Bluetooth Low Energy re-pairing in Silicon Labs RS9116W and SiWx91x devices allows a nearby unauthenticated attacker to negotiate a lower security level during the re-pairing process with an already-bonded peer, effectively bypassing the previously established security guarantees. Documented as the 'V3' attack variant in the NDSS-published BLERP (BLE Re-Pairing) research paper, this flaw enables high-impact compromise of confidentiality, integrity, and availability across affected WiseConnect firmware lines. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the NDSS publication constitutes academic proof-of-concept disclosure.
BLE re-pairing attacks against Silicon Labs RS9116W and SiWx917 modules allow an adjacent unauthenticated attacker to spoof a previously bonded device and force the target to re-bond with a rogue device, yielding full BLE session control. Both WiseConnect SDK 2.x (before 2.14.0) and 4.x (before 4.1.0) are confirmed affected per vendor release notes and the academic BLERP (BLE Re-Pairing Attacks and Defenses) paper published at NDSS. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though the NDSS paper provides a detailed methodology that could guide motivated researchers to weaponize the technique.
Remote code execution via the OpenSearch SQL plugin's Flint extension query handler exposes Apache Spark workers to arbitrary code execution by any authenticated user holding async query access. The vulnerable component is the SQL query validation layer in the Flint extension, which fails to prevent crafted payloads from reaching and executing on Spark worker nodes. No public exploit code has been identified at time of analysis, but the network-reachable RCE primitive, low complexity, and low privilege requirement collectively make this a high-priority remediation target; vendor patches are available in OpenSearch 3.7.0 and 2.19.6.
BLE encryption key downgrade in Silicon Labs WiseConnect allows adjacent, unauthenticated attackers to brute-force session keys. When a peripheral initiates SMP (Security Manager Protocol) pairing, WiseConnect's security request omits the device's maximum supported encryption key size. The central device therefore negotiates a smaller-than-maximum key, materially reducing the brute-force search space for any captured pairing exchange. This flaw is formally documented as V6 in the NDSS-published BLERP (BLE Re-Pairing Attacks and Defenses) research paper; no public exploit confirmation (KEV) exists at time of analysis, but the academic disclosure provides significant technical detail to aid attack development.
KVM on s390 (IBM Z mainframe) exposes a hypervisor boundary-crossing flaw in its PCI Adapter Interrupt Forwarding (AIF) subsystem, where a guest VM registering IRQs without an Adapter Interrupt Summary Bit (AISB) causes the kernel to write `virt_to_phys(page_address(NULL))` - a non-zero, incorrect physical address - into the Guest Adapter Interrupt Table Entry (GAITE) rather than the correct zero sentinel. The CVSS scope change (S:C) indicates this poisoned GAITE entry can be used to cross the guest/host trust boundary, enabling potential host memory disclosure, corruption, or destabilization from a low-privileged guest context. No public exploit code and no CISA KEV listing exist at time of analysis; patches have been issued across multiple Linux stable kernel branches.
Out-of-bounds write in IBM i 7.3 through 7.6 enables a local low-privileged attacker to execute arbitrary code, with scope change (S:C) indicating the exploit crosses a security boundary into a higher-privileged component - achieving full confidentiality, integrity, and availability impact. The CVSS score of 8.8 reflects the severity of privilege escalation potential despite requiring local access. No public exploit has been identified at time of analysis, and IBM has released a patch via their support portal.
Thread authority swap mismanagement in IBM i 7.3 through 7.6 enables a low-privileged local attacker to gain elevated system authorities, including potentially *ALLOBJ-equivalent access. The CVSS scope change (S:C) confirms that successful exploitation extends privilege impact beyond the attacker's own user profile, threatening the broader system partition. No public exploit or active CISA KEV listing exists at time of analysis; risk is driven by low attack complexity and the critical role IBM i plays in regulated enterprise environments.
Connection slot exhaustion in rsync daemon versions 2.0.0 through 3.4.x allows unauthenticated remote attackers to deny service to legitimate clients by stalling the protocol handshake across two distinct vectors. Pre-module-selection stalls are unconditionally effective because the daemon applies no timeout in that phase; post-module-selection, attackers can trickle data just above the I/O timeout floor to hold slots indefinitely while never completing the handshake. No public exploit identified at time of analysis, though the attack is trivially scriptable and requires no authentication or prior access.
