Command injection in Azure Monitor Agent Linux Extension (versions 1.0.0 through pre-1.43) enables privilege escalation over a network by an authorized attacker with high-privilege access. The CVSS:3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms network-based exploitation yielding full confidentiality, integrity, and availability impact on the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is confirmed available from Microsoft MSRC.
Remote code execution in Zoom Clients allows a malicious meeting participant to exploit a buffer over-write vulnerability in the annotator function, achieving code execution on another participant's device over the network. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects high-complexity exploitation with a changed scope, meaning impact extends beyond the Zoom process to the underlying host. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE potential and network vector make this a high-priority patch target for organizations relying on Zoom for sensitive communications.
Remote code execution in Zoom Clients' annotator function allows a malicious meeting participant to compromise another participant's device by exploiting a use-after-free memory corruption flaw during a live meeting session. The CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H vector confirms network-accessible cross-participant exploitation with full CIA impact and scope change, requiring no in-meeting privileges but demanding high attack complexity consistent with UAF heap manipulation. No public exploit code has been identified at time of analysis, and no CISA KEV listing was found.
Server-side RDSTLS authentication bypass in FreeRDP prior to 3.30.0 allows a remote unauthenticated client to skip credential verification entirely - RedirectionGuid, username, domain, and password checks are all circumvented. The flaw exists in libfreerdp/core/rdstls.c: the server's rdstls_server_authenticate function accepted a RDSTLS_TYPE_CAPABILITIES PDU when it was expecting RDSTLS_TYPE_AUTHREQ, and because resultCode was initialized to RDSTLS_RESULT_SUCCESS rather than ACCESS_DENIED, the function returned success without any actual authentication occurring. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the bypass is mechanically straightforward for any attacker with RDSTLS protocol knowledge.
Privilege escalation in Microsoft PowerShell 7.4.x, 7.5.x, and 7.6.x stems from incorrect default permissions (CWE-276), enabling a locally authenticated low-privilege attacker to gain full system control. Exploitation requires local shell access and a user interaction trigger - an already-privileged user or process must execute PowerShell after the attacker has tampered with an incorrectly permissioned file or directory. No public exploit code and no active exploitation have been identified; SSVC confirms exploitation status as none and the attack is not automatable. Microsoft has released patched versions across all three affected branches.
Privilege escalation in the Windows Program Compatibility Assistant (PCA) Service, affecting a broad range of Windows 10, Windows 11, and Windows Server releases, stems from an integer underflow (CWE-191) that an authenticated local attacker can trigger to gain elevated - likely SYSTEM-level - privileges. The vulnerability requires only low-privileged local access with no user interaction, producing total confidentiality, integrity, and availability impact per the CVSS vector. SSVC assessment confirms no exploitation activity at time of analysis and no public exploit code has been identified.
Heap out-of-bounds read and write in FreeRDP's Kerberos SSPI layer (all versions prior to 3.30.0) allows a malicious RDP peer to corrupt memory during CredSSP/NLA Kerberos decryption by supplying a crafted GSS Wrap-token with an unbounded EC or EC+RRC field value. The flaw sits in the pre-session authentication path, meaning exploitation does not require an established authenticated session from the attacker's side. No public exploit has been identified at time of analysis and CISA KEV listing is absent, but the network-reachable attack surface during a common enterprise authentication flow warrants prompt patching.
AdminRenderer in Django REST Framework prior to 3.17.2 discloses unauthorized GET resource data to authenticated users who hold write-but-not-read permissions on a DRF view. When a POST request fails validation and returns a 400 Bad Request, the renderer internally calls view.get() without first invoking view.check_permissions(), embedding the full GET representation in the HTML error response visible to the requester. No public exploit is confirmed in CISA KEV, but SSVC rates exploitation as POC-level; risk is targeted rather than widespread.
Sandbox escape in Google Chrome on macOS exploits a use-after-free condition in the TabStrip browser component, enabling a renderer-level attacker to break out of Chrome's security sandbox. Affected are all Chrome for Mac versions prior to 151.0.7922.137. Critically, this vulnerability is a second-stage exploit primitive - it requires the renderer process to already be compromised via a separate, chained vulnerability before this UAF can be weaponized for full sandbox escape. No public exploit code or CISA KEV listing has been identified at time of analysis.
