clearances. The vulnerability is classified ICS-critical and reported through CISA ICS-CERT (ICSA-26-219-01), indicating a fielded aviation infrastructure component is affected. No public exploit code has been identified at time of analysis, though the attack is described as remotely executable over RF with low privilege requirements, making it a meaningful operational risk at any airport deploying the affected system.
Session termination via injected radio frames threatens Controller-Pilot Data Link Communications (CPDLC), a safety-critical aviation channel used globally between aircraft and air traffic control for ATC clearances, weather, and route updates. Remotely transmitted Unnumbered Disconnect (U DISC) frames or malformed Aviation VHF Link Control (AVLC) frames over VHF radio can forcibly collapse active CPDLC sessions, forcing reversion to voice communication and degrading controller throughput in high-traffic airspace. No public exploit code has been identified at time of analysis; however, the ICS-CERT advisory ICSA-26-219-01 confirms the vulnerability and the aviation safety context elevates operational priority well beyond what the numeric CVSS score alone suggests.
PATH hijacking in NexTor IP Changer prior to 2.0.0 allows a local attacker with low privileges to execute arbitrary code by substituting malicious binaries for trusted executables such as sudo. The root cause is unsafe use of Python's subprocess with shell=True without resolving executables to absolute paths, making the tool vulnerable to CWE-78 (OS Command Injection) and CWE-426 (Untrusted Search Path). No public exploit or active exploitation has been identified at time of analysis; version 2.0.0 resolves the issue by hardcoding absolute paths for all system commands.
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Environment (REE) kernel control to corrupt GPU Firmware data across the TEE security boundary. The GPU Firmware blindly dereferences a pointer sourced from non-secure memory when moving internal data between tightly coupled private memory and main memory - a trust boundary violation that undermines the fundamental isolation guarantee of Trusted Execution Environment platforms. No active exploitation has been confirmed (CISA KEV absent), and EPSS sits at 0.15% (5th percentile), but the cross-domain nature of this flaw makes it relevant for embedded, mobile, and automotive threat models where TEE integrity is a security anchor.
Unauthenticated NTLM credential theft is possible against Tobit Laboratories AG TeamDavid's Webbox component through Rollout 524 via Server-Side Request Forgery using UNC paths. The search endpoint's 'pathnameroot' parameter accepts network location strings (e.g., \\Server\Share) without sanitization, causing the server to initiate outbound SMB authentication to attacker-controlled infrastructure and leak NTLM hashes or session tokens. Where outbound port 445 is not filtered, an unauthenticated remote attacker can exploit this for SMB relay attacks or offline credential cracking, potentially enabling lateral movement into Active Directory environments. No public exploit code or CISA KEV listing has been identified at time of analysis.
Hono's `proxy()` function in the `hono/proxy` Proxy Helper leaks connection-scoped response headers to downstream clients by failing to strip headers named in the origin's `Connection` response field, violating RFC 9110 Section 7.6.1. Versions 4.7.0 through 4.12.33 of the npm `hono` package are affected; the function correctly removed well-known hop-by-hop headers but neglected to parse and remove the additional headers the origin declared as connection-scoped via `Connection`. No public exploit has been identified at time of analysis and exploitation is conditional on non-default origin behavior, limiting real-world priority despite the network-reachable attack vector.
SQL injection in Plesk Obsidian up to version 18.0.80 on Linux and Windows allows any authenticated panel user to read arbitrary data from the underlying control panel database. The CVSS scope change (S:C) reflects that the injected queries cross the application boundary into the database tier, and the high confidentiality impact (C:H) is consistent with a hosting control panel whose database contains cross-tenant customer records, credentials, and configuration data. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated denial of service in HashiCorp Consul's external gRPC listeners allows remote attackers to exhaust agent file descriptors, goroutines, and memory by flooding incomplete connections, rendering the agent unreachable to legitimate clients. Both Consul Community Edition and Consul Enterprise versions 1.13.0 through 2.0.2 are affected - a span covering nearly three years of releases. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 7.5 score and AV:N/AC:L/PR:N profile reflect a straightforwardly exploitable network condition requiring no attacker authentication or user interaction.