CVE-2026-62292 has been reported by Ubuntu as a security update, but no technical description, CVSS score, CWE, affected product versions, or references are available at time of analysis. No meaningful synthesis is possible without fabricating data.
CPU exhaustion in rsync receivers before 3.5.0 allows a remote sender to cause denial of service by exploiting quadratic-time worst-case behavior in the hash_search() function (CWE-407). A malicious or compromised sender delivers a carefully crafted file list - requiring only a modest number of entries - to collapse hash lookup performance and sustain receiver CPU exhaustion for the duration of the sync session. No public exploit has been identified at time of analysis, but the unauthenticated network attack vector and rsync's ubiquitous deployment in backup and file-synchronization infrastructure make patch urgency high.
Remote code execution in GitPython before 3.1.54 exploits a guard bypass in check_unsafe_options where the validation logic inspects kwarg keys but never their values, allowing an attacker to smuggle dangerous git options such as --upload-pack inside single-character kwarg values across every guarded method - clone_from, fetch, pull, push, ls_remote, iter_commits, blame, and archive. Any application that passes externally-influenced kwargs to these methods is fully compromised; the attacker achieves arbitrary OS command execution as the host process. A working proof-of-concept is publicly available in the GHSA advisory; no CISA KEV listing has been issued at time of analysis.
Denial of service in rsync's receiver process allows a remote, unauthenticated sender to exhaust thread and memory resources by specifying the --zt short alias for --compress-threads, directly bypassing daemon-side refuse options directives that match only against long option names. Affected versions span 3.4.2 through 3.4.x prior to 3.5.0; the bypass is most damaging to operators who explicitly configured refuse options to block --compress-threads, since they believed a mitigation was in place. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the CVSS 4.0 score of 8.7 accurately reflects low-complexity, unauthenticated network exploitation with high availability impact.
SandboxPolicy bypass in Network-AI (versions before 5.15.1) enables authenticated attackers to execute arbitrary blocked commands by exploiting a parsing discrepancy between the policy engine and the command executor. The SandboxPolicy evaluates raw command strings with quotes intact, passing them through blocklist and approval-gate checks, while the executor subsequently strips those quotes during tokenization and runs the actual dangerous argv. No public exploit has been identified at time of analysis, but the bypass mechanism is mechanistically straightforward, requiring only knowledge of the quote-handling discrepancy to exploit via the network with low-privilege credentials.
Truncation-induced interpretation conflict in Network-AI ClaudeHookBridge before 5.15.1 enables low-privileged attackers to bypass operator-configured denyPatterns and achieve arbitrary command execution. The bridge evaluates security patterns against only the first 500 characters of a submitted Bash command field while Claude Code receives and executes the full, untruncated string - meaning any payload positioned past byte 500 is invisible to the deny list but fully executable by the runtime. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS 4.0 base score of 8.7 and low attack complexity signal that operationalizing this bypass requires minimal skill once low-privilege bridge access is obtained.
SQL injection in Zalktis accounting software allows an external trading partner to execute arbitrary database queries by embedding malicious payloads in electronic invoice fields (UBL/PEPPOL format). Versions before 2026.1.586 (v1 branch) and 2026.2.592 (v2 branch) concatenate partner-controlled invoice field values directly into SQL statement text, bypassing the application's own Dazadi.sql_txt() escaping helper on the e-invoice and e-commerce import code paths. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though the attack surface is inherent to the standard business workflow of receiving and importing invoices from counterparties.
Persistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network attackers who have established a man-in-the-middle position, exploiting an out-of-bounds read triggered by specially crafted data. The impact is described as persistent, meaning the service does not self-recover and requires manual intervention, making this operationally disruptive for organizations that depend on Secure Access for network connectivity. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Root code execution in OpenWrt LuCI via luci-mod-system-mounts allows authenticated users holding only mount-configuration ACL rights to overwrite the system crontab and execute arbitrary commands as root within 60 seconds. The flaw is a misconfigured ACL definition that incorrectly extends write access to /etc/crontabs/root - a file that should be inaccessible to mount-only operators - through the ubus file.write RPC interface. No public exploit has been identified at time of analysis, but the attack path is mechanically trivial and exploitable by any account granted the mount-configuration ACL group, making this a critical privilege escalation risk on internet-facing or multi-tenant OpenWrt deployments.
