Arbitrary command execution in rsync before 3.5.0 arises from multiple unsanitized code paths - the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell newline injection - that let an attacker who controls hostnames, hostspecs, or related input inject shell metacharacters or newlines and run commands as the rsync process or invoking user. VulnCheck reported the cluster of CWE-78 flaws, which are fixed together in the major security release v3.5.0. No public exploit identified at time of analysis and the issue is not on CISA KEV, but the CVSS 4.0 base score of 9.2 reflects full confidentiality, integrity, and availability impact.
Arbitrary file write in rsync 2.3.3 through 3.4.4 lets a malicious sender escape a daemon module's root by abusing symlinks that are followed while resolving the --partial-dir or --backup-dir paths, redirecting writes to the module-root parent and beyond. Any rsync daemon exposing a writable module - or a read/write sync where a sender controls symlinks - is exposed, and the CWE-22 path-traversal primitive can be leveraged to overwrite configuration, cron, or authorized_keys files for follow-on code execution. Fixed in v3.5.0; reported by VulnCheck with no public exploit identified at time of analysis.
Missing authorization in SiYuan's /api/av/getAttributeViewSearchTarget endpoint allows an anonymous reader to retrieve database (attribute view) row content that publish-access filtering should hide. The affected route was added by commit 9b8e8956f and exists only in the development branch - it is absent from v3.7.3 and master and was fixed in v3.7.4, so no released stable version is affected. There is no public exploit identified at time of analysis and it is not in CISA KEV; despite the 9.2 CVSS the real-world exposure is limited to self-built development instances.
Hard-coded credential exposure in the FL-100 transcranial brain stimulation device enables any attacker within Bluetooth range to bypass authentication entirely and manipulate neurostimulation parameters across every deployed unit simultaneously. The credential is universally shared across all FL-100 devices manufactured under both the Flow Neuroscience and Halo Neuroscience brands, meaning a single credential disclosure event compromises the entire installed base at once. No public exploit code has been identified at time of analysis and active exploitation is not confirmed by CISA KEV, but the zero-privilege, zero-complexity authentication bypass presents a credible patient safety risk in clinical and home-use therapeutic environments.
Authorization bypass (fail-open) in NextAuth.js (Auth.js) v5 affects applications on next-auth 5.0.0-beta.0 through 5.0.0-beta.31 that protect routes by checking only whether the auth() object exists. When Auth.js hits a server-side configuration error, the auth object is populated with a truthy error payload instead of null, so checks like !!auth or if (req.auth) evaluate true for every unauthenticated request. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the impact is a silent, total bypass of session-existence gates once a deployment becomes misconfigured. Fixed in 5.0.0-beta.32.
Account takeover in NextAuth.js / Auth.js email (magic-link) sign-in lets a remote unauthenticated attacker who knows a victim's address hijack the passwordless login. The built-in defaultNormalizer checks for a single ASCII '@' before applying Unicode NFKC normalization, so a homoglyph such as U+FF20 (FULLWIDTH COMMERCIAL AT) passes validation but canonicalizes to a second '@' in a downstream SMTPUTF8/internationalized mailer, misrouting the sign-in link to an attacker mailbox. No public exploit is identified at time of analysis, but a regression test and full commit-level detail are public, and vendor-released patches exist (@auth/core 0.41.3, next-auth 4.24.15 and 5.0.0-beta.32).
IP-based access control bypass in the rsync daemon (rsyncproject/rsync) before version 3.5.0 lets unauthenticated remote attackers forge their source address by injecting a crafted PROXY protocol header, defeating hosts allow/deny restrictions. Reported by VulnCheck and fixed in the v3.5.0 major security release, the flaw applies to daemons that trust PROXY protocol headers yet accept direct client connections. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 9.1 reflects high confidentiality and integrity impact once the IP allowlist is circumvented.
