Command injection in TRENDnet TEW-755AP wireless access points (firmware through 20260702) allows a network-authenticated attacker to execute arbitrary OS commands by submitting crafted input to the email server configuration endpoint. The vulnerability resides in the `log_email_server` function within `/cgi-bin/email.cgi` of the SSI component, where user-supplied parameters are passed unsanitized to a system call. A public proof-of-concept exploit script is available on GitHub, raising the likelihood of opportunistic exploitation against exposed management interfaces. No public KEV listing exists at time of analysis.
Command injection in TRENDnet Router firmware 1.1.02b01 allows authenticated remote attackers to execute arbitrary OS commands by manipulating the `wan_type` parameter in the `/cgi-bin/ping.cgi` endpoint. A publicly available proof-of-concept exploit (hosted on GitHub) lowers the technical bar for exploitation. The provided CVSS 4.0 score of 2.1 with low impact metrics is notably inconsistent with typical command injection severity and warrants independent verification against actual privilege boundaries of the CGI process.
Command injection in TRENDnet TEW-823DRU firmware version 1.1.02b01 allows a network-accessible, low-privileged authenticated attacker to execute arbitrary OS commands by manipulating the Hostname parameter in the /cgi-bin/admin.cgi endpoint. The flaw is classified as CWE-77 and carries a CVSS 4.0 base score of 2.1 with the E:P threat modifier applied, reflecting a publicly available proof-of-concept exploit on GitHub. No vendor-released patch has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Command injection in TRENDnet TEW-821DAP firmware 2.2.01b05 allows authenticated remote attackers to execute arbitrary OS commands by supplying shell metacharacters in the `ipaddr` parameter of the `/cgi-bin/ping.cgi` endpoint. The SSI component passes this input unsanitized to `popen`/`system`, enabling full OS command execution on the device. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation against devices reachable over the network.
Command injection in TRENDnet TV-IP751WIC firmware 11.03.03 enables remote authenticated attackers to execute arbitrary OS commands through the /cgi-bin/admin/set_time.cgi endpoint handled by the alphapd daemon. The flaw stems from unsanitized user input passed directly to a shell command in the time-setting CGI handler. A public proof-of-concept exploit (poc-time-injection.py) is confirmed available on GitHub, lowering the barrier to exploitation significantly; no CISA KEV listing has been issued at time of analysis.
Path traversal in RuoYi-Vue up to 3.9.2 allows authenticated low-privilege users to read arbitrary files from the server filesystem by manipulating the `fileName` or `resource` parameters of the Common Download Endpoint in `CommonController.java`. A publicly available exploit has been disclosed via GitHub issue, but no patch has been released and the maintainer has not responded to the disclosure. No CISA KEV listing is present, so confirmed active exploitation at scale is unverified, though the public POC and low attack complexity make opportunistic exploitation by authenticated insiders or compromised accounts a realistic near-term risk.
Server-Side Template Injection (SSTI) in xianrendzw EasyReport up to version 2.0.17.0522_Beta allows authenticated remote attackers to inject malicious template expressions through the sqlText argument of the SQL Preview endpoint (execSqlText/previewSqlText in DesignerController.java). A publicly available exploit exists via GitHub issue #82, and the project maintainer has not responded to the coordinated disclosure. No patch is available at time of analysis; CVSS 4.0 scores the impact conservatively at low across confidentiality, integrity, and availability, though SSTI in Java template engines frequently enables outcomes beyond information disclosure.
Permission bypass in xianrendzw EasyReport up to version 2.0.17.0522_Beta allows authenticated low-privilege remote attackers to manipulate the queryerClass argument in the DataSourceController.add method within the QueryerFactory component, resulting in unauthorized access to or modification of data source configurations. A public proof-of-concept exploit has been disclosed via GitHub issue #83, and the project maintainer has not yet acknowledged or remediated the finding. Impact is bounded to low-level confidentiality, integrity, and availability degradation on the vulnerable system with no lateral scope change to subsequent systems.
BusyBox wget's FEATURE_WGET_TIMEOUT handler in networking/wget.c crashes with a null pointer dereference when the -T (timeout) argument is processed, affecting versions 1.30.0 and 1.30.1. Local users who can invoke BusyBox wget can trigger a denial-of-service crash of the wget process by supplying a crafted -T argument value, exploiting an unguarded pointer dereference in the shared getopt32 option-parsing library. No public exploit has confirmed active production exploitation, but a public proof-of-concept is available and the CVE is not listed in CISA KEV.
Search Head Cluster member control endpoints in Splunk Enterprise fail to enforce HTTP method-based authorization, allowing a user holding the high-privilege `list_search_head_clustering` capability to send read-typed HTTP requests that alter cluster state and cause a denial of service. Four release branches are affected - 9.4.x, 10.0.x, 10.2.x, and 10.4.x - with fixed versions available from Splunk (SVD-2026-0801). No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; exploitation is constrained to authenticated insiders or post-compromise attackers holding a high-privilege Splunk role.