NoSQL injection in Budibase Server's MongoDB query execution endpoint (POST /api/v2/queries/:queryId) allows authenticated users with query write permission to bypass document-level filters and read, modify, or delete arbitrary MongoDB documents. The flaw stems from Handlebars interpolation being performed with escaping explicitly disabled (noEscaping: true), meaning JSON metacharacters in user-supplied parameters survive into the parsed query object that flows directly to MongoDB driver calls. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, a patch commit and PR are publicly available on GitHub.
Environment variable exfiltration in GitPython before 3.1.55 allows attackers to steal secrets from the hosting process environment by supplying crafted URLs containing shell variable references to Remote.create() (via Repo.create_remote() or Remote.add()) and Submodule.add() API methods. This is an incomplete fix of GHSA-rwj8-pgh3-r573: the prior patch disabled variable expansion only in Repo.clone_from(), leaving sibling callers unguarded - URLs such as https://attacker.example/${AWS_SECRET_ACCESS_KEY}/repo.git are expanded server-side, persisted to .git/config or .gitmodules, and transmitted to the attacker's host on the next fetch or pull. The official GHSA advisory published by gitpython-developers includes detailed step-by-step reproduction instructions; the vulnerability is not in CISA KEV at time of analysis.
Server-Side Request Forgery in the Meeting Room Booking System (MRBS) import functionality allows remote attackers to force the application to fetch arbitrary private or local URIs, enabling potential pivot into internal networks or unauthorized integrity modification of internal services. The flaw affects all MRBS deployments prior to version 1.12.2, where the import feature accepts user-supplied URIs without restricting private address ranges or local endpoints. No public exploit code has been identified at time of analysis, but the unauthenticated network attack vector and low complexity make this trivially exploitable against internet-exposed instances.
SSH key injection in FreePBX versions 17.0.5.34 through 17.0.10.x allows authenticated administrators to escalate from web application control to persistent OS-level shell access on the underlying host. The publicKeySave AJAX endpoint in Backup.class.php appends caller-supplied SSH public keys to /home/asterisk/.ssh/authorized_keys without reliably enforcing backup-only command restrictions or source IP constraints, granting the asterisk OS user unrestricted interactive shell access. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available in version 17.0.11.
Cross-site request forgery in Budibase's AI chat-link handoff endpoint (GET/POST /api/chat-links/:instance/:token/handoff) permits a same-tenant attacker with low privileges to permanently bind their external chat identity (Slack, Discord, MS Teams, or Telegram) to any authenticated victim user's Budibase account. Because the confirmation token is rendered in plaintext inside the HTML page the victim views and the POST endpoint carries no CSRF protection or session binding, an attacker can extract the token from their own session initiation flow and embed it in a phishing page that auto-submits on load, hijacking the victim's globalUserId mapping. Once bound, the attacker impersonates the victim across all AI agent operations and inherits the victim's workspace permissions on knowledge sources and downstream automations. No public exploit code or KEV listing is confirmed at time of analysis; the CVSS 4.0 score of 8.7 reflects high confidentiality and integrity impact across both the vulnerable system and subsequent downstream systems.
Cross-site scripting in JupyterLab 3.3.0 through 4.5.9 and 4.6.0 through 4.6.1 enables arbitrary code execution in a victim's browser session through a crafted overrides.json settings file. The sideBySideLeftMarginOverride and sideBySideRightMarginOverride notebook extension settings are inserted unsanitized into CSS style content, allowing a payload to execute with full JupyterLab API access - enabling notebook reads/writes and arbitrary kernel command execution under the victim's credentials. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the CVSS 4.0 score of 8.6 with high confidentiality and integrity impact reflects meaningful real-world risk, particularly in multi-user JupyterHub deployments.
Entity expansion limit bypass in fast-xml-parser 5.9.3-5.10.0 enables remote unauthenticated denial of service against any Node.js service parsing untrusted XML. The parser's OrderedObjParser.js passes each encountered DOCTYPE declaration through addInputEntities(), which reinitializes the entity-expansion safety counters (maxTotalExpansions, maxExpandedLength) on every call - a crafted document with multiple DOCTYPE blocks therefore resets these guards to zero repeatedly within a single parse operation, nullifying protections against billion-laughs-style exponential entity expansion. The result is excessive CPU consumption, event-loop blocking, memory exhaustion, and process termination. No active exploitation has been confirmed (not in CISA KEV), but exploitation requires zero authentication or special configuration beyond the default entity-processing behavior.
