Red Hat Quay 3 and Red Hat OpenShift Update Service expose an unauthenticated security scanner notification endpoint when the SECURITY_SCANNER_V4_PSK (pre-shared key) is absent, enabling remote unauthenticated attackers to flood the notification queue and inject path traversal characters into outbound Clair API URL paths. The primary impact is worker resource exhaustion leading to denial of service, with a secondary low-integrity impact from blind path manipulation against the configured Clair vulnerability scanner host. No public exploit identified at time of analysis, and EPSS of 0.26% (17th percentile) indicates low current exploitation probability.
Arbitrary file deletion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is achievable by remote authenticated attackers holding only low-privileged credentials, exploiting a path traversal flaw that bypasses directory boundary enforcement to reference and delete files anywhere on the target filesystem. The CVSS 3.1 score of 8.1 reflects high integrity and availability impact with low attack complexity, though the EPSS score of 0.44% at the 37th percentile signals limited observed exploitation probability at time of analysis. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog.
Code injection in Devolutions PowerShell Universal 2026.2.3 and earlier allows any authenticated user granted settings management permissions to execute arbitrary PowerShell within the platform runtime. The vulnerability arises because setting values submitted through the settings interface are not properly escaped before being written to the configuration file, which is subsequently parsed and interpreted as executable code. No public exploit code has been identified at time of analysis, and SSVC reports no known active exploitation, but the technical impact is rated total given full arbitrary code execution capability.
Privilege escalation in Akaunting versions 3.1.21 and earlier allows any low-privileged authenticated user to self-assign the administrator role, gaining full platform control. The flaw resides in the UpdateUser job, which invokes roles()->sync() on caller-supplied role IDs without verifying whether the requesting user holds authorization to assign roles - exploitable by any account holding the default update-auth-profile permission. No public exploit has been confirmed at time of analysis, but the low exploitation barrier (authenticated, no special config) and full admin impact make this a high-priority remediation target.
Privilege escalation in the Essential Addons for Elementor WordPress plugin (versions 5.8.6 through before 6.7.2) permits unauthenticated remote attackers to self-register accounts with arbitrary WordPress roles, up to and including administrator, by supplying crafted values in user registration fields that overwrite reserved account attributes. The attack is gated on a non-default site configuration - specifically, a custom profile registration field with a particular label must have been set up by the site administrator - meaning only a subset of the estimated multi-million plugin install base is realistically exposed. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated path to full admin access makes affected sites a critical-priority remediation target.
Command injection in Microsoft PowerShell 7.4, 7.5, and 7.6 allows a locally authenticated attacker with standard user privileges to execute arbitrary code on the affected system. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only local access and a low-privileged account - no elevated rights, user interaction, or complex conditions are needed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity lowers the bar for exploitation once an injection point is discovered.
Elevation of privilege in the Microsoft Malware Protection Engine (Microsoft Defender), publicly named 'ShieldBreak', allows a locally authenticated low-privileged user to gain high-level system access. The CVSS vector confirms a local, low-complexity attack requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact. Proof-of-concept exploit code exists (E:P in the temporal vector), and Microsoft has acknowledged the vulnerability publicly.
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 enables a local low-privileged attacker to gain elevated system control by exploiting incorrectly set default permissions on files or resources managed by the WMS platform (CWE-269). The CVSS vector confirms a scope change (S:C) with full confidentiality, integrity, and availability impact, meaning a successful exploit transcends the initially compromised process context. Dell has released a fix in version 2605.0.2 via advisory DSA-2026-329; no public exploit code has been identified at time of analysis.
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows a low-privileged local attacker to fully compromise the host system through improper deserialization of untrusted data. The vulnerability carries a CVSS 7.8 High score with full confidentiality, integrity, and availability impact scoped to the vulnerable system. No public exploit code has been identified and EPSS places this at the 0th percentile for near-term exploitation likelihood; however, SSVC rates the technical impact as total, meaning successful exploitation results in complete system compromise for any attacker already holding local access.
Sensitive file disclosure in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is possible through a path traversal flaw (CWE-22) that allows attackers to escape a restricted directory boundary and read files outside the intended accessible path, resulting in high confidentiality impact. The CVE description attributes the exposure to a remote authenticated attacker, though this conflicts with the NVD-assigned CVSS vector - a discrepancy security teams must resolve before finalizing triage. A vendor patch is available via IBM Support advisory node/7283359; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote authenticated attackers to read sensitive files outside intended directory boundaries due to improper input validation (CWE-22). The vulnerability results in high confidentiality impact with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available via IBM support advisory node 7283359.
