Stored cross-site scripting in CamaleonCMS's cama_contact_form plugin lets a low-privileged authenticated user persist arbitrary HTML/JavaScript via the unsanitized before_html field on the contact-form edit endpoint, which lacks proper authorization checks. The payload executes in the browser of anyone who loads the contact form - including administrators - enabling cookie theft, forged authenticated requests, and session takeover. Reported by VulnCheck with a public technical writeup; no public working exploit code and no active exploitation are confirmed at time of analysis.
Stored cross-site scripting in CamaleonCMS (owen2345/camaleon-cms) lets an authenticated low-privileged user persist a malicious HTML/JavaScript payload as a draft post title, which executes in an administrator's browser when the admin views the drafts listing. Because the payload runs in the admin's authenticated session, it enables session/cookie theft and forged administrative requests, effectively escalating a low-privileged account to admin-level control. Reported by VulnCheck with a public technical write-up; no public exploit identified at time of analysis and not listed in CISA KEV.
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) enables an authenticated low-privileged user holding specific channel-related permissions to read or modify Kubernetes Secrets outside their authorized namespace scope. The CVSS S:C (Changed Scope) metric confirms the flaw crosses namespace trust boundaries - a critical boundary in multi-tenant Kubernetes environments - potentially exposing credentials, service account tokens, or application secrets belonging to other tenants, and enabling privilege escalation. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an information-disclosure oracle exploitable by authenticated builders. The `tlsCertificateKeyFile` and `tlsCAFile` fields in the MongoDB datasource configuration were passed unsanitized to the MongoDB driver as server-side filesystem paths, enabling a builder to probe arbitrary absolute paths on the shared multi-tenant server via `/api/datasources/verify` by comparing distinct driver error messages. No CISA KEV listing exists, but the GHSA advisory contains a fully working reproduction command; the vulnerability is specific to Budibase Cloud and does not affect self-hosted deployments.
Integrity-check bypass in CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 lets an attacker defeat the product's file-integrity verification: when a LUKS-encrypted volume is present, the software fails to validate that encryption correctly and then silently skips ALL CryptoPro integrity checks, so tampered files pass as trusted. This undermines the pre-boot/endpoint trust guarantees the product exists to provide, enabling evil-maid-style tampering. There is no public exploit identified at time of analysis, though the flaw is the subject of a Black Hat USA 2026 disclosure ('The Cost of Obscurity'); EPSS is very low (0.11%, 1st percentile) and it is not on CISA KEV.
Authentication bypass in the kin-openapi Go library (getkin/kin-openapi) before 0.144.0 lets unauthenticated remote attackers reach protected routes when an application uses openapi3filter.ValidationHandler as its enforcement middleware without explicitly setting an AuthenticationFunc. Because Load() silently substitutes a no-op callback for a nil AuthenticationFunc, every OpenAPI security requirement is treated as satisfied and the fail-closed guard is never reached. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the flaw is fail-open by default, disclosed with source-level detail in GHSA-r277-6w6q-xmqw, and carries a vendor CVSS of 9.1.
Divide-by-zero in Velociraptor's ShouldPadFile() function allows a rogue enrolled client to crash the server process by uploading a malformed sparse file. When a GUI operator attempts to expand the file in the web interface, the unguarded division triggers a Go runtime panic, taking down the server. No public exploit code is identified at time of analysis, and CVSS rates this Low (3.5) with availability-only impact, but the attack is straightforward for any attacker who controls an enrolled endpoint.
Credential disclosure in the Budibase low-code platform (versions prior to 3.40.1) lets an unauthenticated attacker steal a REST datasource's stored Bearer, Basic, or static-header secrets. Because RestIntegration._req in packages/server/src/integrations/rest.ts attaches getAuthHeaders and defaultHeaders before resolving the request host, a PUBLIC-role query invoked via POST /api/v2/queries/:queryId can be pointed at an attacker-controlled host - using an absolute URL or a {{ parameter }} in the path - and the API-masked (--secret-value--) credentials are delivered in cleartext. Publicly available exploit code exists (full PoC in the GHSA advisory); no public evidence of active exploitation. This is a bypass of the earlier GHSA-3gp5 fix, which closed the base-URL rewrite vector but added no same-origin check.