Remote denial of service in gopacket through version 1.7.0 can crash any Go application that processes untrusted network packets via DecodingLayerParser or direct DecodeFromBytes calls. Eleven protocol decoders - including TLS, DHCPv4, GTPv1U, IPSec AH, Diameter, and RadioTap - consume attacker-controlled length, count, or offset fields from raw packet headers before verifying them against the actual buffer size, causing an unrecovered Go runtime panic that terminates the processing goroutine or application. No active exploitation has been confirmed (not listed in CISA KEV), but the zero-privilege network attack surface makes this a credible operational risk for Go-based network monitoring, packet capture, and security tooling.
ClamAV's zip archive parser in Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning process by submitting a specially crafted zip file, resulting in a denial-of-service condition. The flaw stems from an out-of-bounds write (CWE-120) caused by missing boundary validation on zip file content during parsing. No public exploit code or active exploitation has been identified at time of analysis, but the fully remote, zero-authentication CVSS vector (AV:N/AC:L/PR:N/UI:N) means any attacker able to route malicious files through a ClamAV-enabled scanner can reliably trigger the crash.
Memory corruption in ClamAV's XAR file format parser allows remote unauthenticated attackers to crash the scanning process by submitting a specially crafted XAR archive to any service fronted by ClamAV, including Cisco Secure Endpoint deployments. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, unauthenticated network exploitation with no user interaction required. Cisco's own description hedges the impact beyond DoS - noting 'possibly other expanded impacts as a result of memory corruption' - which, given the CWE-120 root cause, means RCE potential cannot be ruled out pending deeper analysis. No public exploit identified at time of analysis.
Remote unauthenticated exploitation of ClamAV's GPT file format parser can crash the scanning process and potentially corrupt memory on affected Cisco Secure Endpoint deployments. The root cause is a faulty endian conversion in the GPT parser that writes out-of-bounds on the stack (CWE-121), reachable by any attacker who can submit a file for scanning - a condition met by default in mail gateway, web proxy, and endpoint deployments. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis, but the CVSS AV:N/AC:L/PR:N/UI:N profile means exploitation requires no special access and is trivially automatable.
Memory corruption in ClamAV's PESpin file format parser within Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PESpin-packed PE file. The root cause is improper boundary checks that trigger an integer overflow (CWE-190) during scan-time parsing, resulting in a denial-of-service condition and the vendor notes the possibility of expanded impacts beyond DoS due to the underlying memory corruption. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity and zero authentication requirement (AV:N/AC:L/PR:N/UI:N) make exploitation straightforward for any attacker who can route a file through the scanner.
Out-of-bounds buffer read in ClamAV's Mach-O file format parser allows remote unauthenticated attackers to crash the scanning process, producing a denial-of-service condition on any Cisco Secure Endpoint deployment that processes Mach-O binaries. The flaw stems from missing boundary validation when parsing Mach-O file content, and Cisco explicitly acknowledges the possibility of expanded impacts beyond DoS due to the underlying memory corruption primitive. No public exploit code or active exploitation confirmed in CISA KEV at time of analysis, but the zero-authentication, network-accessible attack surface demands prompt patching for gateway and mixed-OS endpoint deployments.
Out-of-bounds read in ClamAV's PDF file format parser, embedded within Cisco Secure Endpoint, enables unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PDF file. The improper boundary validation during PDF content parsing causes memory corruption that terminates the ClamAV process, resulting in a denial-of-service condition; Cisco's own advisory acknowledges 'possibly other expanded impacts' from the memory corruption, leaving the full impact scope incompletely characterized at publication time. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, though the zero-privilege network vector makes automated exploitation mechanically straightforward.
Double-free memory corruption in ClamAV's zip archive parser allows an unauthenticated remote attacker to crash the ClamAV scanning process, producing a denial-of-service condition on Cisco Secure Endpoint. Exploitation requires only submitting a crafted zip file to any scanning interface backed by ClamAV, with no authentication or user interaction necessary per the AV:N/AC:L/PR:N/UI:N CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and ubiquitous file-submission attack surface make this a credible operational risk.
