Remote buffer overflow in Zscaler Client Connector on Windows enables a network-accessible attacker with low privileges to crash the local system at the kernel level, producing a denial-of-service condition. The provided CVSS vector (C:H/I:H/A:H) signals potential confidentiality and integrity impact beyond what the vendor description explicitly states, a discrepancy that warrants verification - kernel-level buffer overflows frequently allow code execution, not merely DoS. No public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in RansomLook's cryptocurrency wallet detail view allows attacker-controlled JavaScript to execute in the security context of any user who clicks the CSV export button on an affected wallet record. The root cause is insertion of externally-sourced wallet addresses and blockchain names directly into an inline JavaScript onclick handler, where Jinja2's HTML autoescaping is bypassed because the browser's HTML parser decodes entities such as ' back to quote characters before the JavaScript engine processes the attribute value. Because RansomLook ingests data from the public crowd-sourced ransomwhe.re feed without prior validation, exploitation may not require an authenticated RansomLook account - an attacker who can introduce a crafted wallet record into that upstream feed can reach the vulnerable rendering path. No public exploit code or active exploitation has been identified at time of analysis; a patch is available via a confirmed vendor commit.
Control-flow hijack in the Zephyr RTOS virtio driver (versions 4.2.0 through pre-4.4.2) allows a malicious or compromised virtio backend - such as an untrusted hypervisor or an untrusted PCI/MMIO virtio device - to invoke an arbitrary function pointer inside the Zephyr guest's interrupt handler. The root cause is a missing bounds check in virtio_isr() (drivers/virtio/virtio_common.c): the 16-bit descriptor-chain head ID written by the device into the used ring is consumed directly as an index into heap-allocated recv_cbs[] and desc[] arrays, each sized exactly vq->num, enabling an out-of-bounds read that returns an attacker-shaped {function pointer, argument} pair which is then called. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the primitive - arbitrary code execution in interrupt context triggered entirely from the backend - is high-severity and the vendor-confirmed patch is available in Zephyr 4.4.2.
Privilege escalation from userspace to kernel level is possible in Google's Fuchsia OS via a Use-After-Free condition in the Zircon kernel pager proxy component, affecting Android F30.1.1. An attacker with low-privileged code execution on the device can exploit the memory corruption flaw to gain kernel-level control, achieving full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and SSVC assessment indicates no current active exploitation.
Remote code execution in Xinference (all versions before 2.12.0) allows any user with model-launch access to execute arbitrary Python code on the server at worker-process privilege level. Six model loader call sites across the rerank, embedding, and LLM subsystems hardcode trust_remote_code=True when invoking Hugging Face AutoTokenizer.from_pretrained, meaning a registered model with an attacker-controlled path can ship a malicious tokenizer_config.json whose auto_map entries are imported and executed unconditionally upon model load. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but any Xinference deployment that permits user-defined model registration is exposed without the 2.12.0 patch.
Local privilege escalation in Zscaler Client Connector enables a standard (non-administrative) local user to execute arbitrary code in a privileged context via multiple improper privilege handling flaws (CWE-280). The scope change captured in the CVSS vector (S:C) reflects that exploitation breaks the security boundary of the Client Connector's privileged agent process, extending impact beyond the attacker's initial user context to full High-rated confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote file read in 4MOSAn Management Center (all versions prior to build 20260621) allows any network-reachable attacker to download arbitrary system files via a Relative Path Traversal flaw (CWE-23). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) confirms no authentication, no user interaction, and no special configuration is required to trigger the vulnerability. A vendor-issued patch was released as of build 20260621 per TWCERT advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in the Mercado Pago Node.js SDK allows attackers who can influence payment, refund, or disbursement identifiers handled by merchant applications to redirect outbound API calls to unintended Mercado Pago endpoints, carrying the merchant's own access token. The affected clients - payment (get, capture, cancel), paymentRefund (create, total, list, get), advancedPayment (get, capture, cancel, update, updateReleaseDate), and disbursementRefund (create, createAll, listAll) - construct API paths via unencoded template literals, allowing dot-dot sequences and question marks to traverse to alternate endpoints or append attacker-chosen query parameters. No public exploit has been identified at time of analysis, and exploitation is conditional on merchant applications forwarding unvalidated, user-supplied identifiers directly to the SDK.