Server-Side Request Forgery in Budibase's AI table generation pipeline (versions prior to 3.39.4) allows a builder-level user to coerce the server into fetching arbitrary internal network endpoints - including cloud metadata services such as 169.254.169.254 - by crafting LLM prompts that cause the AI to output internal IP addresses as attachment column values. The vulnerable code path, `uploadUrl()` in `fileUtils.ts`, uses a bare `node-fetch` call with no SSRF blacklist validation, while sibling code paths in the same codebase correctly use `fetchWithBlacklist()`. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; a vendor-released patch is available in version 3.39.4.
Privilege escalation via OS command injection in IBM i Navigator for i (versions 7.3 through 7.6) allows any authenticated, low-privileged network user to execute arbitrary OS commands as the root user. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N) confirms this is a low-complexity, network-accessible exploit requiring only a valid user account - no additional privileges or user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full CIA impact make this a genuine remediation priority for IBM i environments.
Remote OS command injection in IBM i 7.5 and 7.6 enables authenticated attackers with low-privilege network access to execute arbitrary commands with elevated system privileges, resulting in complete compromise of confidentiality, integrity, and availability. The flaw (CWE-78) arises from improper neutralization of special characters passed to OS command processing functions without adequate sanitization. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and network-accessible attack surface make this a high-priority remediation target for any IBM i deployment.
Remote code execution in the archived Cloudflare pages-action GitHub Action (src/index.ts) allows network-adjacent attackers to exfiltrate CI/CD secrets - including CLOUDFLARE_API_TOKEN and GITHUB_TOKEN - from affected workflow runner environments. All published versions of cloudflare/pages-action are affected, and Cloudflare has confirmed no patch will be issued because the repository has been deprecated since 2024 and is scheduled for removal on 2026-09-18. No public exploit code has been confirmed at time of analysis, but the vulnerability was discovered and reported through Cloudflare's HackerOne program by external researchers.
Privilege escalation in IBM i versions 7.3 through 7.6 via the Navigator for i web-based administration interface allows an authenticated low-privileged user to elevate their session to root and execute arbitrary commands on the system. The CVSS 3.1 score of 8.8 (PR:L, AV:N, AC:L) reflects that exploitation requires only valid credentials and network access to the Navigator for i interface, with full confidentiality, integrity, and availability impact upon success. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Privilege escalation to root authority in IBM i 7.3 through 7.6 is achievable by any authenticated low-privileged user via a remote code execution flaw in the activation engine component. The activation engine executes with unnecessary system privileges (CWE-250), allowing a planted malicious script to run with root authority, resulting in full compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vendor has released a patch and the low attack complexity makes this a credible near-term threat for unpatched IBM i environments.
Remote authenticated attackers can execute arbitrary commands on IBM i 7.3 through 7.6 by exploiting improper privilege management (CWE-250), achieving full confidentiality, integrity, and availability compromise on affected systems. The CVSS vector of AV:N/AC:L/PR:L/UI:N confirms that only a low-privileged account and network reachability are required - no complex preconditions or user interaction needed. IBM has confirmed the vulnerability and released a patch via advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Progress Software WhatsUp Gold (all versions before 2026.0.2) allows unauthenticated attackers with adjacent network access to invoke a critical function exposed without authentication (CWE-306), executing arbitrary code as the IIS application service account. The CVSS 3.1 score of 8.8 with PR:N and UI:N confirms zero-credential, zero-interaction exploitation against all pre-patch deployments. No public exploit has been identified at time of analysis, but a vendor patch is available in version 2026.0.2 per the August 2026 security bulletin.
Pingvin Share X versions 1.5.0 through 1.18.0 expose an authentication bypass in TOTP management endpoints due to a JavaScript async/await coding defect. An authenticated attacker with a low-privileged account can modify or disable TOTP two-factor authentication settings on an account without supplying a correct password, effectively neutralizing 2FA protections. No active exploitation has been identified in CISA KEV, and no public exploit code has been reported, but the bypass is trivially reachable by any valid user of an affected self-hosted instance.
