Path traversal in IBM i 7.3 through 7.6 allows remote authenticated attackers holding high-privilege accounts to delete arbitrary files outside their intended directory scope. The flaw (CWE-22) results from insufficient sanitization of user-supplied path input in a file management operation reachable over the network. No public exploit code has been identified at time of analysis, and a vendor-released patch is available via the IBM support portal.
Integer underflow in PostgreSQL's Embedded C preprocessor (ECPG) client allows a database server administrator to crash ECPG client applications by sending a specially crafted bytea value missing its mandatory prefix. Affected versions span all active PostgreSQL major release lines prior to 18.5, 17.11, 16.15, 15.19, and 14.24. The primary impact is temporary denial of service against the ECPG client process via SIGSEGV, with a rare secondary risk of low-severity client-side integrity corruption; no public exploit has been identified at time of analysis.
Incorrect ownership reassignment in PostgreSQL's ALTER TABLE ALTER TYPE command allows a table owner to seize control of dependent statistics objects they did not create. Affected versions span all major supported branches prior to 18.5, 17.11, 16.15, 15.19, and 14.24. An authenticated table owner (high-privilege context per CVSS PR:H) can subsequently execute DROP STATISTICS or ALTER STATISTICS against statistics objects owned by another user, while simultaneously locking the legitimate statistics owner out of those same commands. No public exploit code exists and this CVE is not listed in CISA KEV.
Untrusted search path in PostgreSQL's amcheck extension allows a database user holding EXECUTE privilege on amcheck functions to execute arbitrary functions as the owners of expression indexes by injecting a hostile search_path before calling amcheck. Affected are PostgreSQL major versions 14, 15, 16, and 18 in releases prior to 14.24, 15.19, 16.15, and 18.5 respectively; version 17 is entirely unaffected. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, consistent with the niche exploitation prerequisite of an explicitly granted amcheck EXECUTE privilege.
Broken object-level authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions before 2.4.6) allows any authenticated employee or provider account to read appointment records they are not assigned to, exposing booked customers' personal data. The vulnerability is a classic IDOR (CWE-639): the plugin fetches appointment details by a caller-controlled identifier without verifying the requesting employee is the one assigned to that appointment. No active exploitation has been confirmed (not in CISA KEV), and EPSS places this at the 3rd percentile, reflecting limited real-world exploitation pressure, though the PII disclosure impact is concrete.
JavaScript hijacking in HCL AION v2.1.0 exposes sensitive data from dynamic JavaScript responses to attacker-controlled pages under specific network and user interaction conditions. The vulnerability arises because JSON or JavaScript-formatted responses from AION can be referenced cross-origin by a malicious page, enabling data capture via classic JS hijacking techniques. No public exploit has been identified at time of analysis, and the low CVSS score of 3.7 reflects high attack complexity and constrained impact scope.
Denial of service in Kibana's Cases module allows any authenticated user with case comment privileges to permanently render a specific case inaccessible to all users by posting a comment containing malformed link syntax. The comment rendering pipeline fails to sanitize or reject the invalid input, triggering an uncaught exception (CWE-248) that prevents the case from loading for every subsequent viewer until the offending comment is manually deleted. No public exploit has been identified at time of analysis, and no CISA KEV listing is present; the CVSS score of 4.3 (Medium) reflects the limited blast radius - individual cases rather than the Kibana instance as a whole are affected.
Cross-site request forgery in Zimbra Collaboration's Exchange Web Services (EWS) endpoint (versions before 10.1.17) allows a network-based attacker to perform unauthorized actions on behalf of an authenticated victim by exploiting insufficient content-type validation. Exploitation requires tricking a logged-in Zimbra user into interacting with attacker-controlled content, after which the browser automatically submits a crafted EWS request within the victim's session context. No public exploit has been identified and this CVE is absent from the CISA KEV catalog; the CVSS score of 3.1 accurately reflects the high attack complexity and integrity-only impact bounded to the victim's account.
Insufficient server-side input validation in HCL AION v2.1.0 allows a low-privileged, adjacent-network attacker to submit crafted input that bypasses validation controls, resulting in limited confidentiality disclosure via a scope change to a dependent component. Exploitation requires user interaction, constraining opportunistic use. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Missing authentication on RTSP/ONVIF interfaces across ten Tenda smart camera product lines allows unauthenticated remote attackers to access live video streams without credentials. Affected devices include CH7, CH7G, CH10, CP3, CP3 Pro, CP7, and the TC3-series (TC3B14C, TC3B15C, TC3T14C, TC3T15C) running firmware through 20260625. Public proof-of-concept exploit code exists on GitHub (E:P per CVSS 4.0 supplemental metrics), though high attack complexity (AC:H) limits trivial mass exploitation; no vendor patch has been identified at time of analysis.
Insufficient entropy in session token generation across ten Tenda smart camera and router models enables remote attackers to predict or brute-force valid session identifiers, potentially hijacking authenticated sessions on the Kylin Web Service. All affected models up to firmware build 20260625 are impacted via the CWebSessionManager_ParseSession function in /user/bin/Kylin. A publicly available proof-of-concept exploit is referenced on GitHub, though the CVSS 4.0 E:P modifier and AC:H rating confirm that exploitation is technically demanding rather than trivially scriptable; no active exploitation has been confirmed by CISA KEV.
