Force-disabling of two-factor authentication on Grav CMS user accounts is achievable through a missing scope enforcement check in the grav-plugin-api Composer package before version 1.0.13. Any holder of a low-privilege API key carrying api.users.write permission - or any scoped key on a super account - can POST to /api/v1/users/{user}/2fa/disable without supplying a TOTP code, stripping 2FA from any non-super target account and enabling direct account takeover. No active exploitation is currently confirmed (SSVC Exploitation: none; EPSS 0.34%), but SSVC rates this automatable with total technical impact, making prompt patching critical for any instance exposing the API with delegated keys.
Privilege escalation in Grav's Flex Objects plugin (through version 1.4.6, confirmed against Grav 2.0.11) allows an authenticated low-privileged admin to achieve full site takeover by exploiting a missing authorization check in FlexApiController::update(). The generic /api/v1/flex-objects/user-accounts and /api/v1/flex-objects/user-groups API endpoints omit the field-level, target, and super-admin guards enforced by the dedicated Users and Groups controllers, so an account holding only api.access, admin.login, and users.update can overwrite a super administrator's password or self-grant admin.super group membership. No public exploit is identified at time of analysis; vendor-released patch Flex Objects 1.4.7 is available.
Privilege escalation in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 allows an authenticated API key holder with api.users.write scope to silently bypass the scope-cap enforcement and self-elevate to super-administrator. The flaw lies in UsersController's create() and update() methods, which validate scope caps only for api.users.write actions but fall back to a bare isSuperAdmin() check - reading access.api.super from the parent account rather than the key's own scope - when granting super privileges, allowing a limited key on a super account to mint or promote unrestricted admin accounts. A proof-of-concept exists per SSVC assessment, CISA rates exploitation as automatable with total technical impact, and a vendor-released patch is available at version 1.0.13.
Privilege escalation in the getgrav/grav-plugin-api plugin before 1.0.13 allows an authenticated attacker holding only a minimal api.access-scoped key on a super account to mint a full-access, unscoped super key by exploiting missing scope-subset enforcement in createApiKey. The self-target path of requireApiKeyPermission() enforces only the baseline api.access scope, while the new key's scopes are taken verbatim from the attacker-controlled request body with no validation that they fall within the caller's granted scopes. Submitting an empty scopes array produces a key with unrestricted super privileges, directly enabling further attack chains including configuration-write-to-RCE. No public exploit code or CISA KEV listing is confirmed at time of analysis; EPSS is 0.30% (23rd percentile). Vendor-released patch version 1.0.13 is available.
Improper access control in File Browser before 2.63.20 allows authenticated users operating through proxy or hook authentication to escape their isolated directory scope and access the server root, exposing all other users' files for reading, modification, deletion, and sharing. The flaw specifically targets the createUserDir isolation mechanism, which is bypassed during auto-provisioning in proxy and hook authentication paths - leaving multi-tenant or shared File Browser deployments fully compromised at the data layer. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the CVSS 4.0 score of 8.7 reflects the high impact once a valid upstream credential is obtained.
Privilege escalation in getgrav/grav-plugin-api versions 1.0.6 through 1.0.11 allows any holder of a scoped, read-only API key to perform super-admin write operations - including rewriting group ACL maps to elevate arbitrary accounts to super-admin. The flaw exists because four privileged write endpoints (GroupsController, AccountsConfigController, PreferencesController, DashboardWidgetController) authorize via an isSuperAdmin() early-return that entirely skips requirePermission(), the only function that enforces scope caps on API keys. A leaked CI or monitoring key with a minimal scope such as api.pages.read is sufficient to achieve full administrative compromise. No public exploit code has been identified at time of analysis, and a patch is available in version 1.0.13.
Arbitrary file write via path traversal in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to place files at any location on the underlying IBM i system. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/I:H) confirms network-reachable exploitation without authentication, with a scope change indicating impact beyond the Db2 Mirror application itself - reaching OS-level paths. No public exploit or KEV listing has been identified at time of analysis, and an EPSS of 0.59% (46th percentile) suggests low observed exploitation activity despite the high CVSS base score.