Spoofing via origin validation failure in Windows Network Address Translation (NAT) exposes Windows Server 2025 and Windows 11 (versions 24H2 through 26H1) to network-layer address spoofing by unauthenticated attackers on an adjacent network. The flaw, rooted in CWE-346, allows crafted packets to bypass NAT's origin-trust enforcement, potentially enabling man-in-the-middle interception or manipulation of traffic transiting the NAT boundary. The CVSS scope change (S:C) reflects that the impact extends beyond the host running NAT to other systems whose traffic passes through it. No public exploit code or active exploitation has been confirmed at time of analysis.
Kernel-mode stack overflow in Intel PROSet/Wireless WiFi Software for Windows allows adjacent unauthenticated attackers to crash affected systems, resulting in a full system denial of service. The flaw resides in Ring 0 (kernel privilege level) WiFi driver code, meaning a successful exploit triggers a kernel panic or Blue Screen of Death rather than a user-space crash. No public exploit or CISA KEV listing has been identified at time of analysis, and no exact patched version is confirmed in the available reference data - the Intel advisory INTEL-SA-01468 should be consulted directly.
Kernel-mode denial of service in Intel PROSet/Wireless WiFi Software for Windows allows an adjacent unauthenticated attacker to crash the target system by triggering an improper buffer restriction in the Ring 0 (kernel-level) WiFi driver component. The vulnerability carries a CVSS 4.0 score of 8.3, requires no authentication or user interaction, and is confined to adjacent-network attackers. Intel has acknowledged the issue via security advisory INTEL-SA-01468; no public exploit code exists and no CISA KEV listing has been identified at time of analysis.
Denial of service in Intel PROSet/Wireless WiFi Software affects the Ring 2 device driver layer, where an improper conditions check (CWE-754) can be triggered by an adjacent, unauthenticated attacker with no user interaction required. The vulnerability collapses wireless availability on the affected host and, per the CVSS 4.0 vector, cascades to subsequent system availability as well, meaning dependent network-connected services may also be disrupted. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Intel PROSet/Wireless WiFi Software for Windows contains a null pointer dereference in Ring 0 (kernel space) that an adjacent, unauthenticated attacker can exploit to crash the target system, resulting in a denial of service. The flaw resides in the WiFi kernel driver, meaning a successful trigger causes a kernel panic (BSOD on Windows) with high availability impact on both the vulnerable component and the broader system. No public exploit code has been identified at time of analysis, and no KEV listing exists, but the adjacent-network attack vector and zero-privilege requirement make this relevant for any environment where untrusted parties share a wireless segment with Intel WiFi-equipped Windows endpoints.
Insufficient certificate validation in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier exposes a privileged internal communication workflow to man-in-the-middle interception, enabling an attacker with adjacent network access to present a fraudulent certificate the application accepts without proper verification. Under controlled network conditions allowing a successful MitM position, an unauthenticated attacker (per CVSS PR:N) can read, modify, or inject data into what GMS treats as a trusted management channel, resulting in unauthorized configuration changes that propagate to managed SonicWall infrastructure. No active exploitation has been confirmed (SSVC exploitation: none) and no public exploit is identified at time of analysis, though the S:C scope change elevates potential downstream impact across the full managed appliance fleet.
Improper access control in Intel PROSet/Wireless WiFi Software device drivers (Ring 2) allows a local unprivileged process to cause a denial of service affecting both the wireless subsystem and, to a lesser extent, downstream system integrity. Affected systems running Intel wireless drivers are exposed to any unprivileged local code - no authentication, no elevated privileges, and no user interaction are required. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Improper Input Validation in Adobe ColdFusion 2023 and 2025 allows unauthenticated remote attackers to bypass security controls, gaining unauthorized read and limited write access to affected systems. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is a low-complexity, network-exploitable flaw requiring no privileges or user interaction, elevating real-world risk for any internet-facing ColdFusion deployment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but ColdFusion's history as a high-value target warrants prompt patching.