Path traversal in IBM i 7.3 through 7.6 enables remote attackers holding high-privilege credentials to manipulate files outside intended directory boundaries. The CVSS score of 2.7 (Low) accurately reflects the constrained impact - exploitation is limited to authenticated users with high privileges (PR:H), and the resulting damage is restricted to limited file integrity modification with no confidentiality or availability consequences. No public exploit code has been identified at time of analysis, and IBM has released a vendor patch.
Denial of service in Calix GigaSpire 26.1.0 is reachable remotely through manipulation of the traceroute.cmd diagnostic endpoint, causing availability disruption to the affected device. The root cause is improper resource handling (CWE-404) within the traceroute function, which fails to properly release resources under adversarial input. A proof-of-concept exploit has been publicly disclosed; no vendor patch or advisory is available as the vendor did not respond to coordinated disclosure.
Denial of service in Calix GigaSpire 26.1.0 is achievable remotely by low-privileged attackers who manipulate the sessionKey argument within the utilities_configurationsave.cgi endpoint of the Web Management Interface, causing improper resource release (CWE-404) and disrupting device availability. The affected product is a residential and SMB broadband gateway deployed by ISPs. Published exploit code exists (E:P in the CVSS 4.0 vector), and no vendor patch has been confirmed - the vendor did not respond to the coordinated disclosure.
Path traversal in Dromara lamp-cloud's Code Generator component (DefGenProjectController.java), affecting all versions up to 5.10.0, enables authenticated remote attackers to manipulate the `outputDir`, `parent`, and `projectPrefix` parameters to read or write files outside the application's intended output directory. A proof-of-concept exploit has been publicly disclosed (confirmed by CVSS 4.0 supplemental metric E:P), and no vendor patch is available at time of analysis as the project maintainer has not responded to the responsible disclosure submitted via GitHub issue. The attack requires low-privileged authenticated access, which bounds real-world risk but does not eliminate it in multi-user development or DevOps platforms.
Server-side request forgery in EnzoVezzaro's mcp-dominican-layer MCP server (all versions through commit 39dd373786712650097ad31db27d5c477c8f9c82) allows low-privileged remote attackers to manipulate the pdfUrl argument within the parse-pdf function, causing the server to issue arbitrary outbound HTTP requests to internal or external resources under attacker control. A public proof-of-concept has been disclosed via the GitHub issue tracker, lowering the exploitation bar, though the CVSS 4.0 base score of 2.1 reflects constrained impact. The project maintainer has not responded to the responsible disclosure issue filed on GitHub, and no vendor patch exists at time of analysis.
Server-Side Request Forgery in EnzoVezzaro's mcp-dominican-layer MCP server allows an authenticated remote attacker to coerce the server into issuing arbitrary HTTP requests via the parse-csv tool's unsanitized csvUrl parameter. The vulnerability exists in the axios.get call within src/index.ts and has been confirmed exploitable with a publicly available proof-of-concept. The CVSS 4.0 score of 2.1 reflects the low confidentiality, integrity, and availability impact, but SSRF primitives can be chained to probe internal services or cloud metadata endpoints depending on the deployment context.
Authentication bypass in the Windows network driver of Palo Alto Networks Prisma Access Agent allows a local administrator to circumvent the agent's security inspection enforcement, subsequently enabling injection and interception of arbitrary network traffic. Only the Windows platform is affected - Linux, macOS, iOS, Android, and Chrome OS deployments are explicitly confirmed unaffected by the vendor. No public exploit has been identified at time of analysis, and exploitation requires pre-existing local administrator access, significantly narrowing the realistic threat population.
Unauthenticated information disclosure in PAN-OS's URL Filtering feature exposes sensitive data to network-accessible users. Affecting PAN-OS 10.2.x below 10.2.8, 11.1.x below 11.1.17, all Cloud NGFW versions, and Prisma Access 10.2.x below 10.2.10, the flaw stems from use of uninitialized resources (CWE-908), which can leak memory or state data during URL filtering operations. No public exploit code exists and CISA KEV status is absent; the CVSS 4.0 score of 1.7 reflects the low confidentiality impact and the presence of specific attack requirements.
Symlink-following (CWE-59) in Palo Alto Networks Prisma Access Agent on Linux allows a local low-privileged user to delete a limited set of system files and disable the agent entirely. Only Linux deployments are affected - macOS, Windows, iOS, Android, and Chrome OS are explicitly confirmed safe by the vendor. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS 4.0 supplemental vector classifies exploitation as unlikely (E:U) with Amber urgency, making this a low-priority but genuine patch target for Linux endpoint fleets.
Account Protection bypass in Palo Alto Networks Prisma Browser allows a local user to circumvent intended security controls due to insufficiently protected credentials (CWE-522), yielding low confidentiality exposure with no integrity or availability impact. The CVSS 4.0 score of 0.5 reflects the constrained attack surface - local access only, specific target conditions required (AT:P), and minimal data exposure. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog, consistent with the Exploit Maturity modifier E:U (Unreported).
Prisma Browser's Account Protection feature insufficiently protects sensitive credential data (CWE-522), allowing a local attacker to read it without elevated privileges. All tracked versions are in scope per the wildcard CPE string. The vulnerability carries a CVSS 4.0 base score of 0.5, is not listed in the CISA KEV catalog, and no public exploit code has been identified, placing this firmly in the low-priority tier for most deployment contexts.