Access control bypass in rsync daemon versions 3.1.0 through 3.4.4 lets remote unauthenticated attackers evade module-level 'hosts deny' restrictions by forcing DNS resolution to fail during hostname-based access checks, causing the daemon to skip the rule (fail-open) instead of denying. Reported by VulnCheck and fixed in rsync 3.5.0, it exposes file trees in modules that were meant to be IP/hostname-restricted; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Account takeover in IBM Langflow OSS versions 1.0.0 through 1.9.6 is possible because the platform fails to limit repeated failed authentication attempts (CWE-307), letting remote attackers brute-force or credential-stuff their way into user accounts. IBM (the reporting vendor) rates it CVSS 9.1 with high confidentiality and integrity impact, reflecting full compromise of a targeted account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the missing lockout control is trivial to abuse against weak or reused credentials.
Server-side template injection in the Form::Processor::Field::HtmlArea Perl module (versions 0.06 through 1.162360) lets a remote unauthenticated attacker inject Locale::Maketext bracket-notation templates through HTML::Tidy validation diagnostics. Because the default language handle enables _AUTO, unrecognized message keys are compiled as templates, so attacker-controlled attribute names/values in submitted markup become method-dispatch templates on the language handle - yielding unhandled exceptions, near-unbounded memory allocation, and, where the application's handle subclass defines side-effecting public methods, invocation of those methods with attacker-chosen arguments. Reported by CPANSec with a vendor patch available; there is no public exploit identified at time of analysis and EPSS is low (0.40%, 33rd percentile).
Unauthenticated information disclosure in the Portal Generator add-on to Priority ERP (developed by Soft Solutions) allows remote attackers to retrieve restricted data by bypassing security controls that are enforced only in the client rather than on the server. Any actor who can reach the portal over the network can craft direct server requests that skip the intended access checks, exposing sensitive data without credentials or user interaction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated sensitive information disclosure in the Portal Generator Addon to Priority ERP (developed by Soft Solutions) allows remote attackers to retrieve private personal and business data without credentials or user interaction. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) and reported by Israel's National Cyber Directorate (INCD), the flaw combines CWE-200 and CWE-359 exposure classes. No public exploit identified at time of analysis, and the product has a primarily Israeli deployment footprint.
Path confinement bypass in the rsync daemon (versions before 3.5.0) lets remote clients escape the intended per-module chroot root when a module path contains a '/./' boundary marker, granting unauthorized read or write access to files outside the module subtree. Reported by VulnCheck and carrying a CVSS 4.0 score of 9.1, the flaw is exploitable by mishandling the '/./' notation or by forging delta-basis (xname) transfers that cross the boundary. No public exploit has been identified at time of analysis, but the fix is a coordinated advisory (GHSA-wj7w-vh23-mm44) shipped in the major 3.5.0 security release.
Information disclosure and denial of service in IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 lets a remote unauthenticated attacker trigger a stack-based buffer overflow, potentially reading sensitive memory contents and crashing the affected service. IBM (the reporter) has released a patch, and no public exploit has been identified at time of analysis. Despite a CVSS of 9.1, the EPSS probability is low (0.25%, 17th percentile) and CISA SSVC records no known exploitation.
Open redirect in Saurus CMS Community Edition's logout handler allows unauthenticated attackers to redirect authenticated users to attacker-controlled domains or javascript: URIs immediately after session destruction. The vulnerability exists in classes/port.inc.php, where the `url` GET/POST parameter is passed unsanitized into the HTTP Location header with no allowlist, scheme check, or path restriction. A publicly available proof-of-concept demonstrates exploitation; no active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 5.1 with UI:A reflects the social-engineering dependency inherent to post-logout redirect abuse.
Reflected XSS in Next AI Draw.io 0.2.1 through 0.4.16 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the localhost origin by crafting malicious URLs containing a payload in the unsanitized `mcp` query parameter. Successful exploitation - which requires a victim to click the crafted link - enables theft of diagram session tokens and API credentials accessible within that browser origin. Publicly available exploit code exists (GitHub issue #917 via VulnCheck), though no CISA KEV listing confirms active exploitation at time of analysis.