Memory exhaustion in Coturn's DTLS listener allows unauthenticated remote attackers to crash or degrade the TURN/STUN service by flooding it with fragmented DTLS ClientHello messages before cookie validation occurs. All Coturn deployments prior to version 4.16.0 are affected, as both dtls_server_input_handler() and create_new_connected_udp_socket() in dtls_listener.c retain OpenSSL reassembly state for attacker-declared inflated handshake lengths without first completing RFC 6347 cookie exchange. No public exploit has been identified at time of analysis, but the attack requires only UDP connectivity to the listener and no credentials whatsoever, making it accessible to any internet-facing adversary.
Local privilege escalation in Windows User Profile Service affects all major current Windows client and server releases, allowing any authenticated local user to gain SYSTEM-level privileges by exploiting improper symlink or junction-point resolution (CWE-59). The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms low attack complexity with no user interaction required - a standard domain or local account is sufficient. Vendor patch is available; no public exploit is identified at time of analysis, but the low barrier to exploitation makes this a practical post-compromise escalation primitive.
Privilege escalation via use-after-free in the Windows Kernel allows a locally authenticated low-privilege attacker to gain SYSTEM-level access on Windows 11 and Windows Server 2025. The vulnerability carries a CVSS 7.0 score with high attack complexity (AC:H), indicating exploitation likely requires precise timing or heap-grooming to succeed. No public exploit identified at time of analysis, and Microsoft has released patches addressing all affected build versions.
Cleartext SQL credential transmission in Ivanti Endpoint Manager Core before version 2024 SU7 exposes database credentials to any attacker capable of occupying a man-in-the-middle network position on the path between EPM Core and its external SQL backend. The underlying root cause is classified as CWE-295 (Improper Certificate Validation), suggesting the Core component fails to properly enforce TLS certificate validation - likely causing connections to proceed over unencrypted or improperly verified channels. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog; however, the network-accessible attack surface and high-value credential target make this a meaningful priority for organizations running EPM in network environments with untrusted segments.
Stored XSS in telegram-search (versions ≤ 1.2.8) allows any group member to execute arbitrary JavaScript in co-members' browsers by sending crafted messages to a shared Telegram group. The highlightKeyword function in MessageList.vue returned attacker-controlled message text directly to Vue's v-html directive without HTML escaping, creating a persistent, cross-user sink that fires when victims browse or search the message archive - zero clicks required on the victim's side beyond opening the interface. No public exploit has been confirmed as actively exploited and no CISA KEV listing exists, but the public fix commit (PR #654) fully documents the vulnerable code path, making payload construction trivial for any XSS-proficient attacker with group access.
Arbitrary file deletion in the GeoDirectory WordPress plugin (all versions through 2.8.169) permits authenticated attackers with subscriber-level access to delete any file the web server process can reach, trivially enabling remote code execution by targeting wp-config.php. The attack exploits a query-string consistency-check bypass in the delete_revision handler, which dereferences attacker-supplied attachment metadata paths without any post-type or filesystem-path validation. No public exploit code or CISA KEV listing was identified at time of analysis, though the description is sufficiently detailed to enable independent exploit development; any site with open user registration should treat this as an immediate priority.
Denial of service via improper input validation in Intel Active Management Technology (AMT) and Intel Standard Manageability firmware allows unauthenticated network-adjacent attackers to disrupt the out-of-band management interface. The CVSS 4.0 AT:P designation confirms that specific prerequisites - namely AMT being provisioned and network-accessible - must independently exist before exploitation is possible. No public exploit has been identified at time of analysis, and Intel has disclosed the issue under advisory INTEL-SA-01427.
Privilege escalation in Windows Win32K via a use-after-free memory corruption flaw enables a locally authenticated standard user to gain SYSTEM-level access across a broad range of Microsoft Windows desktop and server releases. The vulnerability resides in the win32k.sys kernel-mode driver and carries a CVSS 7.8 score with low attack complexity and no user interaction required once local code execution is established. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though vendor patch is available and Win32K LPE flaws are historically attractive as second-stage payloads in chained attack campaigns.
