Scheduled task configuration overwrite in Sonatype Nexus Repository 3 enables a low-privileged authenticated user - holding permission to create at least one scheduled task type - to corrupt the configuration of an unrelated existing task via mass assignment against the administrative UI. By injecting internal configuration keys into user-supplied task property values, the attacker causes the system to redirect its write operation onto a pre-existing task rather than creating a new one, disrupting or manipulating that task's behavior. No public exploit or active exploitation has been identified; vendor-released patch 3.95.0 resolves the issue.
Authenticated denial of service in HashiCorp Consul Community Edition and Consul Enterprise 1.18.0-2.0.2 allows a network attacker holding config-entry write permission to crash the Consul server agent by submitting a crafted service-router configuration entry. The flaw is rooted in a null pointer dereference (CWE-476) triggered along the Enterprise-to-Community Edition downgrade code path, meaning only deployments undergoing or having undergone that transition are exploitable. No public exploit code or active exploitation confirmed by CISA KEV has been identified; vendor-released patches are available and confirmed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Unrestricted access to the Document Follow API (update_follow) in Frappe framework allows any authenticated user to follow or unfollow arbitrary documents without authorization checks, constituting an Insecure Direct Object Reference (IDOR) flaw classified under CWE-639. Frappe versions prior to 16.20.0 (v16 branch) and 15.112.0 (v15 branch) are affected, enabling authenticated attackers to subscribe to change notifications for documents outside their authorization scope. No public exploit code exists and no active exploitation has been identified at time of analysis.
The email configuration verification endpoint in Sonatype Nexus Repository 3 (CE and Pro editions through 3.94.1) allows authenticated users holding the nexus:settings:update permission to submit arbitrary host and port values, causing the server to probe internal or restricted network addresses via Server-Side Request Forgery. Differences in server responses - connection timing, error codes, and success signals - act as a side channel revealing which internal hosts and ports are reachable from the Nexus server, enabling internal network enumeration. No public exploit has been identified at time of analysis, and vendor-released patch version 3.95.0 resolves the issue.
Stored cross-site scripting in HAPI FHIR's scan command allows an attacker who controls an Implementation Guide or FHIR profile to inject arbitrary JavaScript into generated scan.html reports. All versions of org.hl7.fhir.core, ca.uhn.hapi.fhir:org.hl7.fhir.validation, and ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli prior to 6.9.11 are affected. When a developer or CI pipeline scans the malicious IG and subsequently opens or publishes the resulting HTML report, the injected payload executes in the viewer's browser context - no public exploit or CISA KEV listing exists at time of analysis, but the fix commit and advisory are public.
Plaintext SQLite database storage in the Datadog Android application exposes operationally sensitive monitoring metadata to anyone with physical access to the device or the ability to perform forensic acquisition. Two Room-managed databases - LocalNotificationDatabase and SearchRecentDatabase - store incident notification recipients, deeplinks, service names, and free-text search queries without at-rest encryption; no SQLCipher or equivalent openHelperFactory configuration was found in the codebase. Protection relies entirely on the Android application sandbox, which is insufficient for this class of data in high-risk deployment environments such as on-call engineering teams managing production infrastructure. No public exploit code exists and CISA has not added this to the KEV catalog.
SELinux label manipulation via TOCTOU race condition in the policycoreutils fixfiles script allows a local low-privileged attacker to corrupt SELinux mandatory access control labels on arbitrary system files, including security-critical targets such as /etc/shadow. The flaw affects fixfiles when run in relabel or restore mode across all supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained by both a required race condition win and the need for an administrator to actively invoke fixfiles.
Uncontrolled resource consumption in HashiCorp Consul and Consul Enterprise 1.17.0 through 2.0.2 allows authenticated network callers to unboundedly inflate the Consul agent's intention-match cache via the Connect authorization endpoint, defeating explicitly configured cache-disable operator settings. This CWE-770 flaw degrades service mesh authorization availability and undermines a deliberate operational control. No public exploit code or active exploitation has been identified; HashiCorp has released patches across all affected release lines.
Open redirect in the Home Assistant Android Companion App (prior to 2026.6.1) enables credential phishing attacks against new users via crafted homeassistant://invite deep links. Because no screen in the invitation or onboarding flow displays the parsed server hostname before the WebView commits to it, an attacker who delivers a malicious invite link can silently redirect the victim's onboarding session to an attacker-controlled server presenting a look-alike login page. No public exploit code has been identified at time of analysis; the CVSS score of 4.3 (C:L) understates real-world impact given that captured credentials yield full smart-home access.
