Privilege escalation in Grav API Plugin (all versions before 1.0.6) allows any authenticated user holding the api.users.write permission to mint API keys bound to super-administrator accounts, bypass key scope enforcement, and gain full persistent super-admin access - including the ability to rotate or disable two-factor authentication on targeted accounts. Three endpoints in UsersController - createApiKey(), generate2fa(), and disable2fa() - omitted the accessGrantsSuper() target authorization check that all sibling user mutation endpoints correctly enforced, creating an unguarded escalation path. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, though the fix commit is publicly visible and the attack path is structurally a single authenticated API call.
Remote code execution in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 is enabled by an off-by-one wrap-around error in bounds checking, reachable from an adjacent network without authentication. An attacker positioned on the same network segment can trigger the flaw to achieve full compromise of the affected system - confidentiality, integrity, and availability are all rated High. No public exploit or CISA KEV listing has been identified at time of analysis, but the combination of no-auth adjacency and RCE impact makes this a high-priority patch target in any environment running these IBM platforms.
Out-of-bounds write in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables an unauthenticated attacker positioned on an adjacent network segment to execute arbitrary code with full confidentiality, integrity, and availability impact. The CWE-787 class flaw requires no privileges and no user interaction, lowering the exploitation bar substantially once network adjacency is achieved. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero-prerequisite exploitation and complete system compromise warrants urgent patching in affected enterprise environments.
Heap buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated adjacent-network attackers to execute arbitrary code on affected systems. The CWE-787 out-of-bounds write flaw carries a CVSS score of 8.8 and yields full confidentiality, integrity, and availability compromise upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis; however, a vendor-supplied patch is available via IBM support advisory node/7283858.
Stack buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables unauthenticated remote code execution by any attacker with adjacent network access. The flaw (CWE-787, Out-of-bounds Write) corrupts stack memory during processing of a crafted network payload, allowing an attacker to overwrite return addresses and redirect execution without requiring credentials or user interaction. No public exploit has been identified at time of analysis and IBM has released a patch, but the AV:A/PR:N/AC:L vector makes this a high-priority fix for any organization running IBM Power Systems infrastructure.
Heap buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated remote code execution by attackers positioned on an adjacent network segment, with no user interaction required. The flaw (CWE-787, out-of-bounds write) results in full compromise of confidentiality, integrity, and availability of the affected system. A vendor patch has been released via IBM advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data exposure in Termix prior to 2.3.2 allows a low-privileged authenticated user to exfiltrate password-reset tokens belonging to other local accounts via the POST /database/export endpoint, enabling full account takeover of any local user including administrators. The database export is intended to be user-scoped but incorrectly includes the global settings table, which stores transient reset_code_ and temp_reset_token_ artifacts from incomplete or historical password-reset flows. With CVSS 8.8 (PR:L, C:H/I:H/A:H) and a public GitHub advisory, this represents a high-severity privilege escalation path in deployments where multiple user accounts exist. No public exploit identified at time of analysis; vendor-released patch is available.
Remote code execution in Splunk Enterprise allows any low-privileged authenticated user to execute arbitrary code by exploiting a missing authorization check in the Federated Search dispatch flow. The vulnerability stems from the platform accepting caller-controlled bundle selection without verifying the fsh_manage capability, meaning any user with basic login access can escalate to full RCE. All four active version branches (9.4.x, 10.0.x, 10.2.x, 10.4.x) are affected below their respective patch thresholds; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Wekan open-source kanban (all versions prior to 9.89, dubbed 'SortBleed') allows any board member - including read-only or comment-only invitees - to atomically elevate themselves to sole board administrator, expose private boards to the public, and evict the legitimate owner via a single crafted Meteor DDP update call. The root cause is Meteor's OR-semantics allow-rule evaluation: the `canUpdateBoardSort` helper checked only that `sort` was among modified fields, not that it was the sole field, allowing arbitrary board mutations to be smuggled alongside a legitimate sort value. No public exploit identified at time of analysis, though the attack is fully reproducible from the public GHSA advisory and fix commit.