Broken access control in Gitea (self-hosted Git service) versions up to and including 1.26.4 lets the team-repository linking endpoint ignore the RepoAdminChangeTeamAccess organization setting, so repository administrators can grant or alter team access to repositories even when an org owner has explicitly restricted that ability. This CWE-862 missing-authorization flaw undermines an intended org-level guardrail, exposing private repository contents (C:H) and permitting unauthorized permission changes (I:H). No public exploit has been identified at time of analysis, and the EPSS probability is low (0.15%, 5th percentile).
Server-side request forgery in Gitea Open Source Git Server (all versions through 1.26.4) lets attackers abuse the repository migration and mirror features to reach internal network resources. Two distinct weaknesses are involved: a DNS-rebinding bypass where a hostname resolves to a permitted address during validation and to an internal address when the actual request is made, and a missing re-validation flaw where redirect or subsequent fetch targets are not re-checked against the allow/deny policy. No public exploit was identified at time of analysis, EPSS is low (0.15%), and it is not in CISA KEV, but the vendor rates technical impact as total and the issue is fixed in 1.27.0.
Authenticated SQL injection in Zohocorp ManageEngine Password Manager Pro (before build 13232) and ManageEngine PAM360 (before build 8552) allows a network-authenticated attacker with low-level privileges to read, modify, or delete sensitive database contents. Given that Password Manager Pro is a privileged credential vault and PAM360 is a privileged access management platform, successful exploitation could expose every managed credential, secret, and privileged session record stored within the system. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the severity and target sensitivity make this a high-priority patching candidate.
Account takeover in the Budibase low-code platform (prior to 3.39.30) lets an attacker impersonate any existing user by abusing OIDC SSO account-linking. Because the OIDC verify callback in oidc.ts resolved the email claim without ever reading email_verified, and sso.ts fell back to getGlobalUserByEmail as the linking key, a fresh attacker identity from a configured IdP asserting a victim's email - even as unverified - is silently merged into the victim's account, inheriting its _id and roles up to global admin/builder. No public exploit is identified at time of analysis, but the root cause is confirmed by the vendor GHSA advisory and the fixing commit; the issue carries a CVSS 4.0 base score of 9.0.
SQL injection in Budibase's webhook-triggered automation engine (versions before 3.40.0) lets remote attackers reach EXECUTE_QUERY automation steps and inject SQL that runs with the builder-configured datasource credentials. Because the webhook trigger endpoint accepts attacker-controlled JSON without authentication, an attacker can exfiltrate, modify, or persist data in connected backends such as Snowflake. No public exploit identified at time of analysis; the flaw is fixed in 3.40.0 and documented in GHSA-x7h8-ww3q-xv7c.
Authentication bypass in ManageEngine Password Manager Pro (all versions before 13232) and PAM360 (all versions before 8551) allows low-privileged network attackers to forge SAML assertions and gain unauthorized elevated access, including administrative sessions, within these enterprise credential vaults. The flaw stems from improper cryptographic signature verification of SAML responses (CWE-347), enabling token manipulation that the service provider cannot detect. Vendor patch is available; no public exploit code has been confirmed at time of analysis, but the crown-jewel nature of PAM platforms - storing all privileged enterprise credentials - makes this a high-priority remediation regardless of current exploitation status.
Integer wraparound in PostgreSQL's tsvector and tsquery full-text search functions allows an unprivileged database user to trigger an undersized heap allocation and subsequently write out-of-bounds, with potential for arbitrary code execution as the operating system user running the database process. All supported major release lines are affected - versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 - and the vulnerability closely mirrors CVE-2026-6473, which addressed a similar integer overflow class in the same subsystem. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 rating with full High C/I/A impact reflects the worst-case consequence of successful exploitation.
Heap buffer overflow in PostgreSQL's pg_dump backup utility across all active major versions enables an authenticated database user with object creation privileges to execute arbitrary code as the operating system account running pg_dump. The attacker plants a crafted database object containing an excessively long function transform list, then waits for pg_dump to process that object during a backup operation, triggering CWE-122 heap corruption. No public exploit has been identified at time of analysis, but the clear trigger path and widely deployed target surface make this a meaningful operational risk for organizations relying on pg_dump for backup automation.
