Incorrect authorization in Velociraptor's hunt_delete() VQL function grants investigator-role users the ability to permanently delete hunt results, a privilege that should be restricted to administrators holding the DELETE_RESULTS permission. The platform misapplied the COLLECT_CLIENT permission check in place of the DELETE_RESULTS gate, enabling lateral privilege abuse within authenticated sessions. No public exploit or active exploitation has been identified, but the integrity impact is high because hunt data represents forensic evidence collected during incident response operations.
Stored Cross-Site Scripting in the Royal Addons for Elementor WordPress plugin (all versions before 1.7.1065) allows authenticated users holding the Contributor role or higher to inject persistent malicious scripts by supplying an unsanitized value in a widget setting that is written directly into an HTML tag. When a higher-privileged user such as an administrator subsequently views the affected page, the injected script executes in their browser session. A publicly available proof-of-concept exists and EPSS is 15%, placing this above the median exploitation probability for medium-severity WordPress plugin flaws.
Password takeover in Semaphore UI prior to version 2.18.21 enables an unauthenticated attacker to reset any authenticated user's password - including administrator accounts - by luring them to a malicious page that silently issues a cross-site POST to /api/users/{id}/password. The session cookie was issued without SameSite restrictions, causing browsers to attach it automatically to cross-origin requests, and the endpoint performed no CSRF token validation or current-password confirmation before accepting the change. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is trivially constructable by anyone familiar with basic CSRF techniques.
Improper access control in the Cotton Cloud Joomla extension (versions prior to 2.0.3) enables horizontal privilege escalation across user accounts within a shared Joomla installation. Any authenticated user - regardless of privilege level - can read, delete, overwrite, or reassign permissions on files owned by other users, bypassing the extension's intended ACL enforcement. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes exploitation straightforward for any credentialed user.
Unauthenticated information disclosure in the Order Sync with Zendesk for WooCommerce WordPress plugin (all versions before 2.2.3) exposes full customer order history and cumulative purchase totals to any remote attacker who supplies a target's email address. The plugin's REST API endpoint omits both a WordPress capability check and any ownership verification, meaning the access control layer is entirely absent - not misconfigured but simply missing. A publicly available proof-of-concept exists (reported by WPScan), and SSVC assesses the vulnerability as automatable, making bulk enumeration of customer purchase data a realistic threat; however, no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
User Access Manager WordPress plugin before version 2.3.15 exposes restricted content to unauthenticated attackers via the WordPress REST API, which the plugin fails to protect with its own access control logic. Any post, page, or custom post type configured to be visible only to specific user groups can be silently read through standard REST API endpoints without credentials. A publicly available proof-of-concept exists (WPScan), and with an EPSS of 15% and automatable exploitation, this is a realistic risk for any WordPress site using this plugin to gate premium or sensitive content.
Unauthenticated IDOR in WP Travel Engine WordPress plugin before 6.8.5 exposes all customer booking records and stored billing information to any unauthenticated attacker who supplies a valid booking identifier to an unprotected cart action. The root cause is a complete absence of authorization and ownership checks - the plugin accepts a caller-supplied booking ID and processes it without verifying the requestor's identity or entitlement. Beyond disclosure, attackers can overwrite any customer's booking record with their own data, enabling fraud, booking manipulation, or data corruption at travel agencies. A publicly available proof-of-concept exists, and at 15% EPSS this vulnerability is elevated for its CVSS 5.3 rating - warranting prompt attention.
Privilege escalation in the Linux kernel's vxlan subsystem allows a local user holding CAP_NET_ADMIN in a vxlan device's network namespace to rewrite underlay configuration in a separate, more privileged namespace where they lack that capability. The flaw in vxlan_changelink() affects multiple stable kernel branches (6.6.x, 6.12.x, 6.18.x, 7.1.x, and 7.2-rc) and is most impactful in multi-tenant container or cloud environments where vxlan devices span namespace boundaries - a common topology in Kubernetes and OpenStack deployments. With an EPSS score of 17% and no public exploit or CISA KEV listing confirmed at time of analysis, this is an elevated-risk local privilege escalation requiring prompt patching on affected containerized infrastructure.