Remote denial of service in frp's optional SSH Tunnel Gateway (versions 0.53.0 through 0.70.0) allows any unauthenticated network attacker to terminate the entire frps server process with a single five-byte crafted message, instantly dropping all active tunnels for every connected client. The root cause is an integer overflow in the SSH exec-channel request parser in pkg/ssh/server.go: an attacker-controlled length value of 0xFFFFFFFF wraps to 3 on uint32 addition, defeating the only bounds check and triggering an unrecovered Go panic that kills the process. No confirmed active exploitation or formal public exploit code has been identified at time of analysis, though the GHSA advisory discloses the exact code path and payload arithmetic sufficient for trivial reproduction; vendor-released patch v0.70.1 is available.
Unauthenticated authentication bypass in the Portal Generator Addon to Priority ERP (developed by Soft Solutions) allows remote attackers with no credentials to access confidential ERP data across a scope boundary. Carrying a CVSS 3.1 score of 8.6 with Scope Changed and High Confidentiality impact, the flaw exposes the underlying Priority ERP backend through the portal layer - meaning business-critical records such as financial data, customer information, or operational records may be readable without any authentication. No public exploit code and no CISA KEV listing exist at time of analysis, but the attack profile (AV:N/AC:L/PR:N/UI:N) means exploitation requires minimal sophistication from any network position.
Directory escape in rsync's rrsync restricted shell wrapper before version 3.5.0 allows authenticated users to read and write files outside their enforced directory boundaries via two distinct paths. The first is a TOCTOU race condition that substitutes a symlink after path validation but before file transfer; the second is direct abuse of unrestricted rsync flags - --copy-unsafe-links, -D, and --log-file - that rrsync fails to sanitize, requiring no race timing at all. Scored 8.6 (High) under CVSS 4.0 with full confidentiality and integrity compromise of the vulnerable system, this is a genuine priority for any deployment using rrsync for SSH-based restricted file sharing; no public exploit has been identified at time of analysis.
Authorization bypass in rsync 3.1.0 through 3.4.x allows authenticated users to circumvent module-level access controls when group-based deny rules are configured with space-containing group names. The auth users directive's comma-only parser silently discards deny rules for any @Group Name entry whose group name contains a space, granting unintended access to restricted rsync modules regardless of the administrator's intended group-based exclusions. The rsync project designated v3.5.0 a major security release to address this flaw; no CISA KEV listing or public exploit code has been identified at time of analysis.
FreePBX Framework's restore functionality allows an authenticated user with backup-restore privileges to inject the hidden AUTHTYPE=none configuration setting via a crafted backup archive, completely disabling web administration authentication on the affected PBX. Versions prior to 16.0.47 (branch 16) and 17.0.30 (branch 17) are confirmed affected; vendor patches have been released. No public exploit identified at time of analysis, though the fix commit diff publicly reveals the exact attack technique against a widely deployed telephony platform.
Tenant admin account takeover in Budibase self-hosted deployments before 3.40.0 is achievable by any authenticated user, including the lowest-privilege BASIC app user. The PUT /api/global/users/tenant/owner endpoint fails to enforce the cloudRestricted middleware on self-hosted instances where SELF_HOSTED or DISABLE_ACCOUNT_PORTAL is set, allowing any valid session to silently reassign the tenant owner email address to an attacker-controlled value. By then triggering the public password-reset flow against that address, the attacker achieves full administrative control over the entire Budibase tenant; no public exploit has been identified at time of analysis, but the single authenticated API call required makes the exploit chain mechanistically trivial for any user who holds even a basic account.
Cross-tenant IDOR in Roskus Prospero Flow CRM before 5.4.7 allows any authenticated user to read sensitive product records belonging to other tenant companies and reassign those products into their own account. Two compounding root causes drive the impact: ProductUpdateController lacked the MainController inheritance that enforces session-based authorization, leaving the product read endpoint unguarded, while ProductRepository::save() performed a bare Product::find($data['id']) lookup with no company_id scope constraint, enabling cross-tenant record hijacking. No public exploit or CISA KEV listing exists at time of analysis, but the exploit conditions are trivially met by any authenticated session holder.