Sensitive scraping credentials and bypass logic were exposed to unauthenticated callers through multiple RansomLook API endpoints. Location records associated with monitored ransomware groups and markets were returned verbatim - including the `header` field containing authentication tokens and session cookies, the `init_script` field holding CAPTCHA and anti-bot bypass logic, and `browser` metadata revealing the scraping environment - whenever a location was not explicitly marked private. The patch, confirmed via GitHub commit cc9182930306ff36c7b3424817d49f18df3c85d1, introduces a strict field allowlist and a sanitization function applied across all three affected API routes; no public exploit or KEV listing has been identified at time of analysis.
Denial of service in multiple DrayTek VigorSwitch managed switch models can be triggered remotely without authentication via the setget.cgi web management interface. The root cause is a null pointer dereference (CWE-476) triggered when the `pass` field is absent from a crafted request, crashing the CGI service. The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial remote exploitability with no prerequisites; no public exploit or CISA KEV listing has been identified at time of analysis.
Unbounded xlsx decompression in exceljs-hardened before 5.0.0 allows unauthenticated remote attackers to exhaust server memory and cause denial of service by uploading a crafted zip-bomb workbook. The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) reflects that exploitation requires no authentication, no special configuration, and no victim interaction beyond the server automatically parsing the uploaded file. No active exploitation has been confirmed (no CISA KEV listing) and no public exploit has been identified at time of analysis, but the zip-bomb technique targeting archive parsers is well-documented and requires minimal attacker skill.
Path traversal in exceljs-hardened before 5.0.0 allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying crafted paths to the Workbook.addImage() function, which performs no input validation before passing the value to Node.js file system APIs. Any Node.js application that exposes this function to user-controlled input is at risk of exposing secrets, credentials, configuration files, and any other content readable by the process. No public exploit has been identified at time of analysis; vendor-released patch is available as version 5.0.0.
PHP object injection in Combodo iTop's user preference functionality prior to version 3.2.3 enables authenticated remote attackers to achieve remote code execution on the underlying server. The vulnerability stems from deserializing attacker-controlled PHP objects without validation, with the CVSS Scope:Changed metric reflecting that successful exploitation escapes the application boundary to compromise the host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CWE-502 vulnerability class is well-understood and the attack complexity is rated Low once an authenticated session is obtained.
Cross-organization IDOR in Label Studio allows any authenticated user on a shared instance to read, modify, and delete annotations belonging to other tenants by enumerating sequential integer primary keys. The AnnotationAPI and AnnotationConvertAPI in label_studio/tasks/api.py declare an unscoped queryset (Annotation.objects.all()) and register all annotation permissions against rules.is_authenticated, meaning the organization boundary is never tested at the object level. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects genuinely high confidentiality, integrity, and availability impact on any multi-tenant deployment, and the low exploitation complexity makes the conceptual-to-exploitable gap very small.
RansomLook versions through 2.0.0 leaks victim posts belonging to privately configured ransomware groups and markets through public notification channels (Rocket.Chat, Mastodon, Bluesky, email) and the public MISP feed, due to incomplete privacy enforcement at the entity level rather than the post level. The post-processing logic in posts.py checked only the individual post's private flag, leaving freshly parsed victims of private groups and markets unprotected because new posts arrive with private=False. A parallel defect in misp_feed.py restricted its privacy check to the group database only, so victims of private markets were admitted to the public MISP feed. No public exploit is identified at time of analysis; this is a passive information-disclosure flaw - subscribers to the affected channels receive the leaked data automatically without taking any active exploitation step.