Concurrent TLS handshakes on Zephyr RTOS devices built with CONFIG_TLS_CREDENTIALS_BACKEND_PROTECTED_STORAGE cause a deterministic kernel panic and device reset via a NULL pointer dereference in the uninitialized credential mutex wait queue. The PSA Protected Storage credential backend in all affected Zephyr builds declared its serialization mutex without proper initialization, leaving its dlist sentinels as NULL; the fault triggers only on first contention but is fully deterministic once two threads race to acquire the lock. No public exploit has been identified and the issue is not in CISA KEV, though no exploit sophistication is required beyond opening multiple simultaneous TLS connections.
Improper access control in the Cotton Cloud Joomla extension (versions below 2.0.2) by tabaoca.org exposes a broken ACL implementation that allows unauthenticated remote attackers to perform arbitrary file operations - reading, deleting, overwriting, and reassigning permissions - on every file managed within the extension. The network-accessible, zero-authentication attack vector (CVSS 4.0 AV:N/AC:L/PR:N/UI:N) makes exploitation trivially low-effort against any Joomla site running an unpatched Cotton Cloud installation. No public exploit code or active exploitation has been identified at time of analysis, though the attack surface is broad enough that no specialized tooling is required.
Broken authorization in the Cookie Consent WordPress plugin before 0.0.10 allows any authenticated user - including a subscriber - to invoke administrator-intended REST API endpoints that control consent settings. Affected sites on the vendor's paid plan face an additional confidentiality exposure: the same misconfigured routes permit low-privileged users to read stored visitor consent logs, data that may carry GDPR compliance significance. A publicly available exploit exists, and an EPSS of 18% signals meaningful near-term exploitation probability despite the moderate CVSS score.
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced Cluster Management for Kubernetes 2 allows a compromised managed-cluster agent to read all Secrets and ConfigMaps within any Channel namespace on the hub cluster. The Changed scope (S:C) in the CVSS vector confirms that exploitation pivots from a managed cluster context into the hub, exposing Git and Helm repository credentials belonging to other tenants. No public exploit has been identified at time of analysis, but the network-reachable, low-privilege vector makes this a high-priority finding in any multi-tenant RHACM deployment.
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2 allows an authenticated namespace administrator to read Kubernetes Secrets from arbitrary namespaces outside their own authorization domain. By setting Channel.Spec.SecretRef.Namespace to a target namespace, the attacker causes the subscription controller to autonomously copy sensitive Secret contents into a namespace the attacker controls, violating the Kubernetes namespace isolation model. No public exploit code has been identified at time of analysis, but the scope-changed CVSS vector (S:C, C:H) and the sensitivity of Kubernetes Secret payloads - which frequently contain credentials, API tokens, and TLS private keys - make this a high-priority finding in any multi-tenant RHACM deployment.
Uninitialized memory read in the Linux kernel's libceph client library exposes stale kernel buffer contents and risks system instability on Ceph-connected hosts. The flaw exists in handle_get_version_reply(), which incorrectly uses msg->front_alloc_len - the allocated buffer size - as the decode boundary instead of msg->front.iov_len, the count of bytes actually received. A truncated MON_GET_VERSION_REPLY from a malicious or compromised Ceph monitor therefore passes the ceph_decode_need() guard and reads a second u64 from leftover bytes of a prior message, constituting an out-of-bounds read of uninitialized kernel memory. No public exploit has been identified at time of analysis, but the 16% EPSS score is elevated for a kernel library flaw and warrants prompt patching on Ceph-client deployments.
Arbitrary file read via path traversal in mcp-atlassian prior to 0.22.0 allows any authenticated MCP client to supply an absolute or traversal path to the confluence_upload_attachment tool, causing the server to open and exfiltrate the targeted file as a Confluence attachment. On Linux deployments, /proc/self/environ exposes live API credentials including CONFLUENCE_API_TOKEN, AWS keys, and database passwords, enabling full Atlassian account takeover and lateral movement. A confirmed prompt injection attack chain means threat actors who can write content an AI agent will read - such as a malicious Jira ticket - can trigger the same credential exfiltration with zero MCP credentials; publicly available exploit code and a demonstration video exist.
Incorrect authorization in the Cookie Consent WordPress plugin (versions before 0.0.10) allows any authenticated user - including low-privilege roles such as subscribers - to overwrite the plugin's stored geolocation service license key via a REST API route that fails its intended administrator-only capability check and falls back to a weaker authentication-only gate. The practical consequence is silent disruption of geolocation-based consent banner targeting, which can undermine GDPR and regional cookie-consent compliance workflows. Publicly available exploit code exists (no confirmed CISA KEV listing), and an EPSS score of 17% indicates above-average real-world exploitation interest relative to this severity class.