Unauthenticated S3 path traversal in Typebot versions prior to 3.17.0 allows any attacker to obtain presigned S3 PUT URLs for arbitrary object keys - including other tenants' private paths - by supplying an attacker-controlled filePath parameter to a deprecated public upload endpoint. Exploitation requires only knowledge of a valid public typebotId and blockId, both of which are typically visible in chatbot embed codes or share links. No public exploit has been confirmed at time of analysis, and this CVE does not appear in CISA KEV, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector indicates trivial remote unauthenticated exploitation against any Typebot deployment with S3 storage configured.
Type confusion in the Send Email node of the n8n workflow automation platform allows an attacker-supplied non-string expression value to pass uncoerced into Nodemailer, which then interprets it as a file path or URL rather than literal email content - enabling arbitrary local file disclosure and server-side request forgery (SSRF). Affected are n8n versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1, as confirmed by GitHub Security Advisory GHSA-2x35-3fw4-9jr4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; exploitation depends on a specific non-default workflow configuration that requires an unauthenticated webhook, pre-configured SMTP credentials, and direct mapping of untrusted input into the email body field.
Webhook signature verification bypass in AutoGPT Platform before 0.6.70 allows unauthenticated remote attackers to trigger execution of secret-protected generic webhook graphs as their registered owner. The flaw stems from the ingress router selecting the webhook manager from the untrusted URL provider path segment rather than from the stored webhook record, meaning a request routed through the /compass/ path invokes CompassWebhookManager's inherited no-op verify_signature instead of GenericWebhooksManager.verify_signature, neutralizing the X-Webhook-Secret guard entirely. No public exploit or CISA KEV listing has been identified at time of analysis, but the fix is available in the confirmed release v0.6.70.
Remote code execution via a stack-based buffer overflow in the Windows kernel TCP/IP driver (CWE-121) affects all major Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An unauthenticated remote attacker who can deliver crafted TCP/IP packets to an exposed system may gain kernel-level code execution without requiring user interaction. No public exploit or CISA KEV listing has been identified at time of analysis, though the kernel-mode attack surface and network-accessible delivery make this a high-priority patching target; Microsoft has released patches for all affected platforms.
ishankportfolio exposes contact form submissions containing personally identifiable information (PII) due to client-side database credentials being publicly accessible and database access rules being insufficiently restrictive. Versions prior to 1.0.1 are affected, and the CVSS vector (PR:N, AV:N) confirms unauthenticated remote access is possible without any special preconditions. Any actor who discovers the exposed API keys embedded in client-side code can read or modify stored form submissions - including names, email addresses, phone numbers, and messages - directly against the database. No public exploit or CISA KEV listing has been identified at time of analysis.
Incorrect authorization in FreeIPA's trust-fetch-domains command allows any authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, writing attacker-controlled trusted-domain and ID-range data into the FreeIPA LDAP directory. The flaw (CWE-863) stems from the command being gated by a read-only trust object permission rather than the required trust-administration permission, effectively bypassing the authorization boundary between read and write operations on cross-realm identity data. No public exploit has been identified and CISA has not listed this in KEV, but the scope-changed CVSS score of 8.2 and high integrity impact reflect serious potential for identity infrastructure tampering in environments running AD trusts.
Heap-based buffer overflow in the Windows iSCSI Target Service enables an unauthenticated remote attacker to trigger denial of service across a wide range of Windows Server versions from 2012 through 2025. The vendor-assigned CVSS vector of C:H/I:H/A:H suggests potential impact beyond the description's stated denial-of-service scope, warranting attention to whether memory corruption could extend to confidentiality or integrity compromise. No public exploit or active exploitation has been identified at time of analysis; however, SSVC designates the attack as automatable, elevating the urgency for organizations running exposed iSCSI targets to apply available patches.
Remote code execution in the Windows Remote Desktop Client enables unauthenticated network attackers to execute arbitrary code on a connecting client system by exploiting a heap-based buffer overflow triggered when the client processes a maliciously crafted RDP server response. All major Windows 10, Windows 11, and Windows Server editions from 2012 through 2025 are affected across x86, x64, and ARM64 architectures. No public exploit has been identified at time of analysis and CISA SSVC confirms no current exploitation; a vendor patch is available through the Microsoft Security Response Center.