Unauthenticated media exfiltration on sixteen DJI consumer and prosumer drone models allows any attacker who joins the drone's internal Wi-Fi network to enumerate and download all stored photos and videos via the unprotected `/v2` HTTP endpoint. The onboard HTTP media server (CWE-306: Missing Authentication for Critical Function) performs no client verification, and DJI's deterministic filename naming convention eliminates any obscurity barrier, making systematic enumeration trivial. Firmware patches have been released per the DJI advisory (en-us03400011149); no public exploit or CISA KEV listing has been confirmed at time of analysis.
Unauthenticated artifact manipulation in nektos/act's Artifacts V4 backend allows any network-adjacent attacker to read, overwrite, or delete the build artifacts of concurrently running jobs, including embedded secrets and deployment credentials. Two compounding root-cause defects drive the severity: a run-ID ownership check that is explicitly commented out in validateRunIDV4 (pkg/artifacts/artifacts_v4.go), and a universally forgeable HMAC whose key is a hardcoded 4-byte constant (0xba 0xdb 0xee 0xf0) shared across every build with a delimiter-free concatenation scheme vulnerable to hash ambiguity. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the exploitable code paths are visible in public source and trivially reproducible.
Stored XSS in Sakai Conversations (versions 23.0-23.3) allows any authenticated site member - including students - to inject arbitrary HTML and JavaScript into topics, posts, or comments that subsequently execute in the browsers of every user who views that content. The Conversations REST API accepts raw HTML in message fields without invoking Sakai's standard `FormattedText.processFormattedText()` sanitizer, and the LitElement frontend renders stored content via `unsafeHTML()` with no secondary defense. A detailed proof-of-concept including cookie exfiltration and database verification is publicly available in the GitHub security advisory; no active exploitation is confirmed via CISA KEV. In university deployments with hundreds of students per course, a single malicious post can compromise all enrolled users simultaneously.
Remote code execution in AzuraCast ≤0.23.8 is reachable by any authenticated station manager due to a serialization group mismatch that exposes Liquidsoap custom configuration fields through the profile-edit API endpoint, which enforces only the lower-privilege StationPermissions::Profile rather than the StationPermissions::Broadcasting required by the dedicated Liquidsoap configuration endpoint. An attacker injects arbitrary Liquidsoap script constructs - including process.run() or process.exec() OS command primitives - into fields that ConfigWriter::writeCustomConfigurationSection() emits verbatim into the generated .liq script, with execution triggered automatically by the built-in sync task whenever needs_restart is set. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the attack path is fully described in advisory GHSA-q8wg-3qg7-8pc7 and presents a straightforward escalation from station manager to host OS command execution.
SQL injection in TypeORM's SelectQueryBuilder.distinctOn enables database enumeration against PostgreSQL-backed applications that pass client-controlled values into the API without validation. The distinctOn array is joined and interpolated verbatim into a SELECT DISTINCT ON (...) clause in src/query-builder/SelectQueryBuilder.ts, bypassing the driver's escape helper and the allowlist guard (validateOrderByCondition) that protects the orderBy family. Because the injection point is a parenthesized SQL expression list, attackers can supply correlated subqueries and perform boolean or time-based blind inference against any table reachable by the application's database role, independent of the queried entity. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Buffer overflow in DrayTek VigorSwitch's mail_mailalert function allows authenticated remote attackers with valid administrative credentials to cause a denial of service or potentially execute arbitrary commands across approximately 28 affected managed switch models. The flaw stems from unbounded concatenation of multiple SMTP receiver email addresses into a fixed-size buffer, reachable via the device's web management interface. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 8.6 reflects high potential impact to confidentiality, integrity, and availability.
Buffer overflow in DrayTek VigorSwitch's diag_logmail function allows authenticated administrators to cause denial of service or potentially execute arbitrary commands on affected network switches. The flaw, reported by VulnCheck and acknowledged in DrayTek's August 2026 security advisory, affects a broad range of VigorSwitch models spanning SMB and enterprise product lines. Exploitation requires valid administrative credentials, limiting opportunistic attack surface, but a compromised or rogue admin account can fully compromise device confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing identified at time of analysis.
