Stored cross-site scripting in the Markdown renderer of maalfer Pentestify before v2.3.2 allows authenticated users to inject and execute arbitrary JavaScript within the application's origin by embedding a double-quote character inside a Markdown link URL. The front-end `markdownToHtml()` function escaped `&`, `<`, and `>` but omitted quote escaping, so a `"` in a user-supplied URL closes the surrounding `href` attribute and enables injection of HTML event handlers. The fix in v2.3.2, confirmed by commit 272f7d6 and a tagged GitHub release, adds `"` and `'` escaping to close the gap. No public exploit has been identified at time of analysis, and this CVE is not in the CISA KEV catalog.
Stored XSS in Pentestify's user management component (all versions before 1.1.1) enables an authenticated attacker to execute arbitrary JavaScript in another authenticated user's browser by registering a crafted username containing an HTML-encoded single quote. The escapeHTML() sanitizer in js/app.js encodes the character to ', but the browser HTML-decodes attribute values before the JavaScript engine parses the onclick handler, causing the encoded quote to reconstitute as a literal quote and break out of the JS string literal at runtime. No public exploit code has been confirmed at time of analysis, though the GitHub commit diff fully discloses the vulnerable code path and bypass technique, substantially lowering the bar for independent reproduction.
VoiceTra, a voice translation mobile application developed by Japan's National Institute of Information and Communications Technology (NICT), fails to correctly validate the destination server for its translation API communications (CWE-941), affecting both Android and iOS versions across all releases. An attacker capable of intercepting or redirecting the app's network traffic can substitute a malicious server, enabling theft of spoken or typed translation input and delivery of falsified translation output to the user. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the network-accessible attack vector and zero-privilege attacker requirement make opportunistic exploitation plausible in hostile Wi-Fi environments.
Cross-site scripting in rails-html-sanitizer 1.0.3-1.7.0 allows external SVG references to bypass sanitization when applications use non-default allowed tags including SVG reference elements such as 'use' or 'feImage'. The PermitScrubber correctly blocked external hrefs via the legacy 'xlink:href' attribute but failed to apply the same restriction to the SVG 2 plain 'href' attribute, which modern browsers also honor. Exploitation via 'use' requires the external SVG to be same-origin for script execution; 'feImage' enables cross-origin image loading for user tracking. No public exploit or CISA KEV listing exists at time of analysis.
OAuth2 access and refresh tokens belonging to SSO-authenticated users are exposed via the `/api/users/metadata` and `/api/users/metadata/:id` endpoints in Budibase prior to version 3.39.25, accessible to any user holding the POWER role. The root cause is a missing output-sanitization step in `packages/server/src/utilities/global.ts`, which stripped passwords and roles but never removed `oauth2.accessToken` or `oauth2.refreshToken` from API responses. A POWER-role attacker can harvest these tokens and authenticate directly against the connected identity provider (Google, OIDC) for persistent access to victim services outside of Budibase entirely. A detailed proof-of-concept curl command is published in GHSA-fcrw-f7gg-6g9f; no CISA KEV listing exists at time of analysis.
Terminal injection in gdu, a Go-based disk usage analyzer, allows ANSI escape sequences embedded in crafted filenames or directory names to reach the terminal emulator unfiltered after the TUI exits. Any operator who runs gdu against attacker-controlled filesystem paths — shared mounts, downloaded archives, or untrusted repositories — may have their terminal manipulated through clipboard hijacking (OSC 52), window title spoofing, or other escape-sequence-dependent effects. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA KEV catalog.
Forcepoint One Endpoint (F1E) on macOS prior to version v26.04.5758 allows any standard, non-administrative local user to disable the SafariExtension component that enforces Data Loss Prevention browser controls, effectively creating a blind spot in the organization's DLP posture. The CWE-754 root cause indicates the agent fails to properly validate exceptional or edge-case conditions when processing requests that alter the extension's operational state, permitting a low-privilege account to defeat a security control intended to require elevated rights. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Terminal escape injection in dua-cli allows attackers who can place crafted filenames on a filesystem to manipulate the terminal emulator of any user who subsequently browses that directory with dua-cli and exits the TUI. File names containing OSC or CSI escape sequences are printed unsanitized to stdout after TUI exit, enabling terminal title spoofing, clipboard hijacking, or other escape-sequence attacks against the victim's terminal session. No public exploit code has been identified and this vulnerability is not in CISA KEV; the CVSS 4.0 score of 4.8 reflects the local attack vector and passive user interaction required, limiting realistic blast radius to shared-filesystem or multi-tenant scenarios.
