Out-of-bounds read in S2OPC's AddNodes service allows remote attackers to trigger memory read violations via a crafted UserAccessLevel argument, causing low-severity availability impact on vulnerable server instances running version 1.7.3 and earlier. The flaw resides in SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes within the address space management layer of this OPC UA stack, which is deployed primarily in industrial automation and ICS/SCADA environments. A public proof-of-concept exploit has been disclosed, though high attack complexity (AC:H) limits opportunistic exploitation; no public exploit identified at time of analysis as a KEV-confirmed active threat.
Command injection in TRENDnet TEW-823DRU firmware 1.1.02b01 allows a remote, authenticated attacker to inject arbitrary OS commands through the nvram_get function in the CLI Configuration Tool. Exploitation requires high-privilege credentials (PR:H per CVSS 4.0), limiting the attacker pool to those who have obtained administrative access. A public proof-of-concept is documented on GitHub; no CISA KEV listing has been recorded at time of analysis, and no vendor-released patch has been identified.
Command injection in TRENDnet TEW-821DAP 2.2.01b05 allows remote low-privileged attackers to execute arbitrary OS commands via the `filename` argument in the `/cgi-bin/upload.cgi` CGI endpoint's SSI component. A public proof-of-concept exploit is available on GitHub, raising the operational risk above what the vendor-supplied CVSS 4.0 score of 2.1 suggests. No active exploitation has been confirmed via CISA KEV, but the combination of network accessibility, low complexity, and public PoC makes this a credible threat to any deployed unit.
Tutor LMS WordPress plugin (all versions before 4.0.6) exposes private course content to any authenticated instructor via a missing per-object ownership check - a CWE-639 Insecure Direct Object Reference flaw. Any user holding the instructor role can read private course content authored by other instructors by referencing their course object IDs directly. No active exploitation has been confirmed (not in CISA KEV), EPSS sits at the 4th percentile (0.14%), and the vendor-released patch is available in version 4.0.6.
Path traversal in NLTK's CrubadanCorpusReader (versions 3.9.4 through 3.10.2) allows an attacker who controls a malicious corpus package to read arbitrary file contents outside the corpus root directory via the lang_freq interface. The vulnerability arises because _load_lang_ngrams bypasses NLTK's pathsec containment by calling the builtin open() instead of the pathsec-validated opener, enabling os.path.join to silently discard the corpus root prefix when an absolute path is supplied as the crubadan_code value. No public exploit exists and no KEV listing is present; a vendor patch is available in 3.10.3.