Denial of service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 is achievable by an adjacent-network attacker exploiting a null pointer dereference, capable of crashing the targeted system without requiring authentication or user interaction. The vulnerability affects IBM's enterprise UNIX operating system and its PowerVM Virtual I/O Server layer, where availability is operationally critical for hosted workloads. No public exploit code has been identified at time of analysis, and IBM has released a remediation patch via official advisory.
SQL injection in Splunk SOAR below version 8.6.0 enables users holding the "Automation Engineer" role to execute arbitrary SQL statements against the SOAR database by embedding injection payloads in custom list names referenced within playbooks, granting full create, read, update, and delete access to all data the database contains. The root cause is unsanitized string concatenation: Splunk SOAR builds the custom list lookup query by inserting the user-supplied list name directly rather than using parameterized (bound) values, a textbook CWE-74 injection pattern. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV; vendor-released patch version 8.6.0 is available.
Missing moderator rank authorization in Lemmy's ActivityPub federation layer allows a lower-ranked remote moderator to forcibly remove a higher-ranked moderator from a community by sending a crafted signed Remove activity. Affected versions prior to 0.19.19 and 1.0.0-alpha.18 enforce hierarchy correctly in the local REST API via LocalUser::is_higher_mod_or_admin_check, but CollectionRemove::verify in the federation path skips this rank check entirely, trusting only that the actor holds some moderator role. An authenticated moderator on any federated remote instance can therefore subvert community governance on the victim instance without the local API's protections. No public exploit code has been identified at time of analysis, and patches are available in both stable and alpha release lines.
Broken access control in Wekan's Excel export REST endpoint exposes private board contents to any authenticated user, regardless of board membership. Wekan versions 9.57 through 9.73 failed to await the async authorization guard in models/exportExcel.js, causing the Promise return value to always evaluate as truthy and bypass the board.isVisibleBy(user) check entirely. Any authenticated user can enumerate and download card titles, descriptions, lists, swimlanes, members, and metadata from private boards they are not a member of via GET /api/boards/:boardId/exportExcel. A read-only proof-of-concept was confirmed by the reporter (sec-reex) through responsible disclosure; no KEV listing at time of analysis.
SQL injection in Splunk SOAR's playbook automation data APIs grants any user holding the 'Automation Engineer' role unrestricted read, write, and delete access to the entire SOAR database in versions below 8.6.0. The vulnerability stems from user-supplied input being incorporated into database queries without proper sanitization (CWE-943), enabling arbitrary SQL execution against the SOAR backend. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Splunk has released a patch in version 8.6.0.
Session token disclosure in Splunk SOAR versions below 8.6.0 enables any authenticated account holder to recover session tokens belonging to other users by manipulating REST API filters on the playbook run endpoint. Because Splunk SOAR fails to block filter predicates from matching against values that are otherwise suppressed in API responses, an attacker with a low-privilege account can systematically extract credentials granting full access to any targeted user's data within the platform. Splunk has released version 8.6.0 as a fix; no public exploit has been identified at time of analysis, but the low attack complexity elevates urgency for organizations where multiple users share a SOAR instance.
SQL injection in Splunk SOAR below version 8.6.0 enables authenticated users holding the "Automation Engineer" role to execute arbitrary SQL statements against the SOAR backend database by supplying crafted values through custom function results. The root cause (CWE-89) is Splunk SOAR concatenating the user-supplied name directly into the database lookup query rather than using parameterized, bound SQL values. Successful exploitation allows full read access to all data stored in the SOAR database - including playbook configurations, incident records, and integration credentials - and can affect database integrity; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
XML External Entity (XXE) injection in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote low-privileged authenticated attacker to read arbitrary files from the server or conduct server-side request forgery (SSRF), resulting in significant information exposure. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms low-barrier network exploitation - any authenticated user can trigger the flaw with no interaction from other parties. No public exploit code or CISA KEV listing has been identified at time of analysis, though XXE exploitation techniques are universally understood and require no specialized tooling.
SQL injection in Splunk Enterprise's Data Orchestration jobs endpoint allows any authenticated low-privilege user - explicitly excluding the need for 'admin' or 'power' roles - to execute arbitrary SQL against the underlying Data Orchestration database, exposing all job records across all users and stored connection credentials. Affected version branches are 10.4.x below 10.4.2, 10.2.x below 10.2.6, 10.0.x below 10.0.9, and 9.4.x below 9.4.14. Reported by Cisco; no KEV listing or public exploit code identified at time of analysis, though the credential exposure component significantly elevates real-world impact beyond the moderate 6.5 CVSS score suggests.