Path canonicalization bypass in filebrowser before v2.63.21 permits authenticated users to circumvent administrator-configured deny rules by submitting case-variant or backslash-delimited path representations that the access rule engine fails to normalize before evaluation. The filesystem resolves these alternate representations to the same restricted objects, but the rules engine never matches them, effectively granting access to files the administrator explicitly intended to block. No public exploit code has been identified at time of analysis, though the attack concept is well-understood and straightforward to implement for any authenticated user of an affected deployment.
Arbitrary file write via path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes systems to unauthenticated remote exploitation. The flaw stems from improper pathname restriction (CWE-22), enabling an attacker to escape the intended directory sandbox and write files to arbitrary filesystem locations. No active exploitation has been confirmed in CISA KEV, and no public proof-of-concept exploit is known at the time of analysis, though the CVSS 8.2 High rating and network-accessible attack vector make this a credible priority for organizations running IBM i environments.
Uncontrolled recursion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to crash the service, resulting in a complete loss of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is exploitable over the network without credentials or user interaction, making it trivially reachable in any internet- or network-exposed deployment. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, but the low attack complexity elevates practical risk.
Memory exhaustion via crafted VP8L images affects golang.org/x/image/vp8l in all versions before 0.45.0, enabling remote unauthenticated attackers to crash Go applications that process untrusted image content through this library. The VP8L decoder fails to bound heap allocation when decoding images that declare many unused Huffman tree groups, turning a parsing decision into unconstrained memory growth. No public exploit code or CISA KEV listing exists at time of analysis, but the trivial network attack vector and zero-privilege requirement make this a practical DoS risk for any internet-facing service accepting image uploads.
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes a network-accessible pathway through which an unauthenticated remote attacker can externally influence system configuration settings (CWE-15), enabling disclosure of sensitive information and - per the CVSS vector - potential integrity and availability compromise as well. The changed scope (S:C) in the CVSS vector indicates the vulnerability can propagate impact beyond the directly affected component, consistent with how mirror configuration alterations can affect the paired IBM i high-availability node. A vendor-released patch is available via IBM Support; no public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Arbitrary file write via link-following in PAX Technology Q80 AIP file parsing allows network-adjacent unauthenticated attackers to place attacker-controlled content at arbitrary filesystem paths by embedding a crafted symbolic link within an AIP installer package. This primitive cannot independently achieve code execution - it must be chained with at least one additional vulnerability to reach root-level RCE on the payment terminal. Disclosed through ZDI coordinated disclosure (ZDI-CAN-30583/ZDI-26-525); no public exploit has been identified at time of analysis.
Heap exhaustion via unbounded JSON body reading in the Apache Struts JSON plugin allows unauthenticated remote attackers to deny service by sending a single oversized HTTP request to any endpoint where request-body-to-action population is enabled. Affected version ranges span the 2.x, 6.x, and 7.x release lines. No public exploit code has been identified at time of analysis and SSVC signals no active exploitation, but the attack is rated automatable, meaning scripted large-scale scanning and denial-of-service campaigns are feasible against exposed endpoints.
Red Hat Quay 3's exported action logs download endpoint fails to enforce authorization, permitting any network-accessible party who holds a valid file ID to retrieve full audit log exports without authenticating. The file IDs, while complex and not publicly guessable, are transmitted in plaintext via email notifications and webhook callbacks - creating a realistic interception pathway for adversaries with network positioning. No active exploitation or public POC has been identified; EPSS at 0.31% (23rd percentile) reflects low automated exploitation probability, though targeted disclosure remains credible wherever log export notifications traverse unencrypted channels.
Signature verification bypass in the PAX Technology Q80 payment terminal's application installer enables network-adjacent unauthenticated attackers to install unsigned or malicious applications, which when chained with a secondary vulnerability results in arbitrary code execution at the root privilege level. The flaw stems from the installer's failure to properly validate cryptographic signatures - tagged as a JWT attack vector - before accepting and executing application packages. No public exploit or confirmed active exploitation (CISA KEV) has been identified at time of analysis, though the formal ZDI advisory ZDI-26-526 publicly discloses the vulnerability details.
Remote code execution in ZeroBrew 0.3.1 and prior exploits the absence of SHA-256 checksum validation in the Ruby compatibility shim (shim.rb), enabling a network-positioned attacker to substitute malicious archives or patch files during source builds. The attack surface is specifically the 'zb install --build-from-source' workflow, where secondary resource downloads and URL-based patch fetches proceed without any integrity check, allowing attacker-controlled content to execute arbitrary build steps. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-confirmed patch v0.3.2, released 2026-06-11, closes the gap by adding pre-extraction SHA-256 verification.