Path traversal in Splunk Enterprise's lookup configuration endpoint allows any authenticated low-privileged user - without admin or power roles - to move arbitrary files readable by the Splunk service account into a user-controlled lookup table on the search head. Affected versions span four active release trains: 10.4.x below 10.4.2, 10.2.x below 10.2.6, 10.0.x below 10.0.9, and 9.4.x below 9.4.14. With a CVSS score of 8.8 and no special configuration required beyond a standard Splunk account, successful exploitation yields full confidentiality, integrity, and availability impact; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Privilege escalation in Splunk Enterprise allows an authenticated user holding the schedule_search capability to execute arbitrary SPL commands at the highest system privilege level and read every credential stored in the credential store. Affected versions span four supported release lines - below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 - meaning a wide swath of unpatched deployments across all current branches are exposed. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the credential store access potential makes this a high-priority patch for any deployment where the schedule_search capability is assigned to non-administrator users.
Privilege escalation in the FreeBSD kernel's POSIX shared memory subsystem allows an unprivileged local user to access freed kernel memory and escalate privileges. The flaw arises in the interaction between largepage-backed shared memory objects and the sendfile(2) syscall when used with the SF_NOCACHE flag, which prematurely frees pages that active memory mappings still reference, producing a use-after-free condition in kernel address space. Affected releases span FreeBSD 14.3, 14.4, 15.0, and 15.1; no public exploit or active exploitation has been identified at time of analysis, though a vendor security advisory (FreeBSD-SA-26:44.posixshm.asc) and patched releases are available.
Server-Side Request Forgery (SSRF) in Cisco Talos Intelligence for Enterprise Security Cloud (versions below 1.0.3) allows an authenticated Splunk user holding the get_talos_enrichment capability to redirect the instance's outbound authenticated management requests to an attacker-controlled server, exposing Splunk management tokens. Successful exploitation grants the attacker full control over the Splunk instance, compromising the confidentiality, integrity, and availability of all data and configurations within it. No public exploit code or CISA KEV listing has been identified at time of analysis, but the patch is available and the CVSS score of 8.8 reflects the severity of token theft as a post-exploitation path.
Authenticated low-privilege code injection in Splunk Enterprise allows OS command execution on the host system as the Splunk process account. Affected versions span four active release lines (9.4.x, 10.0.x, 10.2.x, 10.4.x), and the root cause is a missing capability check: Splunk Web accepts Splunk Web Manager XML configuration writes without enforcing the edit_manager_xml permission, meaning any authenticated user can plant attacker-controlled content that executes when the Manager page is rendered. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, but the CVSS score of 8.8 (High) and straightforward exploitation path make this a high-priority patching target for Splunk deployments.
Stored SPL injection in Splunk Enterprise allows an unauthenticated attacker who can reach the management port to register a crafted Deployment Server client identity containing malicious Search Processing Language code, which executes when an administrator opens the Add Data forwarder workflow. All four supported major branches are affected (9.4.x, 10.0.x, 10.2.x, 10.4.x), with vendor-confirmed fixes available. No public exploit has been identified at time of analysis, but successful exploitation yields full confidentiality, integrity, and availability impact on the Splunk platform instance.
SQL injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a low-privileged remote attacker to manipulate backend database queries, with confirmed high confidentiality impact and potential for broader compromise per the vendor's own CVSS rating. The vulnerability (CWE-89) requires only a valid low-privilege account and network access to the management interface - no user interaction or elevated rights are needed. No public exploit code or CISA KEV listing has been identified at time of analysis; Dell has released version 4.7.0 as the remediated release per advisory DSA-2026-359.
Privilege escalation and arbitrary code execution affect the Berkeley Out-of-Order Machine (BOOM) RISC-V processor RTL implementation at commit 2d08d0d8b4563212175212f9db0e69f6e68c9619 (v1.2), specifically within the machine-mode trap-return (MRET) and mstatus.MPRV state-restoration logic in the CSRFile. An attacker who can execute unprivileged or supervisor-mode code on a system running the BOOM core can potentially abuse the flawed privilege-restoration path to gain machine-mode (M-mode) access, achieving full system control. No public exploit code or CISA KEV listing has been identified at time of analysis; the EPSS score of 0.29% (22nd percentile) reflects very limited observed exploitation activity.
SPL injection via Dataset Explorer in Splunk Enterprise allows an unauthenticated attacker to cause an authenticated victim to execute arbitrary Search Processing Language pipelines under that victim's own privileges. Affected versions span five concurrent release branches - 10.4 below 10.4.2, 10.2 below 10.2.6, 10.0 below 10.0.9, 9.4 below 9.4.14, and 9.3 below 9.3.14 - giving this vulnerability broad reach across common enterprise deployments. No CISA KEV listing and no public exploit code have been identified at time of analysis, but the CVSS 8.8 score, wide deployment footprint, and straightforward phishing delivery mechanism make patching urgent.