Splunk Enterprise incorrectly gates the properties REST endpoint on the rest_properties_get capability rather than the purpose-built list_storage_passwords capability, allowing any authenticated user with that role permission to read encrypted stored credentials via the REST API. Affected branches span four active release lines: 10.4.x below 10.4.2, 10.2.x below 10.2.6, 10.0.x below 10.0.9, and 9.4.x below 9.4.14 per EUVD-2026-63112. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, but the flaw is mechanically straightforward for any user whose role carries the misassigned capability.
Splunk Secure Gateway's companion app registration handler contains a hard-coded cryptographic key, enabling any low-privileged authenticated Splunk user - explicitly excluding admin or power roles - to register an arbitrary attacker-controlled callback URL and cause Secure Gateway to forward mobile user requests and authentication tokens to that URL. Affected are Splunk Enterprise branches 9.4 (below 9.4.14), 10.0 (below 10.0.9), 10.2 (below 10.2.6), and 10.4 (below 10.4.2), alongside Splunk Secure Gateway branches 3.8 (below 3.8.71), 3.9 (below 3.9.24), and 3.10 (below 3.10.10). No public exploit code or active exploitation has been confirmed at time of analysis; however, the low attack complexity and minimal privilege requirement make this a credible insider-threat or post-compromise lateral movement vector in any environment running Splunk Mobile.
Unauthorized access to Mobile Device Management signing secrets in Splunk Secure Gateway allows a low-privileged Splunk user to compromise all mobile-device enrollment trust. Affected are Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway below 3.10.10, 3.9.24, and 3.8.71. An attacker holding only the 'list storage passwords' role permission - without Secure Gateway administration privileges - can invoke unprotected REST API endpoints (deployment bundle, SAML setup, companion app workflows) to retrieve MDM signing secrets, enabling enrollment of unauthorized or attacker-controlled mobile devices. No public exploit code or CISA KEV listing has been identified at time of analysis.
Insufficient access controls on the Splunk Secure Gateway App Key Value Store REST API expose Spacebridge asymmetric private keys to any authenticated low-privilege user lacking the 'admin' or 'power' role. The exposure is conditional on instances that were upgraded from older Splunk Secure Gateway deployments where a private-key migration remained incomplete, leaving sensitive cryptographic material in a KVStore collection governed by an insecure default ACL. No public exploit code exists at time of analysis, but successful exploitation fully compromises the affected Spacebridge private-key material, enabling cryptographic impersonation or decryption of Spacebridge-protected communications.
Cross-site request forgery combined with SPL injection in Splunk Enterprise's Event Type Builder allows an unauthenticated attacker to cause an authenticated user to execute arbitrary Search Processing Language queries under the victim's session context. Affected release branches span versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, covering multiple concurrent support tracks. Successful exploitation can expose all data accessible to the victim's Splunk session including stored credentials, though the attacker must first phish an authenticated user into initiating the malicious browser request. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Partition firmware in IBM PowerVM Hypervisor across firmware streams FW950 through FW1120 is vulnerable to a denial-of-service attack during iSCSI SAN network boot. An unauthenticated attacker with adjacent-network access can disrupt the boot sequence of a target partition, preventing it from completing initialization while leaving all other partitions and the managed POWER system entirely unaffected. Patch available per vendor advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in Wireshark's BUSMASTER file parser causes an abnormal process exit when processing a specially crafted BUSMASTER capture file, affecting Wireshark 4.6.0-4.6.7 and 4.4.0-4.4.18. The root cause is a reachable assertion (CWE-617) that aborts the process rather than handling the malformed input gracefully. An attacker who can induce a user to open a crafted file can crash the Wireshark session; no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service via crash in sharkd, Wireshark's daemon-mode component, affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18. An unauthenticated remote attacker with high-complexity exploitation conditions and required user interaction can cause sharkd to crash by submitting crafted input, resulting in limited availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis; the low CVSS score of 3.1 reflects the constrained attack conditions.