Unauthenticated firmware flashing in Netis NC63 routers (firmware V3.0.0.3327) allows any attacker on the same network segment to permanently compromise the device by uploading arbitrary firmware without credentials. Two compounding flaws enable this: the embedded Boa web server grants access to any URL path containing '.cgi' regardless of session cookie validity, and the netis.cgi CGI dispatcher reads but never enforces the authentication state before invoking the firmware update handler. Firmware images are accepted if they pass only a forgeable additive checksum and static product string checks - no cryptographic signature verification is performed. A public proof-of-concept exploit exists on GitHub (ozcanpng/CVE-2026-73673), and no vendor-released patch has been identified at time of analysis.
Privilege escalation in Tenable Security Center allows an authenticated Security Manager to manage users outside their authorized group scope, bypassing the platform's intended group-based access controls. The flaw affects all Security Center versions prior to 6.9.0 and is exploitable over the network by any user holding the Security Manager role with at least one 'manage user' permission grant. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, though the vendor has self-reported it and released a patch via advisory TNS-2026-22.
Cross-tenant payroll data exposure in Roskus Prospero Flow CRM before 5.15.10 enables authenticated users holding standard payroll permissions to read salary and banking details belonging to employees of entirely separate companies within the same multi-tenant instance, and to create payroll records attributed to those foreign employees. The flaw exists at the query layer: the payroll listing endpoint omits a company_id scope constraint, and payroll creation validates employee identifiers for global database existence rather than for membership in the caller's own company. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation barrier makes this an urgent priority for any multi-tenant deployment.
Privilege escalation in Grav Plugin API before 1.0.13 allows an attacker controlling a minimal api.users.write API key - issued under a super admin account - to craft invitation records that embed super-admin access flags, which are written verbatim to any account that accepts the invitation. The root cause is CWE-269 improper privilege management: InvitationsController's strip-super and accept-groups decisions evaluate isSuperAdmin() against the owning account rather than against the API key's declared scope, so a deliberately restricted key silently retains the owner's super-admin authority for these checks. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SQL injection in Emlog 2.6.20 and earlier exposes the database to full compromise through the queryDatabase function in ai.php, a component of the platform's AI feature set. The CVSS 4.0 vector (PR:H) confirms exploitation requires high-privilege authenticated access, yet the resulting impact is rated High across confidentiality, integrity, and availability of the vulnerable system. No public exploit code or active exploitation has been identified at time of analysis.
SQL injection in iCagenda, a Joomla event calendar extension by icagenda.com, affects all versions prior to 4.0.11 and allows authenticated backend operators with iCagenda access permissions to execute arbitrary SQL through an unescaped numeric filter parameter. Successful exploitation yields full database confidentiality, integrity, and availability compromise - enabling data exfiltration, modification, or destruction of the underlying Joomla database. No public exploit or CISA KEV listing has been identified at time of analysis, and the PR:H requirement limits the realistic attacker pool to trusted insiders or compromised admin accounts.
SQL injection in the Paymob for WooCommerce WordPress plugin (versions before 4.1.9) allows unauthenticated remote attackers to read arbitrary data from the WordPress database - including user credentials and application secrets - by submitting a crafted payment callback request. The critical design flaw is that the unsanitized client-supplied identifier is passed directly into a SQL query before the plugin validates the payment provider's HMAC signature, entirely bypassing the intended authentication gate. Both in-band (reflected) and time-based blind extraction techniques are viable, maximizing attacker flexibility. No public exploit or active exploitation (CISA KEV) is confirmed at time of analysis, though the unauthenticated, low-complexity attack vector makes this a high-priority patching target for any site running this plugin.
Reflected XSS in LimeSurvey Community Edition 7.0.5 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of an authenticated administrator by delivering a crafted URL targeting the HTML editor popup endpoint. The `text` and `name` query parameters bypass a blacklist-based sanitizer and are rendered unencoded across at least four distinct output contexts - an HTML title element, a JavaScript `window.status` assignment, and multiple `document.getElementById()` calls - confirmed by the patch commit diff. No public exploit has been identified at time of analysis, but an upstream fix is available as a merged GitHub commit and a vendor patch is listed as available.