Path traversal in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 exposes sensitive files to remote, unauthenticated attackers over the network. The flaw (CWE-22) allows directory traversal sequences to escape an intended path boundary, enabling read access to files that should not be externally accessible. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Integer overflow in IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 allows a local attacker with limited privileges to extract sensitive information or trigger a denial of service under specific high-complexity conditions. Rooted in CWE-190 (Integer Overflow or Wraparound), the vulnerability carries a CVSS 3.1 base score of 3.6 (Low), reflecting the mandatory local access requirement and elevated attack complexity. No public exploit code or active exploitation has been identified at the time of analysis.
Incorrect authorization in FreeBSD's ZFS_IOC_SET_PROP ioctl allows any local unprivileged user to set the internal '$hasrecvd' metadata flag on ZFS datasets - a capability that should be restricted to privileged ZFS receive operations. Affected release lines span FreeBSD 14.3, 14.4, 15.0, and 15.1 prior to their respective patch levels, as confirmed by FreeBSD Security Advisory FreeBSD-SA-26:40.zfs. No public exploit code exists and EPSS probability is 0.18% (8th percentile), indicating very low real-world exploitation pressure; no confirmed active exploitation or CISA KEV listing applies.
Kernel panic in FreeBSD's kernel TLS (kTLS) subsystem, specifically in ktls_ocf_tls_cbc_decrypt(), allows a remote TLS 1.2 peer to crash the kernel by exploiting an uninitialized iovec array bug during CBC record decryption. Affected versions span FreeBSD 14.3, 14.4, 15.0, and 15.1 prior to their respective patch levels, as confirmed by FreeBSD Security Advisory FreeBSD-SA-26:46.ktls. No public exploit code exists and EPSS is negligible at 0.15%, but the attack requires only that the remote peer engineer specific TCP segmentation - a condition achievable by the peer itself without any elevated privilege on the target system.
FreeBSD's kernel audit subsystem silently misreports the outcome of system calls injected into remote processes via ptrace(PT_SC_REMOTE), recording failed operations as successful in BSM audit logs. A local attacker with ptrace capability can exploit this to falsify audit trails and evade audit-based intrusion detection systems, since the IDS receives fabricated success records for operations that actually returned errors. No public exploit exists and EPSS exploitation probability stands at 0.15% (5th percentile), placing real-world exploitation risk at the low end of the spectrum; no active exploitation is confirmed.
Out-of-bounds memory read in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local authenticated attacker to disclose sensitive information from adjacent memory regions. The flaw is constrained entirely to local access with low privileges, yielding a CVSS score of 3.3 (Low), and poses greatest risk in shared or multi-tenant Power Systems environments where untrusted users hold shell access. No public exploit code or active exploitation has been identified at time of analysis.
Tanium Threat Response is affected by a compression bomb (zip bomb) vulnerability tracked as CWE-409, allowing an authenticated network attacker to submit a specially crafted highly-compressed file that expands during processing and exhausts host resources. The impact is limited to availability - confidentiality and integrity are unaffected per the CVSS vector. Exploitation requires high attack complexity and low-privilege credentials, yielding a CVSS base score of 3.1 (Low). No public exploit code or CISA KEV listing has been identified at time of analysis.
Compression bomb processing in Tanium Findings exposes authenticated network attackers to a limited availability impact by submitting specially crafted, highly compressed data that causes disproportionate resource consumption upon decompression. The CVSS score of 3.1 (Low) reflects the constrained impact - availability degradation rather than complete service loss - and the requirement for authenticated access with high attack complexity. No public exploit code has been identified and this vulnerability is not listed in CISA KEV. The EPSS score was not provided in source data.
Path traversal in Splunk SOAR below 8.6.0 enables users holding the OnPrem Broker role to write files to arbitrary locations outside the designated Automation Broker log directory. The flaw stems from the log upload endpoint accepting crafted filenames without adequate sanitization, allowing directory traversal sequences to escape the intended write boundary. No public exploit has been identified and no active exploitation is confirmed; the CVSS score of 2.7 (Low) accurately reflects the high privilege prerequisite and the limited, integrity-only impact.
Splunk SOAR versions below 8.6.0 expose a missing authorization flaw in the Playbook History feature that allows authenticated users holding the `playbooks:view` permission to read metadata about playbook repositories they are not explicitly authorized to access. The Playbook History endpoint omits repository-level permission checks before returning revision metadata, enabling unauthorized information disclosure within role-segregated SOAR deployments. No active exploitation has been confirmed - there is no CISA KEV listing and no public exploit code has been identified - and the CVSS base score of 2.7 reflects the high-privilege prerequisite and narrow confidentiality-only impact scope.
Splunk SOAR versions below 8.6.0 contain a Server-Side Request Forgery flaw in the connectivity check REST API endpoint (/rest/support/connectivity/.../check_connectivity) that allows an authenticated Administrator-role user to direct the SOAR platform to initiate outbound network connections to arbitrary destinations. This enables internal network enumeration - discovering reachable hosts and open ports using the SOAR instance's network position, which is typically privileged within enterprise SOC environments. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the CVSS score of 2.7 (Low) accurately reflects the high privilege prerequisite, though the risk is elevated in environments where the SOAR platform has broad internal network access.