SQL injection in Dell OpenManage Enterprise prior to version 4.7.0 allows a low-privileged authenticated remote attacker to inject malicious SQL constructs via the platform's web interface, leading to script injection and potential full compromise of confidentiality, integrity, and availability. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity and no user interaction required beyond valid credentials. No public exploit has been identified at time of analysis, and EPSS places current exploitation probability at 0.29% (21st percentile), though SSVC rates the technical impact as total.
Privilege escalation in Splunk Enterprise allows any user holding the schedule_search capability to execute arbitrary SPL commands with system-level privileges on the search head by configuring PDF attachments in the email alert action workflow. The flaw exists because the search scheduler substitutes a system-level authentication context for the alert owner's context during PDF rendering, effectively granting the authenticated user full system access. Affected are all Splunk Enterprise installations across the 9.4, 10.0, 10.2, and 10.4 release branches below the patched versions; no public exploit or CISA KEV listing is identified at time of analysis.
Blind SQL injection in vsDesk (vsdesk.ru) exposes database contents and can render the application unresponsive via unauthenticated network requests. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-friction remote exploitation requiring no privileges or user interaction, with high confidentiality and availability impact. No active exploitation or public proof-of-concept has been identified at time of analysis; a vendor-released patch is available in version 14.0101 and later.
SQL injection in Dell OpenManage Enterprise prior to version 4.7.0 allows a remote attacker holding low-privilege credentials to manipulate backend database queries, with the vendor noting this can cascade into script injection within the management interface. The CVSS vector rates impact as high across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and Dell has released a fix in version 4.7.0 per advisory DSA-2026-359.
LDAP authentication bypass in phpMyFAQ 3.1.0-4.1.6 allows a blocked local account to be silently reactivated by authenticating via LDAP, letting previously suspended users regain full application access. The AuthLdap::create() method calls User::setStatus('active') unconditionally after any successful LDAP bind, overwriting an administratively set 'blocked' status in the database without logging the state change. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; the vendor-confirmed fixed release is 4.1.7.
Privilege escalation in IBM System Storage DS8A00 (R10.0-R10.1, firmware 10.1.3.0-10.11.35.0) and IBM DS8900F (R9.4, firmware 89.40.83.0-89.44.25.0) permits low-privileged authenticated users to create accounts bearing full administrative roles, effectively seizing control of enterprise storage infrastructure. The flaw stems from CWE-267 (Privilege Defined With Unsafe Actions), where the user-management subsystem fails to enforce boundaries on the privilege levels assignable by non-administrative roles. No public exploit has been identified at time of analysis; EPSS is 0.25% (17th percentile) and SSVC records exploitation status as none, consistent with the absence of CISA KEV listing.
Privilege escalation in Splunk Enterprise allows any authenticated low-privileged user to create or modify scripted lookups through improperly guarded generic transforms configuration endpoints, gaining code execution under the Splunk service account's operating system permissions. Affected versions span four release branches: 9.4.x below 9.4.14, 10.0.x below 10.0.9, 10.2.x below 10.2.6, and 10.4.x below 10.4.2. An attacker holding any valid Splunk account - without requiring the 'admin' or 'power' roles - can abuse this to access all Splunk-indexed data and compromise system integrity and availability. No public exploit or CISA KEV listing has been identified at time of analysis.
Splunk Secure Gateway's failure to validate decoded report notification identifiers enables any authenticated low-privileged user to hijack system-level REST API sessions in Splunk Enterprise, achieving full configuration control and credential theft without requiring admin or power role. Affected versions span multiple Splunk Enterprise branches (9.4.x, 10.0.x, 10.2.x, 10.4.x) and Splunk Secure Gateway branches (3.8.x, 3.9.x, 3.10.x). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, low-privilege attack path and high-impact outcome (C:H/I:H/A:H) make this a realistic internal threat in any multi-tenant or shared Splunk deployment.