Unauthorized file access in IBM i 7.3 through 7.6 is possible via a TOCTOU race condition exploitable by local authenticated users. The flaw allows an attacker with local access and low privileges to win a timing window between a file permission check and the subsequent file operation, bypassing intended access controls. No public exploit code has been identified at time of analysis, but IBM has released a patch and the CVSS score of 7.1 reflects high confidentiality and integrity impact.
Insufficient access separation in HCL AION's shared storage architecture allows processes within the platform to access or modify files outside their intended scope. The CVSS vector (AV:L/AC:H/PR:H/UI:R/S:C) confirms exploitation requires local access with high privileges, high complexity conditions, and user interaction - all of which must align simultaneously. No public exploit code exists, and CISA has not added this to the Known Exploited Vulnerabilities catalog, placing this firmly in the medium-severity tier despite the scope change flag.
OAuth authorization code theft in @backstage/plugin-auth-backend prior to 0.29.2 is possible when experimental dynamic client registration or CIMD features are enabled and configured with wildcard-hostname or protocol-less redirect URI allowlist patterns. Full-string glob matching allows a crafted attacker-controlled URI embedding a trusted hostname suffix in its path component to pass the allowlist, delivering authorization codes to the attacker after a victim completes an OAuth flow. No public exploit has been identified and this CVE does not appear in the CISA KEV catalog; real-world impact is sharply bounded by the experimental, disabled-by-default nature of the affected features.
Stored XSS in Trix editor (all versions prior to 2.1.18) allows an authenticated low-privilege user to persist a javascript: URI payload via the paste path, which executes in victim browsers when the rendered content is viewed and the injected link is clicked. The entry vector exploits HTMLParser's mishandling of a crafted <span data-trix-attachment="{}"> element, which bypasses attachment processing and routes unvalidated attributes - including a malicious href - into the document model through StringPiece.fromJSON. No public exploit has been identified and the vulnerability is absent from CISA KEV; a vendor-confirmed fix is available in version 2.1.18.
Stored cross-site scripting in Worksuite SaaS Asset Management allows authenticated administrators to persist arbitrary JavaScript into the application database via the Location and Description fields of the asset creation form. All users who subsequently view an affected asset - regardless of their own privilege level - will execute the injected script in their browser, enabling session hijacking, credential theft, and unauthorized actions performed within their authenticated session context. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 4.6 (Medium) reflects the high-privilege prerequisite that meaningfully constrains the attack surface.
Improper certificate validation in Palo Alto Networks GlobalProtect app allows an unauthenticated attacker with an established man-in-the-middle network position to intercept and modify application-layer communications between the client and backend infrastructure. Affected platforms are desktop and non-mobile variants - iOS, Android, and Chrome OS deployments are explicitly confirmed unaffected. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the confidentiality and integrity impacts are rated High given successful interception enables full visibility and manipulation of application traffic outside the VPN tunnel.
Improper privilege management in IBM i 7.3, 7.4, 7.5, and 7.6 enables a locally authenticated low-privileged attacker to read sensitive information or alter data beyond their authorized scope. The flaw is rooted in CWE-269 and carries a CVSS 3.1 score of 4.4 (Medium), reflecting its local-only attack vector and limited impact. No public exploit code and no confirmed active exploitation have been identified at time of analysis; a vendor-released patch is available.
CVE-2026-62289 is an Ubuntu security update with no public technical details available at time of analysis. The sole intelligence source is a vendor report from Ubuntu, with no description, CVSS score, CWE classification, or affected component provided. The nature of the vulnerability, the affected subsystem, and attacker impact cannot be determined from available data.