Resource exhaustion in the sol MQTT broker (commit 373d848, 2024-12-12) allows unauthenticated remote attackers to cause a denial of service by flooding the service with malformed or duplicate CONNECT packets. The broker's session teardown logic is incomplete: failed or repeated CONNECT attempts silently drop the connection without releasing internal state, leaving memory and file descriptors allocated indefinitely. With no authentication required and the attack confirmed automatable per SSVC, a sustained flood of crafted CONNECT packets can exhaust system resources and trigger the Linux OOM killer. No public exploit code was formally released as a tool, but a POC is referenced in the linked GitHub advisory; the vulnerability has not been added to the CISA KEV catalog.
REST API connection exhaustion in Klever-Go versions 1.7.14 through 1.7.17 allows unauthenticated remote attackers to render node API services unavailable by holding slow-header connections open until server file descriptors are exhausted. The root cause is Gin's Engine.Run convenience method, which delegates to Go's default http.ListenAndServe without any ReadHeaderTimeout, ReadTimeout, or MaxHeaderBytes configured, leaving incoming connections open indefinitely if the client never completes request headers. A proof-of-concept documented in GHSA-w4c6-7r69-w7j9 confirmed that 120 such connections caused all 20 of 20 legitimate API probes to fail with 'accept: too many open files' on v1.7.17; no CISA KEV listing was found, and no public exploit beyond the researcher's PoC is identified at time of analysis.
Unbounded goroutine exhaustion in Klever-Go versions 1.7.14-1.7.17 allows any connected libp2p peer to remotely degrade or deny service to a Klever blockchain node by flooding it with well-formed direct messages. The root defect is architectural: `directMessageHandler` in `network/p2p/libp2p/netMessenger.go` spawns an unrestricted goroutine per incoming message before the processor-level antiflood layer can reject it, meaning admission control is structurally bypassed at ingress. No public exploit code has been identified at time of analysis, though the GHSA advisory provides a precise code walkthrough that substantially lowers exploitation complexity. The fix is available in v1.7.18.
Heap memory disclosure in Imager for Perl (versions 0.45_02 through < 1.034) exposes adjacent heap bytes to any application that processes attacker-supplied JPEG or WEBP images and surfaces EXIF tag values. The root cause is a signed integer underflow in copy_string_tags() that causes strlen() to scan past a zero-count ASCII EXIF entry, copying arbitrary heap contents into the exif_* tag returned to the caller. Publicly available exploit code exists (confirmed by the exifattack.bin fixture in the upstream patch commit), and SSVC rates exploitation as automatable; no CISA KEV listing indicates active mass exploitation has not yet been confirmed.
Unauthenticated remote crash in Klever-Go versions 1.7.14-1.7.17 allows any network peer to terminate a node process by gossiping a 3-byte protobuf Transaction with the RawData sub-message omitted, triggering a nil-pointer dereference in the synchronous P2P validation callback with no panic recovery. No account, stake, validator key, or funds are required - the attacker only needs network reachability to the libp2p gossip port. Repeated delivery targeting enough BLS validators can halt block production entirely, constituting a chain-halt attack against the Klever network. No public exploit code or CISA KEV listing was identified, but the trivial payload and zero-prerequisite nature of exploitation make this a high-urgency upgrade target.
Denial-of-service via unbounded recursion in HAPI FHIR prior to 6.9.11 allows an unauthenticated remote attacker to crash parsing and validation worker threads by submitting FHIR resources containing deeply nested XHTML narratives, JSON objects, or XML elements. The commit diff reveals the flaw spans three parsers - XhtmlParser, JsonParser, and XMLUtil - each lacking a nesting depth guard, so crafted input triggers mutual recursion that exhausts the JVM thread stack and raises an unrecoverable StackOverflowError. No public exploit has been identified at time of analysis and this vulnerability does not appear in the CISA KEV catalog, but the AV:N/AC:L/PR:N/UI:N CVSS vector confirms trivial, unauthenticated exploitation against any internet-facing FHIR endpoint accepting resource submissions.