Unauthenticated remote information disclosure in the Portal Generator Addon for Priority ERP (developed by Soft Solutions) exposes sensitive ERP data to unauthorized network actors. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H) confirms that exploitation requires no credentials, no user interaction, and no special network position, yet achieves high confidentiality impact with a scope change that extends beyond the portal component into the underlying Priority ERP system. Reported by the Israel National Cyber Directorate (INCD), no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-enterprise IDOR in Rainbond through 6.9.7 allows any authenticated user to read or modify another enterprise's resources by substituting an arbitrary tenant name in API URL paths. The CheckToken function validates token authenticity but never cross-checks that the token's enterprise matches the enterprise embedded in the request path, enabling horizontal privilege escalation across tenant boundaries. Impacted resources include services, plugins, environment variables, and TLS certificates belonging to any enterprise on the same Rainbond instance. No public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in the Reviewer WordPress plugin (versions ≤ 3.14.2) by mvpthemes allows any authenticated subscriber-level user to query the underlying WordPress database over the network without user interaction. The changed scope (S:C) in the CVSS vector indicates that successful exploitation can reach data beyond the plugin's own tables, yielding high confidentiality impact against potentially the full WordPress database. Reported by Patchstack; no public exploit or CISA KEV listing is identified at time of analysis.
SQL injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro (versions 11.10 and earlier) enables any subscriber-level authenticated user to extract sensitive data from the site's underlying database. The CVSS 3.1 score of 8.5 reflects a network-accessible, low-complexity attack with a changed scope, meaning the injection reaches beyond the plugin's own tables into the shared WordPress database - including user credentials and personally identifiable information. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
SQL injection in the CubeWP WordPress framework plugin versions 1.1.30 and earlier grants any authenticated subscriber the ability to execute arbitrary SQL against the underlying WordPress database, with a CVSS-confirmed scope change that extends impact beyond the plugin itself to the full database layer. Exploitation requires only the lowest WordPress authenticated role - subscriber - combined with network access and no user interaction, meaning any registered site user is a potential threat actor. No active exploitation via CISA KEV and no public POC have been identified at time of analysis, but the low privilege entry bar and high confidentiality impact make this a meaningful risk for sites with open user registration.
SQL injection in the Do Lasso WordPress plugin (versions ≤ 358) allows authenticated subscribers to execute arbitrary database queries against the underlying MySQL instance. The vulnerability carries a CVSS 8.5 score with a changed scope indicator, meaning successful exploitation can expose data beyond the plugin's own tables - potentially the entire WordPress database including user credentials and site configuration. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low authentication bar of subscriber-level access makes this reachable by any registered WordPress user on an affected site.
Blind SQL injection in the Booktics WordPress plugin (all versions through 1.0.22) enables authenticated low-privileged network attackers to systematically extract data from the underlying database. The CVSS Scope:Changed metric indicates data exposure extends beyond the plugin's own tables to the broader WordPress database, yielding a High confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network accessibility make this a meaningful risk for any WordPress site running an affected version.
Privilege escalation in Lenovo Accessories and Display Manager for Enterprise for Windows allows a local authenticated user with low-level privileges to execute arbitrary code at elevated privilege levels, stemming from a hard-coded cryptographic key (CWE-321). The vulnerability was surfaced during an internal Lenovo security assessment and affects all versions of the product per the CPE wildcard. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor patch is confirmed available via Lenovo advisory LEN-213038.
Symlink following in rsync before 3.5.0 enables local privilege escalation by allowing a low-privileged attacker to redirect ancillary file writes - such as log files, batch files, or daemon statistics - to arbitrary filesystem locations. Affected installations are those where rsync executes with elevated privileges, specifically setuid binaries or privileged daemon configurations, making the impact proportional to how widely such configurations are deployed. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.5 and the designation of v3.5.0 as a 'major security release' by the rsync maintainers signal this is treated as a high-severity finding.
Privilege escalation in Lenovo Dock Manager allows a local authenticated user to execute arbitrary code with elevated privileges by exploiting improper file or directory permissions (CWE-276). The flaw was identified during Lenovo's own internal security assessment, suggesting proactive vendor discovery rather than external researcher or attacker-driven disclosure. No public exploit code has been identified at time of analysis, and the local-only attack vector (AV:L, PR:L) meaningfully constrains real-world exposure compared to network-exploitable vulnerabilities, though enterprise environments with shared Lenovo workstations should treat this as a genuine privilege escalation risk.
SQL injection in Form Maker by 10Web (WordPress plugin) versions 1.15.44 and earlier allows subscriber-level authenticated users to execute arbitrary SQL queries against the underlying database, achieving high confidentiality impact with scope change beyond the WordPress application boundary. The CVSS score of 8.5 reflects low-privilege exploitation with network access and no required user interaction, making this accessible to any registered WordPress user on an affected site. No public exploit code or CISA KEV listing has been identified at time of analysis.