Stack buffer overflow in Zephyr RTOS's HL7800 cellular modem driver exposes cellular-attached embedded devices to remote stack corruption during normal LTE network attach, with no device-side privileges or user interaction required. The flaw in on_cmd_atcmdinfo_ipaddr() allows a malicious or impersonated cellular network - for example via a rogue base station - to supply a crafted +CGCONTRDP response whose address fields, whose lengths are derived from attacker-controlled delimiter positions, are copied without bounds checking into fixed 64-byte and 16-byte stack buffers in supervisor context. Outcomes range from a remotely triggerable crash to potential control-flow hijacking on targets without stack canaries; no public exploit has been identified at time of analysis, and an upstream fix commit is available from the Zephyr project.
Stack-based buffer overflow in FreeBSD's libalias RTSP handler exposes NAT gateways to kernel-level or root-level remote code execution from hosts inside the NAT perimeter. The RTSP protocol rewriter copies rewritten packet data into a fixed-size stack buffer with no length validation, allowing a crafted RTSP stream to overflow that buffer. When NAT is implemented via ipfw(4), exploitation can yield kernel code execution; when using natd(8), the impact is RCE in a process typically running as root. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored cross-site scripting via malicious SVG upload in the Booking Calendar, Appointment Booking System WordPress plugin (versions 3.2.18 through 3.2.36) allows unauthenticated remote attackers to plant persistent JavaScript payloads that execute in the browser session of any administrator who reviews submitted bookings. The plugin's SVG sanitization routine strips some script constructs but fails to neutralize all JavaScript execution vectors within SVG markup, making the bypass achievable without authentication. No public exploit has been identified at time of analysis and EPSS is low (0.20%, 10th percentile), but the admin-session-hijacking impact elevates real-world risk for any site relying on this plugin.
Remote code execution in IBM PowerVM Hypervisor partition firmware exposes Power Systems environments during network boot operations. An unauthenticated attacker positioned on the same adjacent network as a partition actively performing a network boot can send a malformed packet that triggers a CWE-787 out-of-bounds write, executing arbitrary code within the partition firmware and compromising everything the partition subsequently loads. Impact is scoped to the actively booting partition - other partitions and the managed system are explicitly unaffected. No public exploit or CISA KEV listing exists at time of analysis; EPSS is notably low at 0.19% (9th percentile), consistent with the narrow exploitation window.
Network boot exploitation in IBM PowerVM Hypervisor across firmware branches FW950, FW1060, FW1110, and FW1120 allows an unauthenticated attacker with adjacent-network access to disrupt or hijack the boot sequence of any partition performing a PXE/network boot. Under the default configuration where OS secure boot is disabled, the attacker can substitute the boot image entirely, compromising the OS and all subsequently loaded software for that partition. No active exploitation has been confirmed per SSVC and EPSS signals, but the default-configuration exposure and full partition compromise potential make this a meaningful priority for IBM Power Systems operators.
Stored Cross-Site Scripting in the Simple File List WordPress plugin (versions through 6.3.11) allows unauthenticated users to inject persistent malicious scripts via unsanitized file description fields when the plugin's front-end file management feature is enabled. The injected payload executes in the browser of every subsequent visitor who views the public file list, enabling session hijacking, credential theft, or malicious redirects targeting site visitors including administrators. No active exploitation has been confirmed (not in CISA KEV), and EPSS of 0.18% at the 8th percentile signals very low automated exploitation probability, though the unauthenticated write path and broad victim exposure make it a priority for any site with front-end file management enabled.
Remote privilege escalation in Ceph RADOS Gateway (RGW) allows any holder of a valid STS session token - regardless of privilege level - to forge administrative credentials by exploiting unauthenticated AES-128-CBC encryption. By applying a deterministic CBC bit-flip to the acct_type, perm_type, and is_admin fields of their own token, an attacker can trigger a global authorization override that bypasses all RGW capability checks, yielding full administrative control over all objects and buckets in the cluster. No public exploit has been identified at time of analysis; however, the attack is self-contained, requires no encryption oracle, and is reachable over the standard RGW S3 endpoint, making it highly accessible to any user with STS access. Fixed versions 19.2.6 and 20.2.4 are confirmed released.
Missing centralized authorization in Leantime's JSON-RPC API dispatcher (through v3.9.0) enables any authenticated user to invoke service-layer methods against arbitrary resources they do not own, resulting in full account takeover of other users including administrators. The dispatcher in app/Domain/Api/Controllers/Jsonrpc.php routes API calls without an authorization gate, allowing a caller to supply a victim's user ID to the editOwn method and overwrite their password. No public exploit or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.17% (6th percentile), though VokeCyber's published research significantly lowers the technical barrier for exploitation.