Unbounded recursive JSON parsing in HAPI FHIR's org.hl7.fhir.utilities.json.parser.JsonParser (versions prior to 6.9.11) allows unauthenticated remote attackers to crash JVM worker threads by submitting a syntactically valid but deeply nested FHIR JSON document. The mutual recursion between readObject() and readArray() carries no depth counter, so a document with as few as ~600 nesting levels exhausts the thread stack and raises a StackOverflowError before structural FHIR validation runs - any service that does not isolate StackOverflowError may lose the worker thread or destabilize the process entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) rating reflects that exploitation requires no authentication and minimal complexity against any exposed FHIR validation endpoint.
Command injection in dracut's die() error-handling function allows an unauthenticated attacker on the adjacent network, controlling a rogue DHCP server, to execute arbitrary commands as root during initramfs boot-failure recovery. The flaw exists because error messages written into emergency hook shell scripts under the initramfs environment are not shell-quoted, and those messages can carry attacker-controlled data sourced from the DHCP ROOT_PATH option processed by the 40network module. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exploitation primitive is conceptually straightforward for anyone with DHCP server control on the local network segment.
Denial of service in the Go implementation of Apache Fory allows unauthenticated remote attackers to crash affected services by sending crafted serialized data containing malformed type metadata, triggering an uncaught Go runtime panic. Affected versions span 0.16.0 through 1.5.0 (exclusive), while all non-Go language implementations remain unaffected. No public exploit code or active exploitation (CISA KEV) has been identified; the EPSS score of 0.18% (8th percentile) corroborates low current exploitation activity despite the high CVSS base score.
Heap out-of-bounds write in RadiAnt DICOM Viewer is triggered when processing JPEG-compressed pixel data embedded in a crafted DICOM file, potentially enabling arbitrary code execution on the victim's workstation. Reported to CISA ICS-CERT as a medical device advisory (ICSMA-26-218-01), the vulnerability requires no privileges and only passive user interaction - consistent with file-preview or file-open workflows common in clinical imaging environments. The provided CVSS 4.0 score of 5.3 rates impact as availability-only (VA:L), which conflicts materially with the described RCE potential; this discrepancy is significant and should be independently verified. No public exploit code or CISA KEV listing has been confirmed at time of analysis.
Privilege escalation in NexTor IP Changer versions prior to 2.0.0 stems from OS command injection (CWE-78) caused by invoking privileged system commands via `sudo` with `shell=True`, allowing shell metacharacter interpretation of unsanitized input. On systems where passwordless sudo (NOPASSWD) is configured for the executing account, an attacker with local low-privilege access can inject arbitrary OS commands that execute silently with root privileges. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; real-world risk is bounded by the NOPASSWD requirement and the tool's niche deployment footprint. Version 2.0.0 resolves the issue.
Remote code execution in Sonatype Nexus Repository 3 (and legacy Nexus Repository 2) is achievable by any account holding the nexus:settings:update permission, which can submit arbitrary strings as realm identifiers to an internal configuration API that performs no validation against the registered realm set. Because unrecognized identifiers are persisted and re-evaluated on every realm load through a legacy code path (CWE-470, unsafe reflection), this allows unintended code to execute inside the Nexus Repository server process and can cause a persistent authentication lockout that is invisible through the administrative UI. A vendor-released patch is confirmed in Nexus Repository 3.95.0; no public exploit or CISA KEV listing has been identified at time of analysis.
Insecure direct object reference in TestLink 1.9.20 and earlier allows any authenticated user - including low-privilege guest accounts - to retrieve arbitrary file attachments from projects they have no membership in, by supplying sequential integer IDs to the attachmentdownload.php endpoint. The handler performs no project membership or role authorization check, enabling bulk enumeration of all attachments across the entire installation. No public exploit has been confirmed at time of analysis, though a researcher writeup exists; the attack is trivially automatable due to the sequential integer ID scheme.