Heap buffer overflow in PostgreSQL's pg_stat_statements extension (major version 18, minor versions 18.0 through 18.4) allows any authenticated database user to execute arbitrary code as the operating system account running the PostgreSQL service by submitting crafted SQL queries containing array constants. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a valid database credential, with full confidentiality, integrity, and availability impact on the database host. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog.
Heap buffer overflow in PostgreSQL's plperl extension allows a database function owner to execute arbitrary code as the OS-level user running the database server by crafting a function body that returns a tied hash. Affected versions span the four active PostgreSQL major release lines prior to 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Heap buffer overflow in PostgreSQL's regexp engine allows any authenticated database user to execute arbitrary code as the operating system user running the database process. The flaw is triggered by specially crafted text that survives input validation but undergoes unanticipated data growth during internal round-trip conversion through the pg_wchar encoding layer, overflowing a heap-allocated buffer during regular expression evaluation. All active PostgreSQL branches are affected - versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 - with no public exploit or CISA KEV listing confirmed at time of analysis.
Remote code execution in PostgreSQL's portal/cursor subsystem allows any authenticated database user to execute arbitrary code as the OS-level process owner (typically 'postgres') by re-creating a named cursor with an incompatible result type. All actively supported major branches are affected - versions prior to 14.24, 15.19, 16.15, 17.11, and 18.5. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and minimal authentication requirement (any valid login) make this a critical patch priority for the ubiquitous open-source RDBMS.
Remote code execution in PostgreSQL 18.x (all minor versions before 18.5) is achievable by any authenticated object creator through a type confusion flaw in pg_restore_attribute_stats(), which conflates range and multirange values to corrupt memory and gain code execution as the OS user running the database process. The CVSS 8.8 score reflects a low-privilege, low-complexity network exploit path with full confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at the time of analysis, but the RCE primitive combined with the low privilege bar makes this a high-priority patch target for all PostgreSQL 18 deployments.
Type confusion in PostgreSQL's 'internal' pseudo-type enforcement enables any authenticated database user to execute arbitrary code as the operating system user running the database process. The vulnerability arises because access controls blocking SQL-layer callers from invoking C-language functions that accept 'internal' arguments contained coverage gaps, allowing a crafted function call to corrupt memory and achieve OS-level code execution. Fixed versions are PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24; no public exploit or CISA KEV listing has been identified at time of analysis.
Integer wraparound in 32-bit builds of PostgreSQL's PL/Tcl and PL/Perl procedural language extensions enables an authenticated object creator to provoke an undersized heap allocation and perform an out-of-bounds write via a crafted function body, ultimately achieving arbitrary code execution as the OS user running the database process. PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, and 14.24 across active major release branches are affected. This is a recurrence of the class of integer arithmetic flaws previously addressed by CVE-2026-6473, indicating an incomplete prior remediation; no public exploit or CISA KEV listing has been identified at time of analysis.
Code injection in PostgreSQL's pg_dump, pg_dumpall, and pg_restore (plain-format mode) allows a malicious superuser of an origin database server to embed arbitrary OS-level commands into a dump file, which execute on the restoring client's operating system account when psql processes the dump. This is a confirmed bypass of the CVE-2025-8714 patch: the \unrestrict meta-command introduced by that fix is itself exploitable via psql meta-command input expansion, negating the protection that \restrict was intended to provide. No public exploit has been identified at time of analysis, but the high CVSS score (8.8) and full RCE impact make this urgent for any organization that accepts and restores PostgreSQL dumps from external or untrusted sources.
Heap-based buffer overflow in IBM i 7.3 through 7.6 enables remote authenticated attackers to execute arbitrary code with full confidentiality, integrity, and availability impact. The vulnerability carries a CVSS 3.1 base score of 8.8 and is network-accessible with low attack complexity, making it a high-priority remediation target for IBM Power Systems environments. No public exploit code or active CISA KEV-listed exploitation has been identified at time of analysis; a vendor patch is available via IBM's support portal.