Denial of service in GitLab CE/EE (versions 18.5 through pre-19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2) allows unauthenticated remote attackers to exhaust server resources through improper input validation, rooted in CWE-770 (resource allocation without throttling limits). Exploitation is conditional - the description explicitly qualifies 'under certain conditions' - which is reinforced by SSVC classifying the attack as non-automatable despite a CVSS PR:N/AC:L rating. A publicly available proof-of-concept exists via a HackerOne disclosure, though EPSS sits at only 0.41% (34th percentile) and CISA has not listed this in the KEV catalog, suggesting exploitation remains opportunistic rather than widespread.
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email addresses, user IDs, SSO identifiers, and document revision metadata via a public API endpoint that was intentionally exempted from authentication middleware - accompanied by a `TODO` comment in source acknowledging it should have been restricted. Any network-reachable unauthenticated caller can query the Worker service endpoint `GET /api/global/users/tenant/:id` with an email or user identifier and receive a full `PlatformUser` document. No public exploit code has been identified at time of analysis, though the attack is trivially reproducible from the public GitHub security advisory alone.
Out-of-bounds memory read in the Linux kernel's in-kernel SMB server (ksmbd) lets a remote, unauthenticated client leak adjacent kernel memory. The receive path applied the minimum SMB2 PDU size check only to packets with ProtocolId SMB2_PROTO_NUMBER, so a short packet carrying SMB2_TRANSFORM_PROTO_NUM slipped past validation on an SMB 2.1 connection (which offers no transform handling) and reached init_smb2_rsp_hdr(), which read past the request allocation and returned the copied fields to the client. Rated CVSS 9.1 with an EPSS of 11%; no public exploit or CISA KEV listing is indicated, so this is no public exploit identified at time of analysis.
GPU shader validation bypass in the Linux kernel's drm/vc4 driver allows local low-privileged users to rewrite validated shader bytecode after it has been approved by the GPU security validator. Specifically, vc4_gem_object_mmap() rejects writable mappings of validated shader buffer objects (BOs) but neglects to clear VM_MAYWRITE, enabling a two-step attack: map the BO read-only, then invoke mprotect() to silently upgrade the mapping to PROT_WRITE, bypassing the one-time validation check the GPU trusts unconditionally. No public exploit has been identified and no CISA KEV listing exists, but an EPSS of 17% is elevated for a local-only kernel driver issue, warranting prompt patching on affected Raspberry Pi and BCM283x-based platforms.
Privilege escalation in GitLab Enterprise Edition exposes project governance controls to any authenticated project member due to missing authorization checks on the project update API endpoint. Affecting EE versions 19.1.0 through 19.1.3 and 19.2.0 through 19.2.1, this flaw lets lower-privileged users (developers, reporters) silently overwrite project settings normally restricted to maintainers or owners - including branch protection rules, merge approval requirements, and access policies. A publicly available exploit exists via HackerOne; active exploitation is not confirmed by CISA KEV, but the low attack complexity combined with public proof-of-concept code significantly elevates operational urgency.
WP Crowdfunding WordPress plugin before version 2.2.1 allows any subscriber-level authenticated user to create crowdfunding campaign posts by exploiting a missing capability check in an AJAX action endpoint. The plugin fails to verify whether the requesting user holds the campaign-submission permission, allowing low-privilege WordPress roles to perform actions reserved for higher-privileged users. A publicly available exploit exists via WPScan, and an elevated EPSS of 14% signals meaningful real-world exploitation interest despite no CISA KEV listing.
Insecure Direct Object Reference in WP Crowdfunding (WordPress plugin, all versions before 2.2.1) allows any authenticated user with Subscriber-level access to read personal data from arbitrary WooCommerce orders and enumerate the store's complete order history. The flaw stems from missing order ownership verification, meaning low-privilege accounts - freely obtainable on sites with open registration - can harvest customer PII at scale. A publicly available exploit documented by WPScan exists, and the 14% EPSS score indicates meaningful real-world exploitation interest beyond what the mid-range CVSS score alone suggests.
Broken object-level authorization in the WP Crowdfunding WordPress plugin before 2.2.1 allows any authenticated user - including low-privilege Subscribers - to modify the update history of campaigns they do not own and trigger notification emails to that campaign's backers. The vulnerability stems from missing ownership verification on campaign update endpoints, enabling horizontal privilege escalation across all campaigns on the affected site. A publicly available proof-of-concept exists (reported by WPScan), and the EPSS score of 14% is notably elevated relative to most WordPress plugin flaws, warranting prompt patching on sites hosting active crowdfunding campaigns.