Authorization bypass in HashiCorp Consul and Consul Enterprise versions 1.19.1 through 2.0.2 allows authenticated callers to delete arbitrary sessions via the transaction API without holding the required `session:write` ACL permission. Any principal with valid credentials and network access to the Consul server's API can silently circumvent access controls that are correctly enforced on the standard session deletion endpoint. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low privilege barrier and straightforward API path make targeted misuse plausible in multi-tenant or shared Consul deployments.
L7 intention authorization bypass in HashiCorp Consul Community and Enterprise editions 1.20.1 through 2.0.2 allows an authenticated mesh workload to reach HTTP paths that are explicitly blocked by path-based deny intentions, when the service proxy is configured with a custom public listener. The flaw undermines a core service mesh security control - path-based L7 intentions - without requiring unauthenticated access or elevated privileges beyond mesh workload enrollment. No public exploit code has been identified and this CVE is not listed in CISA KEV; the CVSS 4.2 Medium score accurately reflects the configuration-dependent, authenticated nature of the attack.
Adobe Genuine Software Integrity Service on local systems exposes an Incorrect Authorization flaw (CWE-863) enabling any local attacker - without elevated privileges - to bypass the service's integrity-verification controls and obtain unauthorized limited write access to areas the service is designed to protect. All tracked versions of the service are affected per the open-ended CPE range published by Adobe. No public exploit or CISA KEV listing has been identified at time of analysis, and exploitation is constrained to the local environment, reducing mass-exploitation risk while remaining a realistic threat from malware, shared-account misuse, or low-privileged insider scenarios.
Use-after-free in Zephyr RTOS kernel queue peek operations (z_impl_k_queue_peek_head and z_impl_k_queue_peek_tail in kernel/queue.c) allows a local low-privileged thread to obtain a dangling pointer to freed heap memory by winning a race against a concurrent k_queue_get call on a shared queue. Successful exploitation - requiring SMP or preemptive concurrency - can leak a stale heap pointer or crash the system when the returned dangling pointer is subsequently consumed as a live buffer in the net_buf, Bluetooth, USB, or networking subsystems. No public exploit exists and no active exploitation is confirmed; CVSS scores this at 3.6 (Low), accurately reflecting the narrow race window and local-only attack surface.
Symlink following in File::Rotate::Simple before v0.4.0 allows a local low-privileged attacker to create arbitrary files with the permissions of the log-rotating process. When the non-default `touch` option is enabled and the log file path is a dangling symlink, the rotate method skips rotation (because the symlink target does not exist) but still invokes touch, which resolves the symlink and materializes the target at an attacker-controlled path. No public exploit code exists and EPSS is 0.17% (7th percentile), indicating negligible current exploitation interest.
Stale permission enforcement in Frappe's Document Follow subsystem allows authenticated users whose document access has been revoked or downgraded to continue receiving document-level data via scheduled email notifications. Affecting all Frappe v15 releases prior to 15.112.0 and v16 releases prior to 16.23.0, the flaw arises because notification generation never re-evaluates whether recipients still hold current read permission on subscribed documents at dispatch time. No public exploit code exists and no active exploitation has been confirmed; the vendor-assigned CVSS 4.0 score of 2.3 accurately reflects the narrow exposure window and the prerequisite that access revocation must have already occurred before the notification job fires.
CRLF injection in libvirt's virtual network driver enables privileged users holding network-definition rights to inject arbitrary dnsmasq configuration directives - including dhcp-script - into the generated dnsmasq config file, ultimately achieving arbitrary command execution as root on the hypervisor host. The root cause is the network XML parser's failure to strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes before writing them verbatim into the dnsmasq configuration. No public exploit has been identified at time of analysis, though an upstream fix commit exists in the libvirt GitLab repository; the official CVSS score of 2.3 appears to critically understate the impact relative to the described root code execution primitive.
Stored cross-site scripting in Domoticz's mobile dashboard (all versions prior to 2026.3) allows any authenticated API user to inject persistent JavaScript payloads via Text or Alert subtype device values. The ng-bind-html rendering path applies only an nl2br() newline transform with no HTML escaping, meaning stored payloads execute in every administrator's browser that loads the mobile dashboard. Successful exploitation enables session cookie theft and account takeover; no active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in MZ Automation libiec61850 up to version 1.6.1 allows an attacker on the adjacent IEC 61850 SV network segment to corrupt process memory by injecting malformed Sampled Values ASDU packets into the SVReceiver. The commit diff confirms that the parseASDU function in SVReceiver_stopThreadless assigned heap pointers for ASDU fields-svId, datSet, SmpCnt, ConfRev, RefrTm, SmpSynch, SmpRate, and SmpMod-without validating their lengths, enabling overflow via crafted field sizes. A public exploit has been released (E:P per CVSS 4.0 supplemental data); this vulnerability is not currently listed in CISA KEV but poses targeted risk to IEC 61850 substation automation and power grid environments.