Heap out-of-bounds write in rsync 3.2.5 through 3.4.x allows remote unauthenticated attackers to corrupt heap memory by supplying a crafted files-from entry to any exposed rsync daemon module. Critically, the flaw is exploitable against read-only daemon modules - a configuration commonly treated as a safe exposure boundary - by providing a path containing both an interior and trailing backslash, causing add_implied_include() to under-size its destination buffer and write one attacker-controlled byte past the allocation end. No public exploit has been identified at time of analysis, though the CVSS 4.0 score of 8.8 reflects the unauthenticated network attack vector and high availability impact.
Remote code execution via integer wraparound in PostgreSQL's fuzzystrmatch contrib module allows any authenticated database user to corrupt memory and execute arbitrary code as the operating system account running the database server. All maintained PostgreSQL branches are affected: versions before 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE impact, low attack complexity, and network accessibility establish this as a high-priority patching target.
Remote code execution in IBM i 7.3 through 7.6 is achievable by any authenticated network attacker via an out-of-bounds write (buffer overflow) triggered over the network. The vulnerability requires only low-level credentials, making it accessible to any valid user account on an internet- or network-exposed IBM i system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor has confirmed the flaw and released a patch via IBM Support.
SQL injection in PostgreSQL's EXTRACT() expression deparse enables a database object owner to escalate privileges and execute arbitrary SQL with superuser rights. Affected across the active PostgreSQL release tree - versions before 14.24, 15.19, 16.15, 17.11, and 18.5 - the flaw is triggered when deparse consumers such as pg_dump or psql's \sf command process a hostile object definition crafted by a low-privilege but authenticated database user. No public exploit code or CISA KEV listing exists at time of analysis; however, the superuser privilege-escalation impact and broad reach of affected deparse consumers make this a high-priority upgrade, particularly for multi-tenant or shared PostgreSQL environments.
Remote code execution in IBM i 7.3 through 7.6 is possible for any authenticated remote attacker who can manipulate an untrusted search path used by privileged system components. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms network accessibility with minimal privilege prerequisites and no user interaction, yielding full confidentiality, integrity, and availability impact. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Type confusion in PostgreSQL's 'refint' contrib module enables any low-privileged database user with object creation rights to execute arbitrary code as the operating system user hosting the PostgreSQL service. Affected are all active PostgreSQL branches prior to versions 18.5, 17.11, 16.15, 15.19, and 14.24. Notably, the fix was silently committed to the PostgreSQL git repository under the subject 'refint: Remove plan cache.' without a CVE assignment, meaning vulnerable installations may have remained unpatched far longer than typical because administrators had no security signal to act on. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds heap write in rsync 3.0.1 through 3.4.x allows a malicious sender to corrupt adjacent heap memory by crafting an argument list that exactly fills the argv allocation in read_args(), causing the trailing NULL terminator to land one slot beyond the allocation boundary. Any rsync client performing a pull operation against an attacker-controlled or compromised server is exposed; heap corruption at this boundary can produce a crash (high availability impact) or potentially a write-what-where condition depending on heap layout. No public exploit code and no CISA KEV listing have been identified at time of analysis; rsync maintainers designated v3.5.0 a major security release, confirming patch availability.
Out-of-bounds write in rsync 3.0.0 through 3.4.x enables remote memory corruption when a peer sends file entries with the FLAG_HLINKED flag set against a receiver with hard-link preservation disabled. The missing F_SUM field in the file_struct layout permits writes beyond the allocated structure boundary, corrupting adjacent heap or stack data and likely causing denial-of-service or potentially enabling code execution. Vendor-released patch v3.5.0 is available; no public exploit or CISA KEV listing has been confirmed at time of analysis.
Privilege escalation in the Service Finder Booking WordPress plugin (versions 6.2 and below) allows any authenticated subscriber-level user to elevate their privileges within the application, resulting in full confidentiality, integrity, and availability impact. The flaw is network-exploitable with low complexity and requires only a valid subscriber account, making it accessible to any registered user on affected sites. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 score reflects the high-impact potential once a low-privileged account is obtained.