OS command injection in IBM i 7.3 through 7.6 allows a remote authenticated attacker to execute arbitrary operating system commands with the privileges of the affected service. The vulnerability stems from improper neutralization of special elements in OS commands (CWE-78), covering all four current IBM i release lines. No public exploit or CISA KEV listing has been identified at time of analysis, but the high CVSS score of 8.8 and full CIA impact triad reflect serious post-authentication risk on a platform commonly used for enterprise workloads.
Remote command injection in IBM i 7.3 through 7.6 allows a network-accessible authenticated attacker to execute arbitrary OS commands by supplying shell metacharacters in unsanitized input, resulting in full confidentiality, integrity, and availability compromise of the affected system. IBM confirmed and patched this vulnerability, documented at https://www.ibm.com/support/pages/node/7283275. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal authentication bar make this a credible threat to any internet-exposed IBM i environment.
Privilege escalation in Semaphore UI allows an authenticated project manager to gain owner-level project control by exploiting a role-shadowing flaw in the custom role creation API. Affected versions prior to 2.18.19 and between 2.19.0-alpha3 and 2.19.5-beta5 permit a project manager to POST a custom role with a slug matching a built-in role name and bitmask 15, causing the middleware to resolve the database-backed custom role instead of the protected built-in, thereby granting CanUpdateProject and CanManageProjectUsers capabilities reserved for owners. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the low exploitation complexity (AC:L, single API call, no special configuration) and high CVSS impact (8.8) make upgrading urgent for any deployment with untrusted project managers.
Heap-based buffer overflow in the MongoDB BI Connector ODBC Driver enables process memory disclosure, process termination, or arbitrary code execution when an application processes crafted stored procedure output parameter metadata returned by a malicious or impersonated database server. All versions prior to v1.4.9 are affected (CPE: cpe:2.3:a:mongodb:bi_connector_odbc_driver:*:*:*:*:*:*:*:*), and the attack does not require privileges against the driver itself, though the attacker must control or impersonate the upstream database server. MongoDB has released a patched version (v1.4.9) that adds buffer-clamping logic to prevent the overflow; no public exploit has been identified at time of analysis.
Path traversal (Zip Slip) in Joomla 6.1.1's com_joomlaupdate component enables persistent remote code execution when a Super User is socially engineered into extracting a crafted ZIP archive via the administrator interface. The extract.php extraction routine failed to validate ZIP entry filenames for parent-directory sequences (`..`), absolute Unix paths, Windows drive letter paths, or UNC paths - allowing an attacker-supplied archive to write arbitrary PHP files outside the intended extraction root. No confirmed active exploitation (not in CISA KEV); an upstream patch is available via GitHub commit and PR, though a tagged patched release version has not been independently confirmed.
Cache metadata poisoning in JFrog Artifactory enables a low-privileged authenticated user to corrupt cached artifact metadata entries, causing downstream consumers - including CI/CD pipelines and development toolchains - to silently retrieve untrusted or attacker-influenced content. All versions of Artifactory are listed as affected per the CPE wildcard, making this a broad supply chain integrity concern for organizations relying on Artifactory as a central repository manager. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the high CVSS score of 8.8 and network-accessible attack vector warrant prompt patching.
Zip slip path traversal in IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 allows a network-positioned attacker to write arbitrary files outside the intended extraction directory when a victim imports a maliciously crafted configuration archive. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-deliverable with low complexity but requires the target user to actively import the crafted configuration - a social engineering dependency that is the primary limiting factor. No public exploit or CISA KEV listing has been identified at time of analysis; vendor patch is confirmed available.
OS command injection in IBM i 7.5 and 7.6 enables a local attacker holding low-level credentials to escalate privileges to a highly elevated system authority level by injecting shell metacharacters into an unsanitized OS command interface (CWE-78). Both release streams - 7.5 and 7.6 - running on IBM Power Systems hardware are confirmed affected per the IBM advisory. IBM has released a patch via their support portal; no CISA KEV listing and no public exploit code have been identified at time of analysis.
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module imports inside the scheduler process. By controlling a task instance's `next_kwargs` via the task execution API, an attacker can inject a crafted callback path that the scheduler's unconditional `awaiting_input` timeout sweep deserializes by re-running the `SyncCallback` constructor - triggering an import of the named module in the scheduler's process space. Because `SyncCallback` is itself an Airflow class, it bypasses the `allowed_deserialization_classes` allow-list, making tightening that setting ineffective. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS score of 8.8 reflects the severity of the potential scheduler process compromise.