Command injection (CWE-78) in Tenable Security Center versions prior to 6.9.0 enables a local attacker with write access to a specific configuration file to achieve arbitrary code execution at elevated privilege levels, with no user interaction required after file modification. Self-disclosed by Tenable and remediated in Security Center 6.9.0, as documented in advisory TNS-2026-22. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Remote code execution in Eclipse Theia 1.69.0 and earlier allows an attacker to execute arbitrary commands with the victim's user privileges by embedding a malicious git repository configuration inside a cloned repository. Any Theia-based IDE or application including the @theia/git extension or the bundled VS Code git extension is affected, because both automatically invoke git commands such as git status upon folder open without first presenting a workspace trust prompt. This vendor-confirmed issue is fixed in version 1.70.0 via workspace trust enforcement; no public exploit code has been identified at time of analysis and it does not appear in the CISA KEV catalog.
Unprivileged user-mode threads in Zephyr RTOS can crash the kernel or disclose arbitrary kernel memory by exploiting a missing validation step in the logging subsystem's syscall verifier, directly violating the user/kernel isolation boundary that CONFIG_USERSPACE is designed to enforce. Any Zephyr build compiled with CONFIG_USERSPACE=y is affected, as the __syscall-decorated z_log_msg_static_create() function accepted fully attacker-controlled pointer and length arguments without any K_SYSCALL_* bounds checking in its verifier function z_vrfy_z_log_msg_static_create(). No public exploit identified at time of analysis; an upstream fix has been committed to zephyrproject-rtos/zephyr and documented in GitHub Security Advisory GHSA-h7rf-g9mg-g23f.
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a heap-based buffer overflow (CWE-122) that network-accessible, unauthenticated attackers can trigger when a victim interacts with attacker-controlled content. The CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) reflects high confidentiality and integrity impact with low attack complexity, requiring only that the user visit or open a crafted resource. No public exploit code and no CISA KEV listing have been identified at time of analysis.
OS command injection in @ooples/token-optimizer-mcp v5.0.1 and earlier allows any MCP client that can call the smart_user tool to execute arbitrary shell commands with the privileges of the MCP server process. The get-user-info operation interpolates the caller-controlled username argument directly into a shell command string passed to Node.js execAsync(), and the double-quoting applied by the developer does not prevent POSIX shell command substitution via $(...) or backtick syntax. A complete, working proof-of-concept is publicly available via GHSA-49mq-fc6q-3h46; no public exploit identified at time of analysis as actively exploited per CISA KEV, though the low exploitation complexity makes this a high-priority patching target.
Authorization regression in Budibase v3.39.4 enables any authenticated BASIC user to generate S3 PutObject presigned URLs for arbitrary S3 buckets, bypassing the intended BUILDER-level permission gate on the attachment upload endpoint. The regression introduced in v3.39.4 - where the route guard was changed from `authorized(BUILDER)` to `authorized(PermissionType.TABLE, PermissionLevel.WRITE)` - gives all default BASIC users access to an endpoint that was explicitly restricted to builders. Compounding the issue, the endpoint accepts an attacker-controlled `bucket` parameter without validating it against the datasource's configured bucket, allowing writes to any S3 bucket reachable by the platform's stored IAM credentials. No public exploit tool exists at time of analysis, but the official GHSA advisory publishes complete reproduction steps and the test suite confirms the behavior, making exploitation trivial for any authenticated platform user.
XXE injection in Datavane TIS v5.0.0 exposes authenticated attackers a path to SSRF and out-of-band file exfiltration against the server hosting the application. The `doEditWorkflow` endpoint accepts a `taskScript` parameter parsed by an unhardened Java `DocumentBuilderFactory` that resolves external entities and loads external DTDs, allowing a crafted XML payload to trigger outbound HTTP requests to attacker-controlled infrastructure and read local files accessible to the TIS process user, including configuration files and Derby database credentials. No public exploit has been identified at time of analysis, but VulnCheck has published a dedicated advisory and the upstream patch commit is publicly accessible, providing clear technical signal about the vulnerable code path.
Red Hat Quay 3 and Red Hat OpenShift Update Service expose an unauthenticated security scanner notification endpoint when the SECURITY_SCANNER_V4_PSK (pre-shared key) is absent, enabling remote unauthenticated attackers to flood the notification queue and inject path traversal characters into outbound Clair API URL paths. The primary impact is worker resource exhaustion leading to denial of service, with a secondary low-integrity impact from blind path manipulation against the configured Clair vulnerability scanner host. No public exploit identified at time of analysis, and EPSS of 0.26% (17th percentile) indicates low current exploitation probability.