Remote code execution in the Windows Remote Desktop Client exposes client machines across Windows 10, 11, and multiple Windows Server generations when connecting to an attacker-controlled RDP server. The heap-based buffer overflow (CVSS 8.1, AV:N/AC:H/PR:N/UI:N) allows a remote unauthenticated attacker to gain full control over a vulnerable client machine, though the AC:H rating reflects non-trivial exploitation preconditions. Microsoft has released patches across all affected product lines; no active exploitation is confirmed per SSVC and the absence of a CISA KEV listing, with EPSS at 0.64% (47th percentile) indicating low near-term exploitation probability.
Heap-based buffer overflow in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to execute arbitrary code in the context of the ColdFusion server process. The vulnerability requires high-complexity exploitation conditions outside the attacker's direct control, yielding a CVSS score of 8.1 rather than critical, but the triple-high impact (full confidentiality, integrity, and availability compromise) makes it a high-priority target. No public exploit code or CISA KEV listing has been identified at time of analysis, though ColdFusion's historical targeting by ransomware and state-sponsored actors elevates real-world urgency beyond what the AC:H qualifier alone would suggest.
Cleartext credential logging in the MongoDB Java Driver exposes outbound network connectivity credentials to any party with log read access during routine client initialization. Affected applications automatically write the credential to log output as part of normal operation - no special trigger, elevated privileges, or attacker interaction with the driver is required to produce the disclosure. While no public exploit or active exploitation has been confirmed, the CVSS 4.0 score of 8.2 reflects that recovered credentials can authenticate an attacker to separate network infrastructure beyond the affected application, producing a scope-changed confidentiality impact.
Remote code execution in Windows Routing and Remote Access Service (RRAS) allows unauthenticated network attackers to fully compromise affected hosts across an exceptionally broad range of Windows versions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is a use-after-free memory corruption flaw (CWE-416) combined with an authentication bypass, enabling an attacker to execute arbitrary code without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-exposed attack surface, zero-authentication barrier, and breadth of affected platforms make this a high-priority patching target. A vendor-released patch is available via Microsoft MSRC.
Remote code execution via heap-based buffer overflow in the Windows iSCSI Target Service affects a broad range of Windows Server versions from Server 2012 through Server 2025, as well as Windows 10 (versions 1607 and 1809). An unauthenticated network attacker can send a malformed iSCSI protocol request to trigger CWE-122 heap corruption and achieve arbitrary code execution on the target host. No public exploit identified at time of analysis and no CISA KEV listing, though the CVSS score of 8.1 (AC:H) reflects real exploitation complexity; the full C:H/I:H/A:H impact triad makes this a credible priority for environments running the iSCSI Target role.
Remote code execution via heap-based buffer overflow in the Windows RPC Runtime affects every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An unauthenticated remote attacker who can reach an exposed RPC endpoint can corrupt heap memory and achieve arbitrary code execution, yielding full confidentiality, integrity, and availability compromise of the target system. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the breadth of affected versions, combined with network accessibility and no authentication requirement, elevates operational priority for internet-facing and laterally-reachable Windows infrastructure.
Privilege escalation via use-after-free in the Windows DNS service exposes a broad range of Windows Server and Windows 10 systems to network-based attacks by unauthenticated adversaries. The race condition root cause (CWE-362) forces high attack complexity, as an attacker must win a precise timing window to corrupt freed memory and gain elevated privileges, reflected in the CVSS 8.1 score. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, though the full C/I/A impact across thirteen distinct product versions from Windows Server 2012 through Server 2025 warrants prompt patching.
Remote code execution affects Microsoft Azure Attestation service and Device Health Attestation Service via an integer overflow condition that leads to a heap-based buffer overflow (CWE-122). Unauthenticated network attackers can exploit this flaw - confirmed by PR:N in the CVSS vector - though the high attack complexity (AC:H) indicates precise exploitation conditions must be met. No public exploit code or CISA KEV listing has been identified at time of analysis, but the potential impact is critical: full compromise of confidentiality, integrity, and availability on the affected service.