Denial of service via a crash in sharkd, the Wireshark daemon component, affects the Wireshark Foundation's Wireshark versions 4.6.0-4.6.7 and 4.4.0-4.4.18. The root cause is CWE-825 (Expired Pointer Dereference), where a crafted network request or packet capture can trigger use of an expired pointer, crashing the sharkd process and producing a denial of service. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA's KEV catalog; with a CVSS base score of 3.1, it represents low severity bounded by high attack complexity and a required user interaction.
Wireshark's Tektronix K12xx file parser crashes when processing a malformed capture file, causing a denial of service in versions 4.6.0-4.6.7 and 4.4.0-4.4.18. Rooted in CWE-126 (Buffer Over-read), the flaw allows an attacker to terminate Wireshark on a victim's system by inducing them to open a specially crafted K12xx-format file. No public exploit code and no active exploitation (CISA KEV) have been identified; the low CVSS score of 3.1 reflects the crash-only impact and mandatory user interaction.
Wireshark's dissection engine in versions 4.4.0-4.4.17 and 4.6.0-4.6.7 contains a heap-based buffer overflow (CWE-122) that crashes the application when processing a specially crafted malformed packet, yielding a denial-of-service outcome. Exploitation requires that an analyst actively opens a malicious capture file or performs live capture of adversary-controlled traffic, making this a user-interaction-dependent, high-complexity flaw with no code execution potential. No active exploitation has been confirmed by CISA KEV, no public proof-of-concept has been identified, and the CVSS 3.1 base score of 3.1 (Low) accurately reflects the constrained real-world impact.
The ERF file parser in Wireshark crashes on malformed input, enabling denial of service against analyst workstations running versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. Exploitation requires that a user open a specially crafted ERF capture file, and the CVSS vector (AV:N/AC:H/UI:R/A:L) reflects both the user-interaction dependency and the limited scope of impact - a crash of the Wireshark process only. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Denial of service in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows an authenticated remote attacker to crash the web management interface by sending a crafted `ssid_number` parameter to the `ajaxSet_wireless_network_configuration.jst` AJAX handler. The flaw was reported by CERT/CC and documented by independent researchers at Wrocław University of Technology alongside multiple other RDK-B vulnerabilities. No public exploit has been identified and EPSS scoring (0.16%, 6th percentile) reflects very low real-world exploitation probability.
Authenticated patient-level users in KiviCare WordPress plugin before 4.5.4 can download any file from the media library - including other patients' confidential medical reports - by exploiting a missing ownership verification on media file access (CWE-639 IDOR). The CVSS vector (PR:L, C:H, AV:N) confirms that any registered patient with network access can enumerate and retrieve arbitrary media objects without elevated privileges. No active exploitation is confirmed (EPSS 0.14%, no CISA KEV listing), but the exposure of protected health information creates significant regulatory liability under frameworks such as HIPAA and GDPR that the moderate CVSS score of 6.5 does not fully capture.
Eventin WordPress plugin before 4.1.21 fails to verify record ownership before permitting schedule modifications or deletions, enabling any contributor-level (or higher) authenticated user to alter or destroy schedule entries belonging to other users. The flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class weakness where the plugin relies solely on a user-supplied record identifier without confirming the requesting user is the legitimate owner. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 4.1.21.
XML External Entity injection in Dell Command Update (DCU) versions prior to 5.7.1 enables a local attacker with low-privilege access to perform server-side request forgery and escalate privileges. The vulnerability stems from insufficient restriction of XML external entity references during DCU's XML parsing operations. No public exploit code or CISA KEV listing exists at time of analysis, but the scope-changed CVSS vector (S:C) and high confidentiality impact confirm that exploitation crosses component boundaries, potentially exposing sensitive resources beyond DCU itself.
Server-Side Request Forgery in mcp-searxng's web_url_read tool allows any caller - including an LLM steered via prompt injection - to make the server fetch internal HTTP services and cloud metadata endpoints (e.g., http://169.254.169.254/) and return their contents into the model context. The SSRF guard function assertUrlAllowed exists in the codebase but ships disabled because MCP_HTTP_HARDEN defaults to false, meaning all default deployments of versions prior to 1.2.1 are unprotected. Publicly available exploit code exists, validated on v1.1.0; no CISA KEV listing was present at time of analysis.