Buffer overflow in DrayTek VigorSwitch web management interface allows authenticated remote administrators to cause denial of service or potentially execute arbitrary commands on affected managed switches. The flaw resides in the acl_general_setup Edit ACE function, where the name field is copied into a fixed-size stack buffer without length validation (CWE-120). No public exploit code has been identified at time of analysis, and exploitation is gated behind valid administrative credentials, meaningfully reducing the attack surface compared to unauthenticated network flaws.
Buffer overflow in DrayTek VigorSwitch's ACL configuration function exposes authenticated administrators to denial of service or potential arbitrary command execution via the device's web management interface. The root cause - an unbounded strcpy-style copy of a user-supplied name field into a fixed-size stack or heap buffer inside acl_general_setup's Add ACE handler - is a classic CWE-120 defect reachable over the network from any host with management-plane access. Exploitation requires valid administrative credentials (CVSS PR:H), substantially limiting the attack surface; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Buffer overflow in DrayTek VigorSwitch's switch_lan_gvrp function exposes multiple managed switch models to denial of service or potential arbitrary command execution from remote, authenticated attackers. The flaw stems from unsafe copying of a user-supplied portList field into an undersized stack or heap buffer within the GVRP handling code - a classic CWE-120 defect reachable via the device's web management interface. No public exploit code and no CISA KEV listing have been identified at time of analysis, and exploitation is gated behind valid administrative credentials, which meaningfully constrains real-world attacker opportunity.
Buffer overflow in DrayTek VigorSwitch's PoE schedule profile function allows authenticated remote administrators to cause denial of service or execute arbitrary commands on affected network switches. The flaw spans at least 10 CPE-confirmed models and an even wider set per VulnCheck tags, covering much of the VigorSwitch product line. No public exploit code and no CISA KEV listing have been identified at time of analysis, but DrayTek has published a security advisory acknowledging the issue.
Buffer overflow in the sysreboot function of multiple DrayTek VigorSwitch managed switch models allows authenticated remote attackers to cause denial of service or execute arbitrary commands. The root cause (CWE-120) is unsafe concatenation of split valueN attacker-controlled data into a fixed-size buffer in the device's web management firmware, exploitable over the network by any party holding valid administrative credentials. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in DrayTek VigorSwitch's webBackupAction function enables authenticated administrators to trigger denial of service or arbitrary code execution by submitting crafted HTTP requests with excessively long pathN, valueN, key, and option parameters. Exploitation is gated behind valid administrative credentials (CVSS PR:H), limiting direct internet exposure but creating meaningful risk via compromised admin accounts or insider threats. No public exploit identified at time of analysis and no CISA KEV listing, though the CWE-120 root cause class is well-understood and device-accessible researchers could feasibly develop working exploits.
Buffer overflow in DrayTek VigorSwitch's pingtrace diagnostic function allows authenticated remote attackers to cause denial of service or achieve arbitrary command execution across a broad range of VigorSwitch hardware models. The flaw arises from absent length validation when user-supplied host, count, and interval parameters are concatenated into a statically allocated buffer in the web management firmware. No public exploit is identified at time of analysis, and exploitation is gated behind valid administrative credentials, but the severity of achievable impact - full device compromise - warrants prompt patching on any network where VigorSwitch units are deployed.
Buffer overflow in the apautotest function of DrayTek VigorAP firmware allows an authenticated remote attacker with administrative credentials to cause denial of service or potentially execute arbitrary commands across six affected device models. The root cause is CWE-120 (Classic Buffer Overflow) - the CMD6 field undergoes memory copy operations without length validation, enabling controlled heap or stack corruption. No public exploit code has been identified at time of analysis, the vulnerability is absent from CISA KEV, and a vendor-released patch is confirmed available via DrayTek's August 2026 security advisory.