Path traversal in IBM i 7.3, 7.4, 7.5, and 7.6 allows a remote authenticated attacker to read sensitive files outside their permitted directory boundaries, resulting in unauthorized information disclosure. The vulnerability carries a CVSS 3.1 base score of 4.3 (Medium) and is limited strictly to confidentiality impact - integrity and availability are unaffected. A vendor-supplied patch is available, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service against PostgreSQL DDL operations is achievable by any authenticated database user who creates a custom type, exploiting missing authorization checks in two specific code paths - range subtype assignment and SQL expression type references. By manufacturing an artificial type dependency through these unguarded paths, a low-privileged user can permanently block administrators from executing ALTER TYPE or DROP TYPE on the affected object, disrupting schema maintenance across PostgreSQL versions 14 through 18 prior to their respective patched releases (14.24, 15.19, 16.15, 17.11, 18.5). No public exploit code exists and active exploitation has not been confirmed by CISA KEV at time of analysis.
Buffer over-read in PostgreSQL's ascii() SQL function exposes up to 3 bytes of heap memory beyond a specific allocation boundary when processing a crafted text value. Authenticated database users on affected versions - PostgreSQL 14.x before 14.24, 15.x before 15.19, 16.x before 16.15, 17.x before 17.11, and 18.x before 18.5 - can trigger this condition via a malicious SQL query. The vulnerability is a partial information disclosure with limited impact; no public exploit code has been identified at time of analysis.
Buffer over-read in PostgreSQL's pg_trgm extension exposes limited heap memory values to authenticated low-privileged users through the side-channel of GiST index picksplit decisions. All four active major release branches are affected - versions before 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit has been identified and active exploitation has not been confirmed; the practical impact is constrained by the indirect, lossy nature of the information disclosure mechanism.
Cross-space alerting rule telemetry disclosure in Kibana allows an authenticated user with read access to alerting rules in one Kibana space to retrieve execution telemetry belonging to other spaces they are not authorized to access. The exposed metadata includes rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters - a meaningful control gap for organizations using Kibana Spaces for multi-tenant or departmental isolation. Fixes are available in Kibana 8.19.20 and 9.4.5 per Elastic advisory ESA-2026-105; no public exploit or CISA KEV listing exists at time of analysis.
Sensitive information disclosure in IBM i versions 7.3 through 7.6 allows a remote authenticated attacker to read heap memory contents by triggering a heap buffer overflow in a vulnerable network-accessible component. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms the attack is network-delivered with low-privilege authentication and yields limited but real confidentiality exposure with no integrity or availability impact. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; IBM has released a patch via PTF advisory and affected customers should apply it as a medium-priority remediation.
Elasticsearch's indexing pipeline contains an algorithmic complexity flaw (CWE-407) that allows any low-privileged authenticated user with document indexing rights to submit a single crafted document that occupies a worker thread in the bounded indexing thread pool for a disproportionate duration, degrading indexing availability on the affected node. Affected versions span both the 8.x and 9.x release lines, with fixes available in 8.19.20 and 9.4.5 per ESA-2026-77. No public exploit has been identified at time of analysis, and no active exploitation is confirmed.
Post-authentication denial of service in the russh Rust SSH server library crashes individual session tasks when an authenticated client sends a pty-req channel request with more than 130 terminal-mode records. Russh versions up to and including 0.62.3 are affected; the code path is reachable with default server and crypto configurations, requiring only a valid authenticated SSH session - no special server-side setup. No public exploit identified at time of analysis, though the GHSA advisory documents a working end-to-end proof-of-concept using the public Channel::request_pty() API.
Privilege management bypass in IBM i 7.3 through 7.6 permits remote low-privilege authenticated attackers to circumvent security restrictions and achieve limited unauthorized integrity modifications. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) confirms network reachability but imposes high attack complexity and mandatory prior authentication, significantly constraining the realistic attack surface. No public exploit code and no CISA KEV listing were identified at time of analysis, consistent with the low base score and high complexity requirement.