Server-Side Request Forgery in the Telefunken TE24553B45V2DZ Smart TV firmware V2.78.0.0 allows a network-adjacent unauthenticated attacker to abuse the SmartCenter browserseturl command, redirecting the device's embedded browser to loopback (127.0.0.1) and internal network destinations that are otherwise unreachable through normal browser navigation. The Vestel MB181 / Voltron181 / TiVo OS platform's SmartCenter component fails to restrict target URL schemes and destinations, enabling the TV to serve as an internal SSRF proxy against its own locally-running services. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog; however, the zero-privilege, adjacent-network attack posture makes exploitation accessible to any local network attacker, including guests in hospitality deployments.
Heap buffer overflow in stb_truetype.h (nothings stb, up to version 1.26) allows a local attacker to trigger out-of-bounds heap reads by supplying a crafted TTF font file with an inflated endPtsOfContours value and truncated glyph data. Any application statically embedding this library - including game engines and graphics software - that loads attacker-controlled fonts via stbtt_GetGlyphShape() is exposed to potential heap memory disclosure and application crash. No public exploit code has been identified and EPSS at 0.16% (5th percentile) indicates low current exploitation probability; no CISA KEV listing confirms no confirmed active exploitation at time of analysis.
Out-of-bounds kernel memory read and GPU use-after-free in Imagination Technologies Graphics DDK exposes systems to kernel memory disclosure and potential arbitrary page corruption by local, non-privileged users. Incorrect array index validation in the GPU driver stack allows crafted GPU system calls to bypass kernel memory safety boundaries, resulting in both information disclosure (kernel memory read) and high-availability impact (UAF of arbitrary GPU-managed pages). No public exploit code or active exploitation has been identified; EPSS sits at 0.14% (4th percentile), indicating very low current exploitation probability.
Consensus quorum bypass in Klever-Go prior to v1.7.20 allows a low-privileged block producer to satisfy the two-thirds validator signature threshold using phantom padding bits in the PubKeysBitmap rather than genuine validator signatures. Because the BLS aggregate-signature check ignores bits beyond the consensus group size while the quorum counter does not, a crafted block header with set padding bits appears validly signed without a real supermajority, undermining blockchain finality and consensus safety. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 1.7.20.
The Home Assistant iOS Companion app silently executes tag-triggered automations when any co-installed untrusted app forwards a crafted tag event via iOS universal links, bypassing physical scan validation entirely. Affected versions are all iOS Companion app releases prior to 2026.5.0; the underlying Home Assistant core CPE (cpe:2.3:a:home-assistant:core:*:*:*:*:*:*:*:*) is also cited. Because automations can control physical devices such as smart locks and alarms, the I:H CVSS metric reflects real-world consequences beyond software state. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Silent automation execution in the Home Assistant Android Companion App prior to 2026.8.1 allows any co-installed app on the device to trigger arbitrary HA automations by forwarding a crafted tag URL to an exported Activity without user confirmation. The flaw exists because TagReaderActivity accepted both physical NFC intents and OS-routed deep links identically, with no caller validation or approval prompt before dispatching the tag scan to the Home Assistant server. No public exploit has been identified at time of analysis, but the attack is unattended and can control physical actuators such as locks or alarms.
Unauthenticated log file exposure in the Webbox component of Tobit Laboratories AG TeamDavid allows remote attackers to retrieve sensitive error messages and internal application details without any credentials. All TeamDavid versions through Rollout 524 are affected per CPE cpe:2.3:a:tobit_laboratories_ag:teamdavid:*:*:*:*:*:*:*:*. No public exploit code or active exploitation has been identified; this vulnerability was disclosed as part of a batch of 22 CVEs uncovered by InfoGuard researchers during a systematic security audit of the platform.
Unauthenticated remote attackers can trigger operator-configured scheduled jobs in Grav CMS when the scheduler-webhook plugin is installed and misconfigured, due to a compound-conditional short-circuit (CWE-303) that skips token validation entirely when no webhookToken is set. The primitive is job-triggering rather than attacker-controlled command injection: RCE is only achievable when an administrator has separately configured a scheduled job that shells out, a condition the attacker cannot influence. No public exploit has been identified at time of analysis, and the vendor-released fix is available in Grav v2.0.9.