Blind SQL injection in Cisco Unified Intelligence Center's web-based management interface allows an authenticated low-privilege user to extract the full contents of the internal database over the network. The flaw (CWE-89) stems from insufficient input validation in a network-accessible endpoint, confirmed by Cisco in advisory cisco-sa-cuic-sql-inject-2qbfWSm5. No active exploitation has been identified and no public exploit code is known at time of analysis.
Broken access control in the Taxi Booking Manager for WooCommerce WordPress plugin (versions prior to 2.0.8) enables attackers to perform unauthorized write operations against booking data or plugin configuration, resulting in high integrity impact with no confidentiality or availability loss. The flaw stems from missing authorization checks (CWE-862) on plugin endpoints, a class of vulnerability common in WooCommerce plugins where AJAX handlers or REST routes omit WordPress capability checks. No public exploit code or active exploitation has been identified at time of analysis, and the plugin's niche deployment base limits overall exposure, though the low attack complexity means exploitation is straightforward once a vulnerable installation is located.
Stored cross-site scripting in lemmy-ui prior to 0.19.19-beta.1 allows session hijacking and unauthorized authenticated actions against viewers who render attacker-controlled markdown content. The vulnerable markdown-it-html5-embed@1.0.0 plugin generates video element fallback HTML by inserting image alt text via unescaped string replacement, bypassing the markdown-it html:false safety setting because plugin-generated output is never subject to that guard. An attacker controlling a federated Lemmy instance or holding approved-member status can store the payload, and any viewer who renders it on a deployment lacking Content-Security-Policy headers will execute attacker JavaScript in the lemmy-ui origin. No public exploit identified at time of analysis; EPSS data not provided in source intelligence.
Stored Cross-Site Scripting in the SiteGround Speed Optimizer WordPress plugin (all versions through 7.8.0) allows authenticated contributors to inject persistent malicious JavaScript via unsanitized image tag attributes, executing in any visitor's browser upon page load. Exploitation is gated on the Lazy Load Media option being enabled in plugin settings, limiting but not eliminating real-world exposure across the large SiteGround-hosted WordPress ecosystem. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a patched release (7.8.1) is confirmed available via the WordPress plugin repository.
Stored XSS in the EWWW Image Optimizer WordPress plugin (all versions through 8.7.3) lets authenticated attackers holding contributor-level accounts inject arbitrary JavaScript that executes silently in every subsequent visitor's browser. The exploit embeds a crafted img element with class='lazyload' and a data-script attribute pointing to an attacker-controlled URL in post content; the plugin's bundled lazysizes ls.unveilhooks addon then dynamically inserts a script element into the DOM at page-view time with no domain validation. No public exploit has been identified at time of analysis and the CVE is absent from the CISA KEV catalog, though the fix commit fully exposes the exploitation mechanic.
SPL injection in Splunk Enterprise below versions 10.2.6, 10.0.9, and 9.4.14 enables an unauthenticated attacker to execute arbitrary Search Processing Language commands under the privileges of any authenticated Splunk user by luring that user into clicking a specially crafted Splunk Web URL. The root cause is unsanitized substitution of URL-supplied form token values directly into SPL searches, effectively turning the victim's browser session into a proxy for the attacker's queries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact (C:H) makes this a meaningful data-exfiltration vector in targeted phishing scenarios against Splunk-heavy SOC or analytics environments.
SPL injection via Splunk Secure Gateway's unsanitized dashboard URL parameters allows an unauthenticated attacker to execute arbitrary Search Processing Language commands under the full permissions of a phished Splunk administrator. The Splunk Secure Gateway component fails to neutralize caller-supplied values before embedding them in dashboard searches, meaning a crafted URL opened by an 'admin' or 'sc_admin' user causes injected SPL to run with that user's data access - potentially exposing all indexed data visible to the administrator and corrupting search results or lookup tables. No public exploit code has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog, though the phishing vector and high data-access impact make this a meaningful risk for organizations with sensitive Splunk deployments.