Insecure deserialization (CWE-502) in AVEVA Enterprise SCADA and related pipeline/HMI products allows an authenticated operator holding the 'DNA Authority - Operator' role to tamper with serialized data and achieve code execution during deserialization, running under the elevated Enterprise SCADA 'DNA Apps' security group. The flaw affects AVEVA Enterprise SCADA, Enterprise SCADA HMI, Pipeline Operations for Gas/Liquids, Pipeline Integrity Monitor, Pipeline Training Simulator, and Measurement Advisor, and is fixed per AVEVA Security Bulletin AVEVA-2026-005 and CISA advisory ICSA-26-225-01. There is no public exploit identified at time of analysis, but the reported CVSS 4.0 base score is 10.0.
Arbitrary file deletion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is achievable by remote authenticated attackers holding only low-privileged credentials, exploiting a path traversal flaw that bypasses directory boundary enforcement to reference and delete files anywhere on the target filesystem. The CVSS 3.1 score of 8.1 reflects high integrity and availability impact with low attack complexity, though the EPSS score of 0.44% at the 37th percentile signals limited observed exploitation probability at time of analysis. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog.
Code injection in Devolutions PowerShell Universal 2026.2.3 and earlier allows any authenticated user granted settings management permissions to execute arbitrary PowerShell within the platform runtime. The vulnerability arises because setting values submitted through the settings interface are not properly escaped before being written to the configuration file, which is subsequently parsed and interpreted as executable code. No public exploit code has been identified at time of analysis, and SSVC reports no known active exploitation, but the technical impact is rated total given full arbitrary code execution capability.
Privilege escalation in Akaunting versions 3.1.21 and earlier allows any low-privileged authenticated user to self-assign the administrator role, gaining full platform control. The flaw resides in the UpdateUser job, which invokes roles()->sync() on caller-supplied role IDs without verifying whether the requesting user holds authorization to assign roles - exploitable by any account holding the default update-auth-profile permission. No public exploit has been confirmed at time of analysis, but the low exploitation barrier (authenticated, no special config) and full admin impact make this a high-priority remediation target.
Privilege escalation in the Essential Addons for Elementor WordPress plugin (versions 5.8.6 through before 6.7.2) permits unauthenticated remote attackers to self-register accounts with arbitrary WordPress roles, up to and including administrator, by supplying crafted values in user registration fields that overwrite reserved account attributes. The attack is gated on a non-default site configuration - specifically, a custom profile registration field with a particular label must have been set up by the site administrator - meaning only a subset of the estimated multi-million plugin install base is realistically exposed. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated path to full admin access makes affected sites a critical-priority remediation target.
Command injection in Microsoft PowerShell 7.4, 7.5, and 7.6 allows a locally authenticated attacker with standard user privileges to execute arbitrary code on the affected system. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only local access and a low-privileged account - no elevated rights, user interaction, or complex conditions are needed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity lowers the bar for exploitation once an injection point is discovered.
Elevation of privilege in the Microsoft Malware Protection Engine (Microsoft Defender), publicly named 'ShieldBreak', allows a locally authenticated low-privileged user to gain high-level system access. The CVSS vector confirms a local, low-complexity attack requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact. Proof-of-concept exploit code exists (E:P in the temporal vector), and Microsoft has acknowledged the vulnerability publicly.
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 enables a local low-privileged attacker to gain elevated system control by exploiting incorrectly set default permissions on files or resources managed by the WMS platform (CWE-269). The CVSS vector confirms a scope change (S:C) with full confidentiality, integrity, and availability impact, meaning a successful exploit transcends the initially compromised process context. Dell has released a fix in version 2605.0.2 via advisory DSA-2026-329; no public exploit code has been identified at time of analysis.
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows a low-privileged local attacker to fully compromise the host system through improper deserialization of untrusted data. The vulnerability carries a CVSS 7.8 High score with full confidentiality, integrity, and availability impact scoped to the vulnerable system. No public exploit code has been identified and EPSS places this at the 0th percentile for near-term exploitation likelihood; however, SSVC rates the technical impact as total, meaning successful exploitation results in complete system compromise for any attacker already holding local access.