Elastic Security's case management API in Kibana fails to enforce the same authorization controls applied in the UI, allowing authenticated low-privileged users to modify case records they are only entitled to view. The vulnerability arises from a mass-assignment flaw (CWE-915/CAPEC-77) where the API accepts object attributes that bypass privilege checks enforced at the UI layer - a classic server-side trust boundary mismatch. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the low exploitation complexity (AV:N/AC:L/PR:L) makes it accessible to any authenticated insider or compromised low-privilege account.
IBM i versions 7.3 through 7.6 expose sensitive information to remote low-privileged attackers via a byte-count and element-count confusion flaw rooted in CWE-200. An authenticated network attacker can trigger the confusion to receive more data than the system should return, leaking sensitive content without user interaction. No active exploitation has been confirmed, no public proof-of-concept has been identified, and IBM has released a patch via their support portal.
Indirect prompt injection in HCL AION v2.5.0 enables authenticated network attackers to embed HTML markup into AI-generated rendered output, which may then be displayed to other platform users and trigger unintended browser behavior. Classified under CWE-1427 - a category specific to AI/LLM output sanitization failures - the vulnerability carries a vendor-assigned CVSS 4.3 Medium rating reflecting limited confidentiality impact and an authentication prerequisite. No public exploit code or active exploitation has been identified at time of analysis.
Kibana's Machine Learning space management feature performs an incomplete authorization check when removing a saved object from a space, accepting trained models as targets while only verifying privileges for anomaly detection jobs and data frame analytics jobs. Authenticated users whose roles grant ML job creation rights but lack the trained model privilege can therefore remove a trained model from the active space, despite having no legitimate authority over trained models. No public exploit is identified and this vulnerability is not listed in CISA KEV; real-world impact is bounded by the reversibility of the action and the non-deletion of the underlying model.
Authorization bypass in Zimbra Collaboration (ZCS) before 10.1.17 allows authenticated users to impersonate other accounts and send emails by exploiting improper permission validation in the SaveDraftRequest SOAP handler. An attacker with a valid low-privilege account can craft SOAP requests that circumvent delegation and send-as permission checks, enabling unauthorized email impersonation without possessing the required access grants. No active exploitation has been confirmed (no CISA KEV listing) and no public exploit code has been identified at time of analysis; the CVSS score of 3.1 reflects the constrained real-world impact.
Incorrect authorization in OpenNMS Meridian and Horizon's v2 Alarm REST API allows any authenticated ROLE_REST user to acknowledge, escalate, or clear alarms attributed to arbitrary usernames, effectively forging audit records without holding delegation privileges. An inverted boolean condition in AlarmRestService.java - `!StringUtils.isNotBlank(ackUser)` instead of `StringUtils.isNotBlank(ackUser)` - renders the credential delegation check dead code for any non-blank username supplied in the request. Users simultaneously holding ROLE_REST and ROLE_READONLY can additionally bypass the read-only restriction to modify alarm state. No public exploit exists and the vulnerability is absent from CISA KEV; vendor-confirmed patches are available via OpenNMS GitHub PR #8755.
Stale row-level security policy execution in PostgreSQL 14 through 18 permits authenticated database users to read or modify rows they are no longer authorized to access after role membership, role attributes, or database ownership are changed. The flaw lies in PostgreSQL's plan cache, which does not invalidate cached RLS policies when such privilege changes occur, meaning a revoked permission continues to be honored until the session ends or an unrelated cache invalidation event fires. No public exploit code has been identified and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog, but the partial data access bypass represents a real confidentiality and integrity risk for applications relying on RLS as a security boundary.