Insecure Direct Object Reference (IDOR) in KiviCare WordPress plugin before 4.5.2 allows any authenticated patient-level user to retrieve bills, invoices, and appointment records belonging to other patients without authorization. The plugin fails to verify record ownership server-side, meaning a low-privilege patient account is sufficient to enumerate and access sensitive healthcare and financial records of arbitrary other patients. A publicly available proof-of-concept exists via WPScan, and the EPSS score of 14% indicates meaningful near-term exploitation probability.
Eventin WordPress plugin versions from 4.1.9 through 4.1.19 exposes customer order records - including personal information - to any contributor-level or higher WordPress user via an Insecure Direct Object Reference (IDOR) flaw. Authenticated users can enumerate order identifiers sequentially to read arbitrary customers' purchase data without authorization. A public proof-of-concept is available via WPScan, and an EPSS score of 14% places this notably above the median for WordPress plugin vulnerabilities, indicating active interest from threat actors even without a CISA KEV listing.
Arbitrary code execution at the firmware level is possible in Insyde Software's InsydeH2O UEFI implementation due to the absence of verified boot enforcement on certain Firmware Volumes (FVs). A local attacker holding high-privileged OS or physical access can inject unsigned or tampered code into unverified FVs, achieving persistent below-OS execution that survives operating system reinstalls and standard endpoint security controls. No public exploit has been identified at time of analysis, and this vulnerability has not been listed in the CISA Known Exploited Vulnerabilities catalog.
Missing input validation in the Linux kernel's drm/vmwgfx driver allows a low-privileged local user on a VMware guest VM to supply an arbitrary array_size value in vmw_surface_metadata via ioctl, bypassing per-Shader-Model limits and triggering out-of-bounds kernel memory access with high confidentiality, integrity, and availability impact. Affected kernel versions span 5.7 through multiple stable branches, with patches now available for 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. No public exploit code or CISA KEV listing has been identified at time of analysis, though EPSS at 16% signals a meaningfully elevated probability of eventual exploitation.
Use-after-free in the Linux kernel's btrfs filesystem driver allows a low-privileged local user to cause kernel memory corruption with full system compromise potential. Introduced by a regression in commit f86f7a75e2fb, the btrfs extent map splitting code in btrfs_drop_extent_map_range() incorrectly propagates EXTENT_FLAG_LOGGING to child split maps, which are never cleared of this flag; when the extent map shrinker later frees such a map while it remains on the inode's modified_extents list, a use-after-free is triggered. No public exploit has been identified at time of analysis, but an EPSS of 16% signals elevated exploitation probability for a local kernel UAF affecting Linux 6.8 and later across multiple stable branches.
Heap overflow in the Linux kernel's txgbe network driver enables a local attacker to write beyond an allocated heap buffer during ethtool EEPROM reads, potentially escalating to full kernel compromise on systems with Wangxun txgbe 10GbE hardware. The flaw exists because txgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes into a buffer ethtool allocates to exactly length bytes, causing a 1-3 byte out-of-bounds write whenever the requested length is not 4-byte aligned. Vendor patches are available in Linux 6.19 and stable releases 7.1.6 and 7.2-rc5; no public exploit code or active exploitation has been identified at time of analysis, though the 16% EPSS score is notably elevated for a kernel driver defect.
Missing authorization on two administrative AJAX endpoints in ProSolution WP Client WordPress plugin before 2.0.9 allows any low-privileged authenticated user - including subscribers - to trigger administrative data synchronization and erase the plugin's activity log. The security nonce protecting these endpoints is exposed in the public-facing frontend, effectively nullifying WordPress's built-in CSRF protection and reducing the attack bar to any account with login access. A public exploit exists via WPScan, though CISA KEV lists no active exploitation and SSVC rates technical impact as only partial.
Insufficient authorization in WP Photo Album Plus (all versions before 9.2.09.002) allows any authenticated WordPress user-including low-privilege Subscriber accounts-to upload files into photo albums owned by other users or administrators. The flaw is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin's front-end upload endpoint accepts a caller-supplied album identifier without verifying ownership, enabling cross-user content injection. A publicly available POC exists via WPScan; no active exploitation is confirmed in CISA KEV, and the attack surface is constrained by a non-default configuration prerequisite.