Symlink-based path traversal in Smarty's Security::_checkDir() allows an attacker who can place a symbolic link inside a trusted directory (such as a template or upload path) to read arbitrary files accessible to the PHP process, bypassing the configured secure_dir sandbox entirely. Affected are Smarty 5.x versions prior to 5.8.2 and all 4.x releases prior to 4.5.7, when Smarty's Security policy is enabled. The root cause is that _checkDir() resolves paths via string normalization only, while the underlying file_get_contents() call faithfully follows symlinks to their targets outside the sandbox. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unverified password change in Sonatype Nexus Repository 3 allows any account holding the nexus:* permission to overwrite the administrator password by invoking an onboarding-phase endpoint that remains accessible after initial setup is complete. The endpoint enforces access using only the presence of a local onboarding artifact rather than a proper lifecycle state check, enabling a privileged-but-non-admin account to hijack the administrator credential without invalidating existing administrator sessions. No public exploit has been identified at time of analysis and Sonatype has released a fix in version 3.95.0.
Kirby CMS's REST API error handler exposes full server filesystem paths to unauthenticated remote users via unsanitized PHP exception messages. Affected are all Kirby installations on versions prior to 4.9.5 (4.x branch) and 5.0.0 through 5.5.1 (5.x branch) where the REST API has not been explicitly disabled. An attacker triggering a PHP-level error receives the raw exception message - including absolute paths such as '/var/www/kirby-site/content/' - enabling server directory enumeration that lowers the bar for chained attacks. No public exploit or CISA KEV listing has been identified at time of analysis.
Improper behavioral workflow enforcement in WonderTrader up to version 0.9.9 allows remote attackers to manipulate the FID_JYLB argument in the TraderDD::queryTrades function, causing the application to execute trading query operations in an unintended sequence. Per the CVSS 4.0 vector (AV:N/AC:H/PR:N/UI:N), exploitation is network-reachable without authentication but requires high attack complexity, limiting opportunistic abuse. A proof-of-concept exploit is publicly available (E:P), and the vendor did not respond to responsible disclosure, leaving no patch available at time of analysis.
Out-of-bounds heap read in Apache Fory C++ versions 0.14.0 through 1.4.x allows attackers supplying crafted deserialization payloads to trigger information disclosure or denial of service. The flaw resides specifically in the tagged integer fast-path deserializer and only manifests when the application processes structs with tagged integer fields. No public exploit or active exploitation has been identified at time of analysis, and a vendor-released patch is available in version 1.5.0.
Partial arbitrary file read in HashiCorp Consul Community Edition and Enterprise 1.18.21 through 2.0.2 allows a network-accessible, highly-privileged attacker to exfiltrate sensitive credential files from the Consul server host. The flaw is scoped to configurations using the Vault Connect CA provider with JWT or AppRole authentication - a non-default but production-relevant deployment pattern - and requires operator:write permission to exploit. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available in Consul 2.0.3 and corresponding Enterprise builds.
Denial-of-service in the TP-Link Archer A6 V4 router's embedded web server allows an authenticated, adjacent-network attacker to crash the httpd process or the device by sending a malformed request to the HTTP-WRITEOEM handler, which fails to validate input before passing it to flash-write logic. All Archer A6 V4 firmware versions prior to V4_1.15.10 Build 260625 Rel.25447 are affected, per EUVD-2026-54656 and TP-Link's own advisory. No public exploit code or active exploitation has been identified at time of analysis.
Denial-of-service in the TP-Link Archer A6 v4 httpd service allows an adjacent, authenticated attacker to crash the web management process or force a device reboot by exploiting a race condition in the asynchronous systool instruction handling path. All firmware builds prior to V4_1.15.10 Build 260625 Rel.25447 are affected; a vendor-released patch has been issued. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog - real-world risk is constrained by the adjacent network and high-privilege prerequisites.