Out-of-bounds write in the MongoDB BI Connector ODBC Driver exposes client applications to memory corruption and potential code execution when the driver processes malformed stored procedure parameter metadata returned by a malicious or compromised server. The root cause is a missing bounds check (CWE-120) on the parameter size field in the metadata parsing routine, affecting all versions prior to v1.4.9. No public exploit code or active exploitation has been identified at time of analysis, and MongoDB has released a fix in v1.4.9.
Privilege escalation in RustFS prior to version 1.0.0-beta.11 allows any authenticated user holding CreateServiceAccountAdminAction to create a root-parented service account by supplying an arbitrary target_user to the AddServiceAccount API, because the handler validates only the permission and never enforces scope - and prepare_service_account_auth automatically grants is_owner status to root-parented accounts. The resulting credential provides full owner-level access to all objects in the distributed storage cluster. No active exploitation has been confirmed (no CISA KEV listing), but the complete attack path is publicly documented in the fix PR, substantially lowering the exploitation barrier.
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution in the Scheduler and API server by placing a crafted value in an operator's executor_config field. The serialization layer reconstructed exception nodes by calling import_string() on an attacker-controlled class name with no allowlist, enabling import and invocation of arbitrary callables such as subprocess.check_output or builtins.eval. Both affected components hold the metadata database credentials and JWT signing secret, making full infrastructure compromise a realistic outcome. No public exploit has been identified at time of analysis, but no non-default configuration is required. This is a distinct sink from CVE-2026-33264, meaning deployments that already patched that earlier advisory remain fully vulnerable and must upgrade again to apache-airflow 3.3.1.
Token replay in Vulnerability-Lookup's account activation and password-recovery mechanism allows an attacker who captures a valid one-time link to repeatedly reset the victim's password throughout the entire TOKEN_VALIDITY_PERIOD, even after the legitimate user has already consumed that token. Because the application never records whether a token has been used and does not bind tokens to a specific workflow, a single intercepted link grants persistent account-takeover capability without requiring any knowledge of the victim's current credentials. Reported by CIRCL, no public exploit code or CISA KEV listing exists at time of analysis; an upstream patch is available via a GitHub commit.
Privilege escalation in IBM i 7.3 through 7.6 allows remote authenticated attackers to gain elevated privileges by submitting a crafted, client-supplied profile name that bypasses server-side validation. The root cause is improper privilege management (CWE-269) in profile name handling, enabling an attacker with only low-level authenticated access to escalate to higher system privileges. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and high impact across confidentiality, integrity, and availability make this a serious priority for IBM i environments.
Remote code execution in IBM Informix Dynamic Server 14.10, 12.10.x, and 15.0 is possible through a stack-based buffer overflow (CWE-121) in the oninit daemon's sq_sgkprepare function, triggered when processing a SQL interface request containing an unchecked length field. An authenticated, network-adjacent attacker with low-privilege SQL credentials can exploit this to achieve full compromise of the database server, resulting in complete confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis; IBM has released a patch via Security Advisory 7283143.
Second-order SQL injection in SiYuan's attribute-view template columns allows a remote attacker to execute arbitrary SQL against a victim's local kernel database by distributing a crafted document or package. All SiYuan releases before v3.7.4 are affected; the `queryBlocks` function processes attacker-controlled template column data through raw string substitution rather than parameterized queries, granting full read and write access across all notebooks upon import and render. No public exploit has been identified at time of analysis, but the attack is practically feasible in any community or collaborative context where SiYuan packages are exchanged.
Symlink following in KubeVirt's virt-handler migration proxy enables a low-privileged Kubernetes user holding namespace edit and pods/exec permissions to achieve full node compromise by redirecting a migration Unix socket to the host CRI-O container runtime socket. Because virt-handler runs as root within the host mount namespace and resolves socket paths through /proc/<pid>/root/ using net.Dial() without symlink validation, an attacker-controlled symlink placed in a qemu-writable directory causes virt-handler to transparently proxy arbitrary bytes into the container runtime, yielding complete control over the underlying Kubernetes node. No public exploit has been identified at time of analysis, but the scope change from container to host and the full CIA triad impact make this a critical remediation priority for all OpenShift Virtualization 4 deployments.