Reflected SPL injection in Splunk Enterprise's Monitoring Console allows an unauthenticated attacker to execute attacker-controlled Search Processing Language queries under the permissions of a targeted Splunk administrator. The attacker must phish an admin-role user into opening a specially crafted link (CVSS UI:R/AC:H), making opportunistic mass exploitation unlikely, but a successful attack can expose all data indexed and accessible to that admin or corrupt lookup tables. Vendor-released patches are available for all affected branches; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Secure boot bypass in the Ingenic T31 SoC allows an attacker with physical write access to boot media to forge SPL (Secondary Program Loader) images that pass RSA signature verification without the OEM signing key. The boot ROM's flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest - rather than validating the full cryptographic outputs - yielding a forgery success rate of approximately 2/3 per attempt. End-to-end hardware acceptance of a forged firmware image on a Wyze Video Doorbell v2 (T31X) has been confirmed by external researchers at opensensor.io; no public exploit is confirmed in CISA KEV, but a working proof-of-concept exists per the researcher disclosure.
Dashboard Studio workflow actions in Splunk Enterprise can be weaponized by a 'power'-role user to store attacker-controlled SPL that executes under a victim's permission context when triggered via Event Actions. Affected versions span all major branches: 9.4 below 9.4.14, 10.0 below 10.0.9, 10.2 below 10.2.6, and 10.4 below 10.4.2. No public exploit code or CISA KEV listing exists at time of analysis, but successful exploitation enables unauthorized read and write access to data within the victim's Splunk permission scope.
CPython's tarfile module on POSIX platforms creates empty directories outside the intended extraction destination when processing archive members whose names temporarily escape and re-enter it, such as '../evil/../dest/sub/file'. The extraction filters ('tar' and 'data') validate the resolved path - which correctly resolves to inside the destination - but create intermediate directories from the raw member name as given, allowing filesystem pollution beyond the extraction boundary. File contents are never placed outside the destination, and no public exploit has been identified at time of analysis; the PSF advisory confirms the limited scope.
GitHub Actions workflow injection in Logto's commitlint.yml exposes versions 1.40.1 through 1.41.0 to arbitrary shell command execution on the project's CI/CD runner, triggered by any GitHub user who can submit a pull request with a crafted title containing shell metacharacters. The PR title was directly interpolated into an inline echo command without sanitization, allowing a single-quote character to terminate the shell string and inject attacker-controlled commands into the ephemeral runner environment. Impact is bounded by a read-only GITHUB_TOKEN and absence of exposed repository secrets; no public exploit is identified at time of analysis, and the issue is fully patched in v1.41.0.
Stored cross-site scripting in Snipe-IT prior to 8.6.2 allows an authenticated low-privilege user to inject arbitrary JavaScript via a crafted manufacturer or supplier name, which executes in the browser of any authenticated user who views the affected detail page. The CVSS 4.0 vector assigns SC:H/SI:H on the subsequent system, reflecting that a successful payload delivered to an administrator can yield full session compromise - including data exfiltration and action execution - against the Snipe-IT instance. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the vulnerability mechanism is fully disclosed via the public GitHub security advisory and fix commit.
Authorization bypass in the Grav Flex Objects Plugin prior to version 1.4.3 permits an authenticated user holding only the api.access permission to invoke all admin API handlers - index, show, create, update, delete, export, and media - against any Flex Objects directory whose blueprint omits the config.admin.permissions field. The root cause is a logic inversion in requireFlexPermission() inside FlexApiController.php: when no blueprint permissions are defined, the original code iterated over an empty set and silently returned without throwing a ForbiddenException, bypassing the core admin.flex-object authorization fallback that would otherwise deny the same actions. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available as version 1.4.3.
Payment-replay protection in ZenHive mpp's Tempo hash-credential path is defeated by a TOCTOU race condition, allowing a single confirmed on-chain payment hash to be redeemed for multiple paid-resource grants. The race window spans an eth_getTransactionReceipt RPC round trip - potentially hundreds of milliseconds - during which concurrent unauthenticated requests all pass the non-atomic read guard before any write completes. Affected deployments run mpp 0.2.0 through 0.6.0 with a dedup store configured; no public exploit has been identified at time of analysis, but the attack requires only a standard concurrent HTTP client and knowledge of a valid settled payment hash.
Hardened-mode SSRF protections in the mcp-searxng Node.js MCP server (npm/mcp-searxng < 1.2.1) can be bypassed via three distinct techniques, allowing `web_url_read` to fetch loopback and internal network resources despite `MCP_HTTP_HARDEN=true` being set. The bypasses exploit: unvalidated HTTP redirect chains to internal addresses, the unblocked `0.0.0.0` special address, and IPv4-mapped IPv6 literals that survive Node's WHATWG URL canonicalization intact but defeat regex-based private-address filters. Publicly available proof-of-concept code demonstrates all three bypass paths returning content from a loopback sentinel service; no KEV listing exists at time of analysis.