Remote code execution via use-after-free memory corruption in Windows DNS enables unauthenticated network attackers to achieve full system compromise against exposed DNS servers. The CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms network-reachable, zero-privilege exploitation, though high attack complexity signals that reliable triggering requires precise memory state manipulation rather than simple packet delivery. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Remote code execution in Windows DNS Server allows unauthenticated network attackers to exploit a race condition in concurrent DNS request processing to achieve full system compromise. The flaw spans Windows Server 2016 through 2025 and select Windows 10 builds, targeting the server-side DNS component; the 'Authentication Bypass' tag indicates the race window undermines an internal access control that would otherwise gate execution. Microsoft has released build-specific patches; no public exploit code or CISA KEV listing has been identified at time of analysis, though the network vector and full C/I/A impact make this a high-priority patching target for any organization running the Windows DNS Server role.
Remote code execution via race condition in the Windows Remote Desktop Client enables unauthenticated network attackers to execute arbitrary code on affected systems across a broad sweep of Windows versions - from the aging Windows Server 2012 through the current Windows 11 26H1 and Windows Server 2025. The flaw (CWE-362) arises from improper synchronization of shared resources during concurrent execution within the RDP client stack, allowing an adversary who can win a precise timing window to achieve full code execution. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none, though the CVSS base score of 8.1 and total technical impact classification make this a meaningful patching priority.
Remote code execution is possible in Microsoft Azure Attestation and the Device Health Attestation Service due to a race condition (CWE-362) in shared resource handling. An unauthenticated network attacker who can win a precise timing window can achieve full confidentiality, integrity, and availability compromise of the affected service. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high-complexity nature of the flaw provides some natural exploitation barrier.
Remote code execution in Red Hat JBoss Enterprise Application Platform (EAP) via the openjdk-orb CORBA bridge allows unauthenticated network attackers to load and instantiate arbitrary Java classes from attacker-controlled URLs during IIOP object unmarshalling. The attack targets port 3528 and executes before EJB security interceptors are invoked, meaning EAP's own authorization layer provides no protection once the malicious payload is in flight. No public exploit or CISA KEV listing is confirmed at time of analysis, but the CWE-829 root cause class and full CIA:HHH CVSS impact reflect genuine arbitrary-code-execution potential under the required configuration.
Path traversal in electerm's RDP clipboard file transfer (prior to v3.15.120) lets a malicious RDP server write attacker-controlled files to arbitrary locations on the victim's filesystem. The `fileInfo.name` field from the RDP CLIPRDR protocol - fully controlled by the server - is passed unsanitized to `osResolve`, enabling `../` sequences to escape the user-selected save directory. No public exploit is identified at time of analysis; exploitation requires the victim to connect to a malicious RDP server and receive a clipboard file transfer.
Path traversal in electerm's recursive file transfer component allows a malicious FTP or SFTP server to write attacker-controlled content to arbitrary locations on the victim's filesystem, bypassing the user-selected download directory. The root cause is in `src/client/components/file-transfer/transfer.jsx` where server-supplied `file.name` and `folder.name` values are passed unsanitized to Node.js `resolve()`, permitting traversal sequences such as `../../` to escape the intended directory. No public exploit or CISA KEV listing exists at time of analysis, but SSVC rates the technical impact as total and the patch is confirmed in release v3.15.120.
Path traversal in electerm's SFTP client allows a malicious or man-in-the-middle SFTP server to write attacker-controlled file content to arbitrary locations on the connecting user's filesystem, bypassing the intended temporary directory confinement. All electerm releases prior to 3.15.120 are affected across all supported platforms (Linux, macOS, Windows). No public exploit code or CISA KEV listing exists at time of analysis, but the patch commit and GitHub security advisory are publicly visible, lowering the bar for independent reproduction. CVSS 8.1 reflects high integrity and availability impact gated by required user interaction with a malicious server.
Broken access control in Peppermint helpdesk (through commit ba6e217) allows any authenticated user to read, modify, or delete tickets, clients, and users owned by any other account. The root cause is that the `Config.roles_active` flag defaults to `false` on all default installations, rendering every permission check on ticket, client, and user handlers a no-op - ownership and administrative access controls are silently bypassed. No public exploit code or active exploitation has been identified at time of analysis, but the flaw is trivially exploitable by any user with a valid account on a default-configured instance.