Privilege escalation in Budibase's public role-assignment API allows an app-scoped builder to grant themselves or other users builder access - or arbitrary data-plane roles - across any app in a shared tenant. Versions prior to 3.39.24 are affected; the CVSS score of 8.8 (PR:L) reflects that a low-privilege authenticated account is sufficient, with no user interaction or elevated complexity required. No public exploit or CISA KEV listing is identified at time of analysis, but the vulnerability is straightforwardly reproducible given the published commit diff and GHSA advisory detail.
Path traversal in IBM i versions 7.3 through 7.6 enables a low-privileged remote authenticated attacker to bypass object-level access controls and gain unauthorized read, write, or disruptive access to arbitrary system objects. The CVSS 8.8 rating reflects full C/I/A impact across a network-accessible attack surface requiring only low privilege - consistent with IBM's own report as originating vendor and the EUVD advisory. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; EPSS at 0.36% (29th percentile) indicates low current exploitation activity, though a vendor patch is now confirmed available.
Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by any user holding the low-privilege ML model upload and deploy permission. By crafting a model that embeds an operation computing a memory address from an attacker-controlled offset, a low-privileged authenticated user can cause the native inference subprocess to read and write outside its allocated heap, reliably crashing that process or, under controlled heap layout conditions, executing arbitrary code within it. No active exploitation or public proof-of-concept has been identified at time of analysis, but the CVSS 8.8 rating, network-accessible vector, and explicit RCE potential in the vendor description place this in the urgent-remediation tier for any organization running Elasticsearch with ML features delegated to non-admin users.
PHP Object Injection in the Booking Activities WordPress plugin (versions ≤ 1.18.4) exposes sites to potential remote code execution through unsafe deserialization of attacker-controlled data. The CVSS vector (PR:N, UI:R) indicates exploitation requires no authentication but does require some form of user interaction, suggesting the attack surface likely involves a front-end booking form or link that a visitor triggers. Depending on available PHP class chains (POP chains) in the WordPress environment, impact can reach full confidentiality, integrity, and availability compromise. No public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in IBM i 7.3 through 7.6 allows remote authenticated users to gain unauthorized elevated privileges via improper privilege management. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-reachable exploitation requiring only low-level credentials, with full confidentiality, integrity, and availability impact on the affected system. No public exploit code or CISA KEV listing is identified at time of analysis, but a vendor-released patch is available.
Privilege escalation in Elastic Kibana's Agent Builder component (versions 9.4.0-9.4.3) allows authenticated low-privileged users to create and execute Agent tools that invoke Kibana features they are not authorized to access, bypassing the platform's feature-level access controls. The Agent Builder omits authorization verification against the target feature's required privilege set before tool creation and execution, enabling cross-feature privilege escalation and potential disclosure of sensitive data. No public exploit code exists and EPSS is 0.25%, but SSVC rates technical impact as total, making this a meaningful risk in multi-tenant or role-segmented Kibana deployments.
SQL injection in Budibase's Oracle datasource connector (versions before 3.40.0) exposes the underlying Oracle database to arbitrary read and write operations by authenticated platform users. The post-write row lookup query concatenates table names into SQL identifiers without escaping double-quote characters, enabling injection of arbitrary SQL that executes under the datasource's Oracle database user account. No public exploit code or CISA KEV listing has been identified; the CVSS 4.0 score of 8.8 reflects high C/I/A impact but is tempered by significant access preconditions including high privilege requirements and an atypical table-naming condition.
Security level downgrade during Bluetooth Low Energy re-pairing in Silicon Labs WiseConnect exposes the Long Term Key (LTK) to practical brute-force attack by an adjacent unauthenticated attacker. Devices running WiseConnect 4.0.0 through 4.0.x and WiseConnect 2.0.0 through 2.13.x accept re-pairing negotiations at weaker security parameters than originally established, reducing LTK entropy and enabling offline key recovery. No public exploit code has been identified at time of analysis, though the vulnerability class is formally documented as V4 in the BLERP academic paper (NDSS); a vendor patch is available in WiseConnect 4.1.0 and 2.14.0.