YAML injection in volsync-addon-controller enables a highly privileged, network-capable attacker to break out of YAML value context when annotation values are rendered into OLM Subscription resources, allowing unauthorized modification of OpenShift operator lifecycle configuration. The root cause (CWE-94) is unsanitized interpolation of Kubernetes annotation strings into generated YAML, and the impact includes high integrity and availability consequences for cluster software management. Exploitation is gated behind high-privilege cluster access and the non-default 'volsync-addon-deploy-type: olm' annotation; no public exploit or CISA KEV listing has been identified at time of analysis.
Platform KeyStore (PKS) and virtual TPM firmware in IBM PowerVM Hypervisor generate AES encryption keys from persistent storage seeds with insufficient entropy (CWE-331), reducing effective key strength below the intended security level. An adversary who already holds privileged access to the service processor or Hardware Management Console (HMC) can exploit this weakness to analytically derive the weakened AES key and decrypt data protected by those keys. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog; IBM has issued a patch via advisory node 7283890.
Cross-site scripting in Splunk Enterprise (below versions 10.4.2, 10.2.6, 10.0.9, and 9.4.13) enables an unauthenticated attacker to execute arbitrary JavaScript in an authenticated user's browser by tricking that user into visiting a malicious web page. Splunk Web's page message handler processes incoming postMessage events without validating their origin or source, allowing cross-origin script injection into the victim's active Splunk session. Successful exploitation can expose all data accessible to the victim user and permit unauthorized actions affecting system integrity; no public exploit code or CISA KEV listing has been identified at time of analysis.
Root-level code execution in Cisco RoomOS via the USB driver allows an unauthenticated attacker with physical access to a device's USB port to achieve full system compromise by connecting a malicious USB device. The vulnerability spans a wide range of RoomOS versions across the 10.x, 11.x, and 26.x release families, covering the Cisco Webex Room and Board series of video collaboration endpoints. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the root-level impact (C:H/I:H) and the unattended nature of conference room hardware make this a meaningful physical security risk.
Heap overread in swtpm's SWTPM_NVRAM_CheckHeader() function allows local low-privileged users to crash the swtpm daemon and leak heap memory contents to system logs on Red Hat Enterprise Linux 8, 9, and 10. The root cause is a classic sizeof-pointer vs. sizeof-struct confusion: the guard compares buffer length against sizeof(bh) (pointer width, 8 bytes on 64-bit) rather than sizeof(*bh) (actual struct size), permitting undersized buffers to bypass validation and triggering a 2-byte heap overread on 64-bit systems or 6 bytes on 32-bit. No public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Splunk Enterprise 10.4.x allows a high-privilege user with search head cluster (SHC) management rights to write files to arbitrary locations accessible by the Splunk service account via the SHC member bundle REST API. The API fails to enforce authorization boundaries and does not validate bundle paths before accepting content, enabling path-traversal-style writes that can deliver and trigger malicious payloads. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the RCE primitive makes this a meaningful risk in environments running Splunk 10.4 or 10.4.1 where high-privilege insider or compromised-account scenarios are plausible.
Regex-driven denial of service in Grav CMS prior to 2.0.4 allows authenticated page editors to exhaust PHP worker CPU by injecting catastrophically backtracking regular expression patterns through the allowlisted `regex_replace` Twig filter. The vulnerable path exists in `GravExtension::regexReplace()`, which forwards editor-supplied patterns directly to `preg_replace()` without backtrack-limit enforcement or error recovery. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack is straightforward for any user who holds page-editor privileges on an affected instance with Twig content processing enabled.
phpMyFAQ before v4.1.6 exposes database credentials by writing backup ZIP archives to the publicly accessible document root at a predictable path (`content.zip`), enabling credential theft via two distinct attack chains. Unauthenticated attackers can race concurrent HTTP requests against the brief window between archive creation and deletion, while a second path chains a stored XSS in the admin panel to force an authenticated backup and retrieve the resulting archive. No public exploit code has been identified at time of analysis, though the concrete credential disclosure impact warrants prompt remediation for all internet-facing deployments.