Memory exhaustion in Net::CIDR::Set before 0.23 exposes any Perl application using the library to remote denial of service when untrusted input reaches `contains()` or `add()`. The `_encode` method in `lib/Net/CIDR/Set/IPv6.pm` accepted unbounded prefix lengths and allocated memory proportional to the supplied value - `::/100000000` produces a ~100 MB string and a 12.5 million-element Perl array before the input is rejected - with no authentication required (CVSS PR:N, AV:N). No public exploit is identified at time of analysis, but the 16% EPSS score is elevated for a library-level DoS, and vendor-released patch version 0.23 is confirmed available.
Unauthenticated shortcode injection in Kirki WordPress plugin (all versions before 6.2.1) allows any remote attacker to execute arbitrary registered WordPress shortcodes via unprotected front-end form submission REST routes. On a default WordPress install, exploitation leads to disclosure of the site administrator's email address and abuse of the victim domain as a mail relay to arbitrary recipients. A publicly available proof-of-concept exploit exists per WPScan, and a vendor patch has been released.
Authenticated customers on WooCommerce stores running Wallet System for WooCommerce before 2.7.10 can complete purchases for free by submitting arbitrarily inflated wallet deduction amounts during checkout that the plugin accepts without verifying against the customer's actual stored balance. This business logic flaw enables systematic payment fraud - any registered shopper can zero out an order total and receive goods or services without paying the merchant. A publicly available proof-of-concept exists per WPScan, making this trivially exploitable by any site visitor who can register an account, and patching should be treated as urgent.
Heap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously crafted Lottie animation files. An integer overflow in the 32-bit bitmap stride calculation inside vbitmap.cpp produces an undersized heap allocation; when the library then writes full-dimension pixel data into this allocation, heap corruption and application crash result. No public exploit has been identified at time of analysis, but any application embedding rlottie that renders untrusted animation content is exposed given the network-deliverable, user-interaction attack path reflected in CVSS PR:N/UI:R.
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to trigger excessive memory allocation, crashing any application that renders it. The root cause is unbounded amplification in the shape/repeater content tree: nested repeaters multiplied by point-heavy shapes (polystar, custom paths) can cause allocations that scale combinatorially with file complexity. All rlottie versions prior to the fix in GitHub PR #599 are affected; no patch release version is independently confirmed. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Server-side template injection leading to remote code execution in Microsoft's @prompty/core npm package (TypeScript runtime) allows an attacker who controls a .prompty template body to execute arbitrary JavaScript in the host Node.js process. The flaw affects @prompty/core versions <= 0.1.4 and the 2.0.0-alpha.1 through 2.0.0-beta.4 pre-releases, where the Nunjucks renderer permitted unrestricted member access, letting a malicious template walk constructor/prototype chains to reach a JavaScript execution primitive. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximum CVSS of 10.0 and CWE-94 code-injection root cause make this a critical-priority patch for any app that renders untrusted, community-supplied, cloned, or LLM-generated .prompty files.
Privilege escalation to host root in Canonical LXD occurs when the container manager unpacks crafted image or backup archives, because it follows a symbolic link where the backup.yaml metadata file should be and then processes attacker-controlled configuration outside its intended confinement. A low-privileged LXD user who can import a malicious archive can execute arbitrary commands as root on the underlying host, breaking the container/host trust boundary (scope change). Rated CVSS 9.9; no public exploit identified at time of analysis and not listed in CISA KEV, but the fix is coordinated through GitHub advisory GHSA-fv82-v4fj-mm4m.
Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with AMD v9 GPU hardware. The MQD control stack copy uses cp_hqd_cntl_stack_size directly from hardware registers without bounding it to the allocated Buffer Object, allowing memcpy to read past the BO into adjacent GTT memory. A local low-privileged user with access to AMD GPU compute queue checkpointing can recover sensitive kernel data; no public exploit has been identified at time of analysis, though the 15% EPSS score is above baseline for kernel information-disclosure flaws.
OS command injection in IBM Db2 Mirror for i (releases 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker execute arbitrary operating-system commands on the affected IBM i host by injecting unneutralized special characters into a command the product builds and runs. The flaw is rated CVSS 9.8 with full confidentiality, integrity, and availability impact and a network attack vector requiring no privileges or user interaction. No public exploit has been identified at time of analysis, but a vendor patch is available and the low attack complexity makes this a high-priority fix.