Sensitive file disclosure in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is possible through a path traversal flaw (CWE-22) that allows attackers to escape a restricted directory boundary and read files outside the intended accessible path, resulting in high confidentiality impact. The CVE description attributes the exposure to a remote authenticated attacker, though this conflicts with the NVD-assigned CVSS vector - a discrepancy security teams must resolve before finalizing triage. A vendor patch is available via IBM Support advisory node/7283359; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote authenticated attackers to read sensitive files outside intended directory boundaries due to improper input validation (CWE-22). The vulnerability results in high confidentiality impact with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available via IBM support advisory node 7283359.
Path canonicalization bypass in filebrowser before v2.63.21 permits authenticated users to circumvent administrator-configured deny rules by submitting case-variant or backslash-delimited path representations that the access rule engine fails to normalize before evaluation. The filesystem resolves these alternate representations to the same restricted objects, but the rules engine never matches them, effectively granting access to files the administrator explicitly intended to block. No public exploit code has been identified at time of analysis, though the attack concept is well-understood and straightforward to implement for any authenticated user of an affected deployment.
Arbitrary file write via path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes systems to unauthenticated remote exploitation. The flaw stems from improper pathname restriction (CWE-22), enabling an attacker to escape the intended directory sandbox and write files to arbitrary filesystem locations. No active exploitation has been confirmed in CISA KEV, and no public proof-of-concept exploit is known at the time of analysis, though the CVSS 8.2 High rating and network-accessible attack vector make this a credible priority for organizations running IBM i environments.
Uncontrolled recursion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to crash the service, resulting in a complete loss of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is exploitable over the network without credentials or user interaction, making it trivially reachable in any internet- or network-exposed deployment. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, but the low attack complexity elevates practical risk.
Memory exhaustion via crafted VP8L images affects golang.org/x/image/vp8l in all versions before 0.45.0, enabling remote unauthenticated attackers to crash Go applications that process untrusted image content through this library. The VP8L decoder fails to bound heap allocation when decoding images that declare many unused Huffman tree groups, turning a parsing decision into unconstrained memory growth. No public exploit code or CISA KEV listing exists at time of analysis, but the trivial network attack vector and zero-privilege requirement make this a practical DoS risk for any internet-facing service accepting image uploads.
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes a network-accessible pathway through which an unauthenticated remote attacker can externally influence system configuration settings (CWE-15), enabling disclosure of sensitive information and - per the CVSS vector - potential integrity and availability compromise as well. The changed scope (S:C) in the CVSS vector indicates the vulnerability can propagate impact beyond the directly affected component, consistent with how mirror configuration alterations can affect the paired IBM i high-availability node. A vendor-released patch is available via IBM Support; no public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Arbitrary file write via link-following in PAX Technology Q80 AIP file parsing allows network-adjacent unauthenticated attackers to place attacker-controlled content at arbitrary filesystem paths by embedding a crafted symbolic link within an AIP installer package. This primitive cannot independently achieve code execution - it must be chained with at least one additional vulnerability to reach root-level RCE on the payment terminal. Disclosed through ZDI coordinated disclosure (ZDI-CAN-30583/ZDI-26-525); no public exploit has been identified at time of analysis.
Heap exhaustion via unbounded JSON body reading in the Apache Struts JSON plugin allows unauthenticated remote attackers to deny service by sending a single oversized HTTP request to any endpoint where request-body-to-action population is enabled. Affected version ranges span the 2.x, 6.x, and 7.x release lines. No public exploit code has been identified at time of analysis and SSVC signals no active exploitation, but the attack is rated automatable, meaning scripted large-scale scanning and denial-of-service campaigns are feasible against exposed endpoints.
Red Hat Quay 3's exported action logs download endpoint fails to enforce authorization, permitting any network-accessible party who holds a valid file ID to retrieve full audit log exports without authenticating. The file IDs, while complex and not publicly guessable, are transmitted in plaintext via email notifications and webhook callbacks - creating a realistic interception pathway for adversaries with network positioning. No active exploitation or public POC has been identified; EPSS at 0.31% (23rd percentile) reflects low automated exploitation probability, though targeted disclosure remains credible wherever log export notifications traverse unencrypted channels.