Cross-tenant run replay in Trigger.dev 4.4.2-4.5.0-rc.3 allows any authenticated API key holder to replay task runs belonging to other tenants by supplying a victim's run `friendlyId` to the replay endpoint, which performs no tenant isolation check. This unauthorized replay consumes victim compute resources and re-executes side effects such as outbound API calls, webhook triggers, and database writes. A secondary chained code path further allows attacker-controlled payload bytes - planted via a separate object-store path-traversal - to become input to the victim task when `payloadType: application/store` is in use. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Silent incomplete replacement of Quadlet unit files in Podman 5.8.x causes stale security-sensitive directives to persist after a `podman quadlet install --replace` operation on non-reflink filesystems. The missing O_TRUNC flag in the file-open call, combined with a non-truncating `io.Copy` fallback when reflink fails, means that if the replacement Quadlet is shorter than the original, trailing content from the old file survives undetected. A local low-privileged user who uses this command to remove a capability grant (e.g., AddCapability) or an extra volume mount may unknowingly leave those directives active, resulting in containers running with unintended elevated privileges or unauthorized data exposure. No public exploit has been identified at time of analysis.
PostgreSQL's GSSAPI authentication enforcement can be bypassed in versions 17.x and 18.x, allowing an authenticated database user to establish a connection protected only by TLS despite pg_hba.conf explicitly requiring GSSAPI. The bypass is achieved by initiating a direct TLS connection rather than a GSSAPI handshake, causing the server to accept the weaker protection profile when TLS settings are more permissive than GSS settings. No public exploit code and no CISA KEV listing have been identified at time of analysis; the EPSS score was not provided in source data.
Privilege escalation to root in Palo Alto Networks GlobalProtect App on macOS is enabled by a race condition exploitable by a locally authenticated, low-privileged user. The vulnerability is strictly macOS-specific - GlobalProtect on Linux, Windows, iOS, Android, and Chrome OS is explicitly not affected per vendor advisory. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 4.1 reflects the local, timing-dependent, and low-privilege-required nature of this attack.
Path traversal in IBM i 7.3 through 7.6 allows remote authenticated attackers holding high-privilege accounts to delete arbitrary files outside their intended directory scope. The flaw (CWE-22) results from insufficient sanitization of user-supplied path input in a file management operation reachable over the network. No public exploit code has been identified at time of analysis, and a vendor-released patch is available via the IBM support portal.
Integer underflow in PostgreSQL's Embedded C preprocessor (ECPG) client allows a database server administrator to crash ECPG client applications by sending a specially crafted bytea value missing its mandatory prefix. Affected versions span all active PostgreSQL major release lines prior to 18.5, 17.11, 16.15, 15.19, and 14.24. The primary impact is temporary denial of service against the ECPG client process via SIGSEGV, with a rare secondary risk of low-severity client-side integrity corruption; no public exploit has been identified at time of analysis.
Incorrect ownership reassignment in PostgreSQL's ALTER TABLE ALTER TYPE command allows a table owner to seize control of dependent statistics objects they did not create. Affected versions span all major supported branches prior to 18.5, 17.11, 16.15, 15.19, and 14.24. An authenticated table owner (high-privilege context per CVSS PR:H) can subsequently execute DROP STATISTICS or ALTER STATISTICS against statistics objects owned by another user, while simultaneously locking the legitimate statistics owner out of those same commands. No public exploit code exists and this CVE is not listed in CISA KEV.
Untrusted search path in PostgreSQL's amcheck extension allows a database user holding EXECUTE privilege on amcheck functions to execute arbitrary functions as the owners of expression indexes by injecting a hostile search_path before calling amcheck. Affected are PostgreSQL major versions 14, 15, 16, and 18 in releases prior to 14.24, 15.19, 16.15, and 18.5 respectively; version 17 is entirely unaffected. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, consistent with the niche exploitation prerequisite of an explicitly granted amcheck EXECUTE privilege.
Broken object-level authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions before 2.4.6) allows any authenticated employee or provider account to read appointment records they are not assigned to, exposing booked customers' personal data. The vulnerability is a classic IDOR (CWE-639): the plugin fetches appointment details by a caller-controlled identifier without verifying the requesting employee is the one assigned to that appointment. No active exploitation has been confirmed (not in CISA KEV), and EPSS places this at the 3rd percentile, reflecting limited real-world exploitation pressure, though the PII disclosure impact is concrete.