Remote code execution in IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated attacker to run arbitrary code by abusing an uncontrolled search path element (CWE-427), where a program resolves a library, service program, or executable from an attacker-influenceable location. Because the CVSS scope is changed (S:C), successful exploitation can execute code in a security context beyond the attacker's own low-privileged account, effectively enabling privilege escalation on this enterprise Power-based operating system. IBM has released a fix and there is no public exploit identified at time of analysis, but the 9.9 base score reflects severe impact once a foothold exists.
Arbitrary host file read and write in Canonical LXD occurs because the image import/unpack routine does not verify whether the bundled metadata.yaml entry is a symbolic link, letting an authenticated user with image-import rights supply a crafted archive whose symlinked metadata.yaml resolves to sensitive host paths. Rated CVSS 9.9 with a scope change (S:C), successful exploitation crosses the container/management boundary to read or overwrite files as the LXD daemon (typically root) on the host. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; details are published only in Canonical advisory GHSA-j825-cg34-5fr5.
Privilege escalation and arbitrary code execution in Red Hat's multicluster engine (MCE) for Kubernetes lets a low-privileged tenant holding create or update rights on ClusterCurator resources hijack the cluster-curator-controller's service account. Because the CreateJob() function unmarshals the attacker-supplied spec.install.overrideJob raw extension without validation, the injected Job runs with the controller's elevated permissions, enabling cluster-wide secret access and full compromise. Rated CVSS 9.9 by Red Hat; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Canonical LXD's NVIDIA GPU passthrough configuration handler fails to sanitize newline characters in user-supplied `nvidia.driver.capabilities` and `nvidia.require.*` instance config values, enabling an authenticated attacker to inject arbitrary directives into the generated `lxc.conf` file. Any LXD user with instance-creation or configuration-modification privileges can exploit this to escape the container boundary and execute arbitrary commands on the host with the full privileges of the LXD daemon - effectively achieving complete host compromise. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible, low-privilege attack path and scope-changed CVSS vector reflect an elevated real-world threat for shared or multi-tenant LXD deployments.
Authenticated command injection in Prowler (Cloud/API) before 5.36.0 lets a low-privileged user with provider-management access run arbitrary shell commands on the shared backend worker. The Kubernetes provider's connection test accepted a kubeconfig containing a legacy GCP auth-provider with cmd-path/cmd-args, which the kubernetes-python client executed via subprocess when POST /api/v1/providers/{id}/connection loaded it. No public exploit is identified at time of analysis, but the flaw is fixed in 5.36.0 and carries a critical 9.9 CVSS.
Path traversal in Canonical's LXD container and VM manager allows a user with backup import/restore privileges to write or read files outside the intended restore directory by embedding traversal sequences in the instance or storage-volume names stored in a crafted backup archive's metadata. Because LXD does not validate these names on import/restore, an attacker can corrupt or overwrite host files, potentially leading to full host compromise. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the very high CVSS (9.9) is driven by the scope-changing, high-integrity/availability impact on the host.
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the multicloud-operators-subscription controller as a confused deputy: by crafting Subscription Custom Resources, a namespace-admin causes the controller's highly privileged ServiceAccount to deploy attacker-chosen cluster-scoped resources. This breaks tenant isolation and can yield cluster-wide privilege escalation and arbitrary code execution. Rated CVSS 9.9 (scope-changing), with no public exploit identified at time of analysis and no active exploitation reported (not in CISA KEV).
Authorization bypass in Canonical LXD (6.0 before 6.10, 5.21.x before 5.21.6, 5.0.x before 5.0.8) lets an authenticated user smuggle disallowed instance configurations into a restricted project by triggering a cross-project, cross-cluster-member migration. Because the migration arrives at the destination node as an internal cluster notification, the destination skips all target-project restriction checks (CWE-863), so limits and security restrictions on the target project are not enforced. Rated CVSS 9.9; reported by Canonical with a vendor patch available, but no public exploit identified at time of analysis and it is not listed in CISA KEV.
Project-confinement bypass in Canonical LXD lets an authenticated user holding can_create_instances on a restricted project escape that project's security policy by migrating an instance into it. Because instancePostMigration never re-validated the incoming instance against the target project's enforced restrictions, an attacker could build a high-privilege or otherwise disallowed instance inside an unrestricted project and relocate it into the restricted one, inheriting capabilities (low-level container access, arbitrary devices, unrestricted network access) that the project was configured to forbid. Rated CVSS 9.9 by the vendor; no public exploit identified at time of analysis and it is not in CISA KEV.