Red Hat Quay's Stripe billing webhook handler at /webhooks/stripe processes inbound JSON payloads without verifying the Stripe-Signature HMAC header, enabling any network-reachable unauthenticated attacker to forge billing events. Successful exploitation resets the targeted namespace's build quota to its configured maximum and dispatches unsolicited billing notification emails to namespace administrators. No public exploit has been identified and EPSS is 0.14% (4th percentile), but the zero-prerequisite attack path makes exploitation trivially scriptable by any attacker with HTTP access to the endpoint.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 exposes authenticated remote attackers to potential arbitrary code execution by sending an oversized `Comment` argument to the `setMacFilterRules` CGI function. A public proof-of-concept has been disclosed on GitHub (corroborated by the CVSS 4.0 E:P modifier), elevating real-world risk beyond the base score of 7.4. No vendor advisory or patched firmware version has been identified at time of analysis, leaving affected devices without an official remediation path.
Stack-based buffer overflow in the TOTOLINK A800R router (firmware 4.1.2cu.5137_B20200730) enables remote code execution via the IPv6 configuration CGI endpoint. The `setRadvdCfg` function in `ipv6.so` fails to validate the length of the `radvdinterfacename` argument before writing it to a stack buffer, allowing an authenticated attacker to overwrite the return address and redirect execution. A public proof-of-concept has been disclosed, and no vendor patch has been identified at time of analysis.
Stack/heap buffer overflow in the Tenda AC12 router (firmware 15.03.06.23_multi_TD01) allows remote low-privileged attackers to potentially execute arbitrary code by sending a crafted HTTP request to the `/goform/SetSysAutoRebbotCfg` endpoint with an oversized `rebootTime` argument. All three impact pillars - confidentiality, integrity, and availability - are rated high for the vulnerable system per the CVSS 4.0 vector. Publicly available exploit code exists per a GitHub PoC disclosure; no confirmed CISA KEV listing was identified at time of analysis.
OpenAM Community Edition through 16.0.6 ships its iPlanetDirectoryPro SSO session cookie with HttpOnly disabled and no SameSite attribute by default, and reuses that same cookie value as the CSRF token for the OAuth/OIDC consent flow. When chained with any other same-origin XSS in the OpenAM console, a single clicked attacker link lets a remote, unauthenticated attacker read the cookie from document.cookie, hijack a logged-in console user's full SSO session, and simultaneously submit attacker-controlled OAuth consent grants using the stolen cookie as the anti-CSRF token. The issue is fixed by
Stack-based buffer overflow in TOTOLINK A800R router firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to achieve arbitrary code execution by sending an oversized Comment argument to the setStaticDhcpConfig function via the CGI web interface. Exploit code has been publicly disclosed (CVSS 4.0 E:P), substantially lowering the exploitation barrier. No CISA KEV listing was identified, but the combination of public PoC, network-accessible attack surface, and high C/I/A impact makes this a credible threat for any deployment where the router management interface is reachable by untrusted users.
Kernel memory corruption in KUNBUS piControl version 2.6.2 allows a local authenticated attacker with device configuration access to write beyond process-image buffer boundaries, corrupting adjacent kernel memory and causing denial of service. The vulnerability resides in process-image management functionality and is triggered by supplying crafted device configuration data and crafted input through the piControl character device. No public exploit code or active exploitation has been confirmed at time of analysis, though the industrial OT context and kernel-level impact elevate operational priority for RevPi deployments.
Race condition exploitation in KUNBUS piControl 2.6.2 allows a local authenticated attacker to corrupt kernel memory by issuing concurrent crafted requests through the piControl character device, triggering use-after-free and invalid pointer dereferences in kernel configuration objects. The flaw resides in the configuration and process-image management subsystem of this industrial Revolution Pi (RevPi) controller platform component, with potential impact spanning confidentiality, integrity, and availability per the CVSS 4.0 vector, though denial of service is the explicitly confirmed outcome. No public exploit code and no active exploitation have been identified at time of analysis; this was responsibly disclosed by Nozomi Networks Labs.
Remote code execution is achievable in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 via an unrestricted file upload vulnerability (CWE-434). A high-privileged remote attacker can upload a file with a dangerous type - such as a web shell or server-side script - to the WMS server, resulting in full code execution with the application's privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and direct RCE impact make patching a priority for organizations running WMS.