Reference count underflow in FreeBSD's jail subsystem allows an unprivileged local user to double-free a prison structure, yielding two distinct impact paths: on the jail host, this reliably causes an immediate kernel panic, while a user already running inside a jail may be able to exploit the freed structure while still in use to escape the jail and elevate privileges to the host. Affected releases are FreeBSD 15.0-RELEASE before patch level 11 and FreeBSD 15.1-RELEASE before patch level 1, per FreeBSD Security Advisory SA-26:38. EPSS is currently 0.16% (5th percentile) and SSVC classifies exploitation as 'none', suggesting no observed in-the-wild activity, but SSVC technical impact is rated 'total', reflecting the severity of the jail-escape scenario.
Use-after-free in the FreeBSD kernel virtual memory subsystem allows an unprivileged local user to corrupt the pager's page list by calling msync(MS_INVALIDATE) on a mapping of an unmanaged device object, then triggering a subsequent page fault. On object destruction, the affected page is freed twice, creating a kernel memory corruption primitive that may enable privilege escalation. No public exploit code has been identified and EPSS probability is very low (0.14%), but the vulnerability is confirmed by FreeBSD Security Advisory SA-26:37 with patches available for all affected release branches.
Code injection in marimo before 0.23.15 allows an attacker who can deliver a crafted notebook file to execute arbitrary operating system commands on the victim's machine simply by having the victim open the notebook in edit mode. The vulnerability resides in the notebook configuration handler's MCP (Model Context Protocol) server entry processing: marimo reads attacker-controlled command values from the notebook's configuration and spawns them as local subprocesses before any notebook cell runs, giving the attacker immediate code execution with no further interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and PR:N vector reflect the low barrier to exploitation once a victim opens a malicious file.
Local privilege escalation in FreeBSD's execve(2) syscall allows an unprivileged local user to gain full root-level control by exploiting a TOCTOU race condition (CWE-367) in SUID binary execution. During the narrow window between virtual address space installation and credential elevation, the kernel's procfs permission check still evaluates the original (unprivileged) credentials, allowing a racing process to write to the target's memory via /proc/[pid]/mem or linprocfs. Confirmed affected versions span FreeBSD 14.3, 14.4, 15.0, and 15.1; EPSS is low at 0.12% (2nd percentile), no KEV listing, and no public exploit identified at time of analysis, though the primitives for this class of attack are well-understood.
Authentication bypass in the SAML Single Sign On WordPress plugin (versions 4.8.85 through below 5.4.7) enables unauthenticated network attackers to inject an arbitrary certificate into the site's SAML trust store by exploiting the plugin's failure to verify incoming SAML response signatures before persisting embedded certificates. Once stored, that attacker-controlled certificate can be promoted to the site's active trusted signing authority via a single administrator UI click, after which the attacker can forge SAML assertions and authenticate as any WordPress user, including site administrators. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS is very low at 0.11% (1st percentile), reflecting limited observed exploitation.
Privilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to gain elevated system access by exploiting missing authorization checks. The vulnerability carries a CVSS 3.1 score of 8.8 with a scope change (S:C), indicating the privilege escalation extends beyond the DCU process itself - likely to OS-level or other system components. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction make this straightforward to exploit for any user with a local account.
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version 26.7.3 to full OS command execution by any authenticated user, including those with only read-only database roles. The flaw is a silent fallback in ArcadeGremlin.executeStatement() that routes parameterized queries failing gremlin-lang parsing to the unrestricted Groovy scripting engine, which can invoke arbitrary Java and OS-level code as the server process user. No public exploit has been identified at time of analysis, but the minimal privilege bar - any valid credential - makes this a critical upgrade priority for all ArcadeDB deployments.
Replay of settled EVM blockchain transaction hashes against ZenHive mpp versions 0.3.0-0.6.2 allows unauthenticated remote attackers to obtain paid resources at no cost. MPP.Methods.EVM.verify/2 validates payment by matching a submitted transaction hash against on-chain token/recipient/amount fields but neither binds the proof to a specific challenge nor records prior use; because MPP.Plug regenerates challenge.id on every 402 response, any historical on-chain transfer visible on a public block explorer can satisfy an unlimited number of subsequent payment challenges on a static-price route. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, though the attack prerequisites are trivially met given the public nature of blockchain transaction data.