FireAMP connector versions below 2.1.15 for Splunk SOAR allow authenticated playbook editors to bypass Safe Mode restrictions by invoking the add listitem action, which the connector manifest incorrectly classifies as read-only despite it performing write operations on file lists. Exploitation requires a high-privilege role (playbook edit/create/run), limiting the attack surface to trusted internal SOAR users. No public exploit code exists and this vulnerability has not been identified in CISA KEV, consistent with its low CVSS score of 2.7.
Broken object-level authorization in the Easy Appointments WordPress plugin (versions up to 3.12.28) exposes a REST endpoint that returns all site bookings - including customer names, appointment schedules, and statuses - to any authenticated contributor-level user, not just the records belonging to that user. The flaw is classified under CWE-200 (Exposure of Sensitive Information) and affects all sites running the plugin before version 4.0.1. No public exploit code or active exploitation has been identified at time of analysis, and EPSS places this in the 5th percentile for exploitation likelihood.
Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 exposes quiz email-notification and results-page configurations to unauthorized lateral reading by any authenticated contributor-level user on the same WordPress installation. The missing per-object ownership check on QSM REST API routes (CWE-639 IDOR) allows a contributor to query configuration data, including notification recipient email addresses, for quizzes created by other site users. No public exploit has been identified and SSVC classifies exploitation status as none, but the flaw represents a meaningful privacy control gap in multi-author WordPress environments where quiz surveys may collect sensitive respondent data.
Improper per-object authorization in the Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 permits any contributor-level (or higher) authenticated user to overwrite the front-end text settings of quizzes owned by other users. The flaw stems from a missing ownership check on the save action for quiz front-end text settings, meaning a contributor on a multi-author site can silently tamper with quiz content they did not create. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog; however, a vendor patch is available and should be applied promptly on any multi-author WordPress deployment running QSM.
Missing authorization in the Eventin WordPress plugin (versions before 4.1.21) permits any authenticated contributor-level user to overwrite other users' WordPress roles and metadata via the speaker creation feature, bypassing the platform's native capability enforcement. The vendor has released a patch in version 4.1.21 addressing the missing permission check. No public exploit code or active exploitation has been identified at time of analysis; however, the practical barrier to exploitation is lower than the published CVSS 2.7 score implies, because contributor accounts are commonly available on sites with open registration.
Integer truncation in the nnn terminal file manager (version 5.2 confirmed vulnerable) allows a local attacker who controls the victim's HOME environment variable to trigger an out-of-bounds read and write. By supplying a HOME path longer than 255 characters, the uchar_t homelen variable wraps to zero; the expression (homelen - 1) promotes to signed int as -1, indexing one byte before the intended path buffer. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 2.4 reflects the constrained attack conditions requiring local access and active user interaction.
Out-of-bounds write in nnn terminal file manager version 5.2 allows a local attacker who can place a malicious session file in the victim's session directory to corrupt adjacent global state when the victim loads the file using the -s option. The vulnerability stems from missing validation of attacker-controlled length fields during session file deserialization, enabling writes beyond fixed-size global buffers. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV; the overall risk is low given the local, user-interaction-dependent attack path.
Memory exhaustion in BuildKit prior to v0.31.1 allows a denial-of-service condition against the buildkitd daemon when it processes a maliciously crafted base image. The daemon reads /etc/passwd and /etc/group from attacker-controlled images without any size limit during UID/GID resolution, enabling an oversized file to exhaust host memory and trigger an OOM kill of buildkitd. No active exploitation has been confirmed (not in CISA KEV), no public exploit code has been identified, and the CVSS 4.0 score of 2.3 reflects the constrained impact: availability-only, requiring user interaction with a hostile image.
Coturn STUN/TURN server prior to version 4.15.0 allows an on-path attacker to tamper with authenticated STUN messages over plain UDP or TCP by appending arbitrary attributes after the MESSAGE-INTEGRITY field and recomputing the unkeyed FINGERPRINT. Because Coturn's server-side attribute iterator did not stop at the MESSAGE-INTEGRITY boundary as required by RFC 8489 Section 9, injected LIFETIME, XOR-PEER-ADDRESS, or ORIGIN attributes were processed as legitimate, enabling allocation lifetime manipulation, unauthorized permission injection, or origin-check bypass. TLS and DTLS deployments are entirely unaffected; no public exploit has been identified at time of analysis.
DNS rebinding in keeper.sh's calendar module (versions prior to 2.18.14) allows authenticated attackers to bypass the SSRF guard and route outbound HTTP connections to private network addresses, including cloud instance metadata endpoints such as 169.254.169.254. The flaw arises from a two-phase design: the guard resolves a hostname's IP addresses, asserts they are public, then discards those resolved addresses before independently re-resolving the hostname at socket-open time - an attacker controlling authoritative DNS can serve a public IP during validation and swap it to a private IP for the subsequent connection. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 2.18.14.