Remote code execution in Dell Wyse Management Suite (WMS) is achievable by a high-privileged, remotely authenticated attacker through an unrestricted file upload vulnerability. All WMS versions prior to 2605.0.2 are affected, as confirmed by Dell advisory DSA-2026-329. While the CVSS impact is high across confidentiality, integrity, and availability, exploitation is gated behind administrative credentials, meaningfully constraining the realistic attacker population. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in W3 Total Cache WordPress plugin (all versions through 2.10.3) allows unauthenticated attackers to inject and persistently execute arbitrary JavaScript in victim browsers by embedding malicious content in the Comment Author Name field. The payload is activated exclusively when the plugin's Lazy Load Images feature is enabled, as the unsafe output occurs within the LazyLoad mutator's img tag rewriting step. No public exploit code or CISA KEV listing is identified at time of analysis, but the network-accessible, unauthenticated attack vector with scope change represents meaningful risk for any WordPress site with both public commenting and lazy load simultaneously active.
Scope-cap bypass in grav-plugin-api before 1.0.13 allows a holder of a least-privilege api.config.write API key issued on a super-admin account to append arbitrary tokens to Grav's Twig sandbox allowlist (persisted to user/config/security.yaml) via the POST /reports/twig-content/allowlist endpoint. Widening the allowlist eliminates the Twig sandbox boundary, converting any subsequent content render into a server-side template injection (SSTI) sink and ultimately enabling remote code execution on the host. No public exploit has been confirmed and the CVE does not appear in CISA KEV at time of analysis, but the two-step primitive - allowlist poisoning followed by SSTI/RCE - is a well-understood attack class in CMS security research.
Stored cross-site scripting in the WP-Stats WordPress plugin (all versions up to and including 2.56) allows unauthenticated remote attackers to inject persistent JavaScript payloads into WordPress pages due to insufficient input sanitization and output escaping. Every subsequent visitor to an injected page - including site administrators - will involuntarily execute the attacker's script in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Server-side request forgery in Budibase automation steps (all versions prior to 3.41.3) exposes internal network resources - including cloud metadata endpoints, private databases, and Kubernetes APIs - to any authenticated user with automation creation rights. Five automation step types (outgoing webhook, Zapier, n8n, Slack, Discord) invoke node-fetch directly without any IP validation, completely bypassing the blacklist module that guards only the REST API integration. A second compounding flaw causes the REST API blacklist to default to an empty allowlist when the BLACKLIST_IPS environment variable is unset, meaning default Budibase deployments carry zero SSRF protection across all outbound request vectors. No CISA KEV listing exists, but the GHSA advisory provides source-level code references that substantially document the attack surface.
SQL injection in Tenable Security Center exposes unauthorized database records to authenticated low-privilege users over the network. The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N vector confirms straightforward network exploitation with high confidentiality impact and limited integrity exposure. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor has published advisory TNS-2026-22.
FileBrowser versions before 2.63.19 fail to enforce the TUS Upload-Length boundary in the PATCH resumable-upload endpoint, enabling authenticated users to stream arbitrarily large request bodies directly to disk regardless of the length declared at upload creation. The root cause, confirmed by the patch diff, is an unbounded io.Copy call that passed r.Body directly to the target file without capping reads to the remaining declared bytes. No public exploit has been identified at time of analysis, and exploitation requires a valid low-privilege account, but the impact - full disk exhaustion causing service unavailability - can be triggered with a single crafted PATCH request.
Unauthenticated access to the XCB daemon on PAX Technology Q80 payment terminals allows network-adjacent attackers to disclose sensitive configuration data and alter device settings without credentials. The flaw is a complete absence of authentication enforcement at a critical daemon interface (CWE-306), and ZDI explicitly notes this can be chained with additional vulnerabilities to achieve arbitrary code execution in the context of root on the terminal. No public exploit code or CISA KEV listing has been identified at time of analysis.
Server-Side Request Forgery in Red Hat Quay's build API allows an authenticated user with repository write access to pivot into internal network segments via the Quay builder service. Exploitation requires FEATURE_BUILD_SUPPORT to be enabled and the attacker to hold at least write-level repository permissions. The CVSS vector (PR:L, C:H) reflects a meaningful but bounded threat: internal network reconnaissance and sensitive data disclosure are achievable, though no public exploit exists and EPSS sits at 0.13% (3rd percentile), indicating no observed widespread exploitation at time of analysis.
Account takeover in Authorizer's OAuth callback handler allows an unauthenticated attacker to pre-stage persistent backdoor access to any victim account by registering an unverified email address before the victim completes a routine OAuth login. The attack exploits a trust boundary violation in `internal/http_handlers/oauth_callback.go` (lines 125-219): the handler merges any incoming OAuth identity into the first database account matching by email, auto-verifies that account's email, and never invalidates the original password - leaving the attacker's credential fully active. No public exploit code has been independently confirmed, but the GHSA advisory contains a complete, line-referenced attack chain that makes independent reproduction trivial.