Memory exhaustion in etcd's TLS acceptor loop allows unauthenticated network attackers to crash etcd clusters - and the Kubernetes control planes they back - without completing a TLS handshake. The vulnerable code path in `client/pkg/transport/listener_tls.go` spawns a goroutine per inbound TCP connection with no timeout, meaning connections that never send a ClientHello block indefinitely inside `tls.Conn.Handshake()` and accumulate in an unbounded `pending` map. Exploitation is trivially automatable: no special protocol knowledge is needed beyond initiating TCP connections. No public exploit code or CISA KEV listing exists at time of analysis, but the Kubernetes control plane dependency elevates real-world blast radius well beyond a standalone etcd outage.
Format string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, including container deployments) enables authenticated administrative attackers to send crafted HTTP requests to the management interface, triggering uncontrolled format string processing. Successful exploitation produces high confidentiality impact through stack memory disclosure and high availability impact through service crashes, with CVSS scope change indicating potential downstream effect on identity services beyond the management component. No public exploit is identified at time of analysis; this is a vendor-confirmed finding reported directly by IBM PSIRT.
XXE injection in Eclipse RDF4J exposes applications to local file disclosure and server-side request forgery when parsing untrusted XML-based RDF data or SPARQL query results. The root cause is an incomplete remediation of CVE-2018-1000644: while that earlier fix hardened some parser entry points, several XML parser interfaces remained unprotected against DOCTYPE declarations, external entity references, and external DTD loading. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the unauthenticated network vector (CVSS 4.0: 8.7, PR:N) means any application exposing RDF ingestion endpoints is at risk without upgrading to RDF4J 5.3.2.
Quadratic-time CPU exhaustion in Shescape's flag-protection loop allows any attacker who can supply untrusted input to the escape, escapeAll, quote, or quoteAll APIs to cause denial of service without authentication or special configuration. Affected npm package versions 2.1.11-2.1.13 and 3.0.0 are vulnerable by default because flagProtection is enabled in the default configuration. The GHSA advisory includes a working proof-of-concept demonstrating approximately 20 seconds of processing time for a 32,000-repeat null-dash payload, and patched releases 2.1.14 and 3.0.1 are available; no active exploitation has been confirmed (not in CISA KEV).
SiYuan's publish mode in versions before v3.7.4 leaks Argon2id key-derivation material - including salt, cost parameters, password verifiers, and wrapped notebook data keys - through unauthenticated HTTP endpoints, enabling unlimited offline master-password cracking. Remote unauthenticated attackers who can reach a publish-mode SiYuan instance can retrieve all inputs needed to run offline Argon2id cracking campaigns with no server-side rate limiting. No public exploit has been identified at time of analysis, but the attack requires only standard HTTP requests once the target is located.
Insecure Direct Object Reference in Microsoft Container Migration Solution Accelerator version 2.1.2 and earlier enables any authenticated organization member to read, overwrite, and delete migration processes and files belonging to other users within the same tenant. The application delegates identity verification to Entra ID but implements no per-resource ownership checks across its process and file management API endpoints, meaning the authentication boundary is entirely decoupled from the authorization boundary. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full confidentiality, integrity, and availability impact on application data make this a high-priority remediation target for any multi-user deployment.
Missing authorization in the Execute Monitor API of the Amazon OpenSearch Alerting plugin allows any authenticated remote user to read, modify, or delete arbitrary index data by supplying crafted inline monitor requests with attacker-controlled data source and input index parameters. The flaw bypasses index-level permission enforcement, making it a meaningful privilege escalation risk in multi-tenant or shared OpenSearch deployments. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
Server-side request forgery and local file read in the OpenSearch Security Analytics plugin exposes authenticated users with low privileges as a vector for internal network reconnaissance and credential theft. The flaw resides in the threat intelligence feed parser, which fails to validate URL parameters submitted to the threat intel source configuration endpoint, allowing a crafted request to redirect server-side HTTP fetches to internal resources - including cloud metadata endpoints. Patch is confirmed available per Amazon's security bulletin AWS-2026-079; no public exploit code has been identified at time of analysis.