Arbitrary OS command execution in GitPython before 3.1.58 is possible by bypassing the check_unsafe_options guard using a single-character kwarg combined with split_single_char_options=False, causing git's short-option parser to interpret a smuggled joined token as --upload-pack=<cmd>. This is a second-order incomplete-fix bypass of the previously patched GHSA-r9mr-m37c-5fr3, affecting all guarded methods including clone_from, fetch, pull, push, ls_remote, iter_commits, blame, and archive. A working proof-of-concept is publicly available in the upstream GitHub Security Advisory GHSA-wvpp-8hx9-p66j; no CISA KEV listing is present at time of analysis, but the public PoC significantly lowers the exploitation bar.
Missing authorization in MyBooks (Talebook) 3.41.2 and earlier allows any authenticated low-privilege user - including holders of unactivated accounts - to overwrite server-side configuration through the POST /api/admin/settings endpoint, exposing SMTP credentials, OAuth client secrets, storage paths, and security feature flags to unauthorized modification. Two compounding flaws are present: the AdminSettings.post handler in webserver/handlers/admin.py applies only the authentication decorator without the admin_user check enforced by its GET counterpart, and process_auth_header in webserver/handlers/base.py accepts sessions for registered-but-unactivated accounts by not verifying the user.active flag. No active exploitation has been confirmed (not in CISA KEV), but the fix is available in version 3.42.0.
Stored XSS in Wekan prior to v9.90 allows authenticated board members to upload HTML containing JavaScript disguised as a permitted MIME type, which is then served under the Wekan origin and executes in any user's browser that opens the attachment. The vulnerability is rooted in a silent fallback: when the Unix `file` binary is absent (typical of minimal Docker/Alpine deployments), MIME detection returns undefined and validation trusts the attacker-supplied content type instead of inspecting actual file bytes. Exploitation is conditional on two deployment-specific factors - the WITH_API=true environment variable and the absence of the `file` binary - but both are common in container-based Wekan deployments. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Config-name injection in GitPython <= 3.1.57 enables arbitrary git-config directive forgery and remote code execution via `core.sshCommand` or `core.hooksPath`. The option-name validator in `git/config.py` only blocks CR/LF/NUL, allowing `=`, `#`, and whitespace to pass unchecked; `write_section` then writes the option name verbatim, causing git to parse attacker-supplied content as a valid directive. Exploitation requires a calling application to forward attacker-influenced input to `config_writer.set_value()` as the option-name argument, and a proof-of-concept is publicly confirmed in the vendor GHSA advisory. No CISA KEV listing is present at time of analysis.
Denial-of-service via quadratic CPU exhaustion in Netty's SniHandler affects all Netty deployments prior to 4.1.137.Final and 4.2.17.Final that use the default SniHandler constructors for TLS termination. An unauthenticated remote peer can fragment a large TLS ClientHello across thousands of small records, causing SslClientHelloHandler#decode to recopy all previously received bytes on every record arrival - O(N²) work that stalls the Netty event loop and denies TLS service to all concurrent clients. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept has been identified, but the low attack complexity and zero-authentication requirement make this a credible threat for any internet-exposed Netty TLS endpoint.
Incorrect authorization in acmailer enables any authenticated low-privilege user to create a sub-account bearing full administrative privileges, effectively allowing unauthorized privilege escalation within the application. The flaw (CWE-863) bypasses the intended privilege boundary during sub-account creation, granting attackers administrator-level control over the mailing list system without requiring any elevated starting permissions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and high impact across confidentiality, integrity, and availability make this a serious risk where untrusted or semi-trusted users have accounts.
Denial-of-service in the J-BusinessDirectory Joomla extension (all versions before 6.2.3) allows unauthenticated remote attackers to crash directory listing pages by supplying array or non-numeric values to pagination parameters such as limitstart[]. PHP arithmetic performed on these malformed inputs triggers fatal type errors, rendering the affected extension inoperable. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Privilege escalation in the Grav API Plugin (prior to 1.0.8) allows any authenticated panel user to generate or revoke API keys on behalf of arbitrary accounts, including super-administrators, by exploiting an insufficient authorization check in the apiKeyGenerate and apiKeyRevoke admin task handlers. The plugin enforced only the baseline admin.login permission - held by every panel user - without verifying that the caller had rights over the target account specified in the route parameter, enabling a low-privilege user to mint persistent API credentials carrying the target's full permissions. No public exploit has been identified at time of analysis; the issue is fixed in version 1.0.8.