DNS rebinding SSRF in Budibase before 3.40.0 exposes internal HTTP services to authenticated builder-level users who can bypass the platform's outbound fetch blacklist protections. Two distinct code paths are exploitable: the OpenAPI query import feature performs a raw fetch independently of its DNS validation guard, and the REST datasource/query execution path uses an undici dispatcher that re-resolves hostnames at connection time, defeating the pinned Node agent passed to fetchWithBlacklist(). No active exploitation is confirmed by CISA KEV, but the GHSA advisory includes detailed proof-of-concept reproduction steps with observed loopback canary responses, making this reliably reproducible by any builder-level account holder.
Ruby code injection in the amazing_print gem's AwesomeMethodArray#grep enables arbitrary Ruby code execution inside the host process when attacker-controlled strings containing interpolation syntax reach a dynamically constructed eval call. Specifically pinned to commit dc890dfafdf07088ea901df53c19c2710e5c5234, the flaw requires an application code path where externally influenced values can become method names processed by grep with a block. A publicly available proof-of-concept exists on GitHub Gist, and while the CVE is not in CISA KEV, the full-RCE impact in affected deployments warrants urgent remediation review.
Server-side request forgery in Serendipity before 2.6.0 allows authenticated users with the adminImagesAdd permission to probe internal network services by submitting image URLs encoded as hex IPv4 addresses, IPv6 literals, or link-local ranges that bypass the serendipity_url_allowed() filter. The server fetches the internal resource and stores the response body in the publicly accessible uploads directory, enabling exfiltration of sensitive internal data such as cloud metadata or internal API responses. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though the low attack complexity and well-understood SSRF technique lower the barrier for any attacker who obtains valid credentials.
Path traversal in rsync daemon before 3.5.0 allows remote rsync clients to read and write files outside the configured module root. The root cause is the daemon calling chdir() to the module root at session start without resolving symlinks via realpath(), so if the module root path or any path component is a symlink, subsequent relative-path operations resolve against the symlink target instead of the intended directory. Exploitation requires two server-side conditions - use chroot disabled and a symlink anywhere in the module root path - but no special conditions on the attacker side beyond having rsync client access to the module. No public exploit code or CISA KEV listing is identified at time of analysis.
Arbitrary file read in rsync before 3.5.0 enables attackers with local low-privilege access to read files accessible to the rsync daemon process by exploiting improper symlink resolution in input configuration file handling. The vulnerability affects --files-from, --password-file, and filter merge file paths, allowing placement of a symlink at a predictable argument path or supply of a --files-from path that escapes the daemon module root. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vendor has released a confirmed fix in rsync 3.5.0.
Supply chain compromise of Go module environments is possible when a malicious GOPROXY serves specifically crafted forged sumdb tile pairs, exploiting CWE-347 (improper cryptographic verification) in the cmd/go toolchain's tile-parent validation logic. Affected are cmd/go versions before 1.25.13, 1.26.6, and 1.27.0-rc.3 - any developer workstation or CI/CD pipeline using these versions and a non-default GOPROXY is at risk of silently caching attacker-controlled module content that cannot be distinguished from legitimate modules through normal transparency log evaluation. No public exploit has been identified and no CISA KEV listing exists; EPSS of 0.12% (3rd percentile) indicates low current exploitation probability, but the theoretical supply chain impact is severe.
Out-of-bounds write in rsync 3.2.3 through 3.4.x corrupts .bss-segment memory via misuse of snprintf() return semantics in parse_size_arg(), enabling remote denial-of-service and potential memory corruption with high availability impact. The CVSS 4.0 score of 8.3 with AV:N/PR:N reflects that an unauthenticated remote attacker can reach the vulnerable code path, though AC:H indicates the truncation condition requires a specifically crafted size argument. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. The fix is confirmed in v3.5.0, designated a major security release by the maintainers.
Credential plaintext exposure in Budibase before 3.40.0 allows any authenticated user with table read permissions to retrieve live MongoDB connection strings and Firebase private keys via the standard read API. The root failure is that STRING-typed datasource fields bypass the platform's credential redaction logic entirely, leaving secrets accessible through normal API calls. No public exploit code or active exploitation (CISA KEV) has been identified, but the CVSS 4.0 score of 8.3 correctly reflects that successful exploitation yields persistent access to backend databases and cloud service accounts well beyond the Budibase instance itself.