Path traversal in Canonical LXD's image metadata template processing enables an authenticated low-privilege attacker to read arbitrary host files or create files in arbitrary host filesystem locations. The flaw resides in the virtual machine/QEMU driver execution path, where LXD fails to sanitize template file paths from escaping the designated instance templates directory. Exploitation crosses the container/VM boundary to the host (scope change, S:C), making this high-severity in environments where host isolation is a security assumption. No public exploit code or CISA KEV listing has been identified at time of analysis.
Container image injection in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM 2) allows a low-privileged authenticated user with specific administrative permissions on a managed cluster to exploit the search-v2-operator component's improper configuration handling, overriding container image settings and deploying arbitrary images across the managed cluster. The CVSS 8.5 score reflects a scope-changed impact (S:C) where the breach crosses from the search operator into the broader managed cluster workload environment, enabling a supply chain-style compromise of running containers. No public exploit code or CISA KEV listing has been identified at time of analysis, limiting near-term opportunistic risk, though the insider or compromised-privileged-account threat model remains credible given the PR:L access requirement.
Improper authorization of namespace identity in GitLab Enterprise Edition 19.1.x and 19.2.x allows an authenticated low-privilege user to attribute AI feature usage to arbitrary namespaces they do not own, crossing organizational authorization boundaries within a multi-tenant deployment. The flaw, classified as CWE-639, arises because user-supplied identity information in requests is insufficiently validated before being used to authorize namespace-scoped AI operations, producing a scope change that affects namespaces beyond the attacker's own. GitLab has released patches in versions 19.1.4 and 19.2.2, and no public exploit code exists at time of analysis.
SQL injection in Phoenix Contact PLCnext controller web interfaces exposes a notification message SQLite database to manipulation by authenticated low-privilege users. The vulnerable endpoint is network-accessible with no attack requirements beyond a valid low-privilege account, making it trivially exploitable from any networked workstation in OT environments where such accounts exist. Impact is deliberately bounded by design to the notification subsystem - core PLC control logic, I/O, and safety functions are not affected - but notification tampering in industrial contexts may suppress or falsify operational alerts. No public exploit code exists and no CISA KEV listing is present at time of analysis.
Arbitrary code execution in Fujitsu Research's OneCompression (onecomp) Python library 1.2.0 is triggered when a victim loads a crafted PyTorch checkpoint file via the library's QuantizedModelLoader API, which unconditionally invokes Python's pickle machinery. The root cause is the hardcoded use of torch.load with weights_only=False in load_quantized_model_pt(), allowing an attacker-supplied checkpoint to embed malicious __reduce__ methods that execute arbitrary Python - including OS commands - in the context of the loading process. No public exploit code has been identified at time of analysis, though a patched version (1.2.1) is available on PyPI per the VulnCheck advisory.
Integrity validation failure in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 allows an attacker with local or physical disk access to craft malicious DataStore contents that trigger code execution in a high-privilege context or disrupt service availability on the host. The DataStore - a non-partitioned filesystem holding pre-boot configuration and cryptographic material - is parsed without authenticity verification, making it a viable Evil Maid attack surface. No public exploit identified at time of analysis, and EPSS at 0.18% (8th percentile) indicates very limited real-world exploitation activity; however, research presented at Black Hat USA 2026 details the vulnerability class.
Stack-based buffer overflow in the MongoDB BI Connector ODBC Driver setup dialog allows unintended code execution in the context of the user who opens the dialog. The flaw is triggered when a DSN configuration containing an over-length file path is loaded into the setup dialog and a file or folder selection is initiated, due to an incorrect buffer capacity calculation in that handler. No public exploit exists and no CISA KEV listing is present; however, a confirmed vendor-released patch is available in v1.4.9, which clamps DSN path field sizes.
Command injection in stata-mcp (pip:stata-mcp < 1.19.0) enables full OS-level remote code execution against any principal that can invoke the `ado_package_install` MCP tool. The `package` argument is concatenated unsanitized into a Stata command string delivered via pexpect.sendline(), allowing embedded newline characters to inject arbitrary Stata commands - including the `shell` escape - that execute under the account running the MCP server. Because the tool is registered in the default `all` profile and `all` is the active default, no misconfiguration by the victim is required; a detailed proof-of-concept confirmed via Docker reproduction is publicly available in the GitHub advisory, and a vendor-released patch exists in v1.19.0.