Signature verification bypass in the PAX Technology Q80 payment terminal's application installer enables network-adjacent unauthenticated attackers to install unsigned or malicious applications, which when chained with a secondary vulnerability results in arbitrary code execution at the root privilege level. The flaw stems from the installer's failure to properly validate cryptographic signatures - tagged as a JWT attack vector - before accepting and executing application packages. No public exploit or confirmed active exploitation (CISA KEV) has been identified at time of analysis, though the formal ZDI advisory ZDI-26-526 publicly discloses the vulnerability details.
Remote code execution in ZeroBrew 0.3.1 and prior exploits the absence of SHA-256 checksum validation in the Ruby compatibility shim (shim.rb), enabling a network-positioned attacker to substitute malicious archives or patch files during source builds. The attack surface is specifically the 'zb install --build-from-source' workflow, where secondary resource downloads and URL-based patch fetches proceed without any integrity check, allowing attacker-controlled content to execute arbitrary build steps. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-confirmed patch v0.3.2, released 2026-06-11, closes the gap by adding pre-extraction SHA-256 verification.
Red Hat Quay's Stripe billing webhook handler at /webhooks/stripe processes inbound JSON payloads without verifying the Stripe-Signature HMAC header, enabling any network-reachable unauthenticated attacker to forge billing events. Successful exploitation resets the targeted namespace's build quota to its configured maximum and dispatches unsolicited billing notification emails to namespace administrators. No public exploit has been identified and EPSS is 0.14% (4th percentile), but the zero-prerequisite attack path makes exploitation trivially scriptable by any attacker with HTTP access to the endpoint.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 exposes authenticated remote attackers to potential arbitrary code execution by sending an oversized `Comment` argument to the `setMacFilterRules` CGI function. A public proof-of-concept has been disclosed on GitHub (corroborated by the CVSS 4.0 E:P modifier), elevating real-world risk beyond the base score of 7.4. No vendor advisory or patched firmware version has been identified at time of analysis, leaving affected devices without an official remediation path.
Stack-based buffer overflow in the TOTOLINK A800R router (firmware 4.1.2cu.5137_B20200730) enables remote code execution via the IPv6 configuration CGI endpoint. The `setRadvdCfg` function in `ipv6.so` fails to validate the length of the `radvdinterfacename` argument before writing it to a stack buffer, allowing an authenticated attacker to overwrite the return address and redirect execution. A public proof-of-concept has been disclosed, and no vendor patch has been identified at time of analysis.
Stack/heap buffer overflow in the Tenda AC12 router (firmware 15.03.06.23_multi_TD01) allows remote low-privileged attackers to potentially execute arbitrary code by sending a crafted HTTP request to the `/goform/SetSysAutoRebbotCfg` endpoint with an oversized `rebootTime` argument. All three impact pillars - confidentiality, integrity, and availability - are rated high for the vulnerable system per the CVSS 4.0 vector. Publicly available exploit code exists per a GitHub PoC disclosure; no confirmed CISA KEV listing was identified at time of analysis.
OpenAM Community Edition through 16.0.6 ships its iPlanetDirectoryPro SSO session cookie with HttpOnly disabled and no SameSite attribute by default, and reuses that same cookie value as the CSRF token for the OAuth/OIDC consent flow. When chained with any other same-origin XSS in the OpenAM console, a single clicked attacker link lets a remote, unauthenticated attacker read the cookie from document.cookie, hijack a logged-in console user's full SSO session, and simultaneously submit attacker-controlled OAuth consent grants using the stolen cookie as the anti-CSRF token. The issue is fixed by
Stack-based buffer overflow in TOTOLINK A800R router firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to achieve arbitrary code execution by sending an oversized Comment argument to the setStaticDhcpConfig function via the CGI web interface. Exploit code has been publicly disclosed (CVSS 4.0 E:P), substantially lowering the exploitation barrier. No CISA KEV listing was identified, but the combination of public PoC, network-accessible attack surface, and high C/I/A impact makes this a credible threat for any deployment where the router management interface is reachable by untrusted users.