JavaScript hijacking in HCL AION v2.1.0 exposes sensitive data from dynamic JavaScript responses to attacker-controlled pages under specific network and user interaction conditions. The vulnerability arises because JSON or JavaScript-formatted responses from AION can be referenced cross-origin by a malicious page, enabling data capture via classic JS hijacking techniques. No public exploit has been identified at time of analysis, and the low CVSS score of 3.7 reflects high attack complexity and constrained impact scope.
Denial of service in Kibana's Cases module allows any authenticated user with case comment privileges to permanently render a specific case inaccessible to all users by posting a comment containing malformed link syntax. The comment rendering pipeline fails to sanitize or reject the invalid input, triggering an uncaught exception (CWE-248) that prevents the case from loading for every subsequent viewer until the offending comment is manually deleted. No public exploit has been identified at time of analysis, and no CISA KEV listing is present; the CVSS score of 4.3 (Medium) reflects the limited blast radius - individual cases rather than the Kibana instance as a whole are affected.
Cross-site request forgery in Zimbra Collaboration's Exchange Web Services (EWS) endpoint (versions before 10.1.17) allows a network-based attacker to perform unauthorized actions on behalf of an authenticated victim by exploiting insufficient content-type validation. Exploitation requires tricking a logged-in Zimbra user into interacting with attacker-controlled content, after which the browser automatically submits a crafted EWS request within the victim's session context. No public exploit has been identified and this CVE is absent from the CISA KEV catalog; the CVSS score of 3.1 accurately reflects the high attack complexity and integrity-only impact bounded to the victim's account.
Insufficient server-side input validation in HCL AION v2.1.0 allows a low-privileged, adjacent-network attacker to submit crafted input that bypasses validation controls, resulting in limited confidentiality disclosure via a scope change to a dependent component. Exploitation requires user interaction, constraining opportunistic use. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Missing authentication on RTSP/ONVIF interfaces across ten Tenda smart camera product lines allows unauthenticated remote attackers to access live video streams without credentials. Affected devices include CH7, CH7G, CH10, CP3, CP3 Pro, CP7, and the TC3-series (TC3B14C, TC3B15C, TC3T14C, TC3T15C) running firmware through 20260625. Public proof-of-concept exploit code exists on GitHub (E:P per CVSS 4.0 supplemental metrics), though high attack complexity (AC:H) limits trivial mass exploitation; no vendor patch has been identified at time of analysis.
Insufficient entropy in session token generation across ten Tenda smart camera and router models enables remote attackers to predict or brute-force valid session identifiers, potentially hijacking authenticated sessions on the Kylin Web Service. All affected models up to firmware build 20260625 are impacted via the CWebSessionManager_ParseSession function in /user/bin/Kylin. A publicly available proof-of-concept exploit is referenced on GitHub, though the CVSS 4.0 E:P modifier and AC:H rating confirm that exploitation is technically demanding rather than trivially scriptable; no active exploitation has been confirmed by CISA KEV.
Path traversal in IBM i 7.3 through 7.6 enables remote attackers holding high-privilege credentials to manipulate files outside intended directory boundaries. The CVSS score of 2.7 (Low) accurately reflects the constrained impact - exploitation is limited to authenticated users with high privileges (PR:H), and the resulting damage is restricted to limited file integrity modification with no confidentiality or availability consequences. No public exploit code has been identified at time of analysis, and IBM has released a vendor patch.
Denial of service in Calix GigaSpire 26.1.0 is reachable remotely through manipulation of the traceroute.cmd diagnostic endpoint, causing availability disruption to the affected device. The root cause is improper resource handling (CWE-404) within the traceroute function, which fails to properly release resources under adversarial input. A proof-of-concept exploit has been publicly disclosed; no vendor patch or advisory is available as the vendor did not respond to coordinated disclosure.
Denial of service in Calix GigaSpire 26.1.0 is achievable remotely by low-privileged attackers who manipulate the sessionKey argument within the utilities_configurationsave.cgi endpoint of the Web Management Interface, causing improper resource release (CWE-404) and disrupting device availability. The affected product is a residential and SMB broadband gateway deployed by ISPs. Published exploit code exists (E:P in the CVSS 4.0 vector), and no vendor patch has been confirmed - the vendor did not respond to the coordinated disclosure.