Buffer overflow in the setLan function of multiple DrayTek VigorAP access point models enables authenticated remote attackers to cause denial of service or execute arbitrary commands on affected devices. Six distinct VigorAP models - 903, 906, 912C, 918R, 960C, and 1060C - are confirmed affected across specific firmware version ranges, all patched by DrayTek in an August 2026 advisory. No public exploit identified at time of analysis, though the vulnerability was independently reported by VulnCheck and the impact class (RCE and DoS) raises operational risk for any organization where VigorAP admin interfaces are reachable from untrusted networks.
Stored OS command injection in the TP-Link Archer BE3600 V1 parent-control module allows an authenticated administrative attacker on the adjacent network to achieve arbitrary command execution on the device. The payload is persisted at configuration time-embedded in a crafted profile name-and fires asynchronously when the router's daily cloud report generation job runs, without any further attacker interaction. A vendor-released patch is available from TP-Link; no public exploit has been identified at time of analysis.
Root-level command injection in the TP-Link Archer BE800 V1 router (firmware prior to 1.4.2 Build 260708) allows an authenticated administrator on an adjacent network to execute arbitrary OS commands with root privileges by injecting shell metacharacters through the VPN connection interface. Successful exploitation hands an attacker full control of the embedded Linux environment, enabling persistent backdoors, credential theft, and use of the router as a pivot into the connected LAN. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released firmware patch is available.
Unauthenticated arbitrary file deletion in the MasterStudy LMS WordPress plugin (versions ≤ 3.7.42) allows remote, unauthenticated attackers to delete arbitrary files on the server via path traversal. The CVSS 8.6 vector (AV:N/AC:L/PR:N/UI:N/S:C/A:H) confirms no authentication or user interaction is required and that impact extends beyond the plugin's own scope to server-level files. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-prerequisite attack surface makes this a high-priority patch target for all WordPress deployments running the affected plugin.
Unauthenticated arbitrary file deletion in ShopBuilder Pro - Elementor WooCommerce Builder Addons plugin versions 2.2.0 and earlier allows any remote attacker to delete arbitrary files on the underlying WordPress server without credentials. The root cause is a path traversal weakness (CWE-22) in a network-exposed endpoint that fails to sanitize user-supplied file paths, enabling traversal outside the plugin's intended file scope. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; however, the trivial exploitation conditions (no authentication, no user interaction) make this a high-priority patching target for any site running the affected plugin.
Unauthenticated arbitrary file deletion in WooCommerce File Approval plugin (versions through 10.7) allows any remote attacker to delete arbitrary files on the underlying server without credentials or user interaction. The path traversal root cause (CWE-22) enables attackers to escape the plugin's intended file handling scope, with the CVSS S:C scope-change indicator confirming that files outside the plugin's own directory — including WordPress core files, configuration files, or OS-level files accessible to the web server process — can be targeted. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the zero-complexity, unauthenticated attack surface makes this a high-priority remediation target for any site running the affected plugin.
Incorrect authorization in KAON PG5298A and PG5298B router firmware allows authenticated network-adjacent users to send crafted JSON-RPC requests that bypass GUI-enforced access controls, enabling arbitrary system file reads and command execution on the device. All firmware versions prior to 3.0.82 (PG5298A) and 4.0.82 (PG5298B) are affected, as confirmed by CERT-PL. No public exploit has been identified at time of analysis; vendor-released patches are available.
OS command injection in Sakura Editor (Windows text editor) enables arbitrary command execution on a victim's PC when they open a file from an attacker-crafted directory and invoke the 'Open Terminal' (Open PowerShell) feature. The vulnerability, tracked as JVN#74538868 and GHSA-6x2x-729r-wjh5 and reported by JPCERT, requires social engineering to place the victim's file in a path containing injected shell metacharacters. No public exploit identified at time of analysis and no CISA KEV listing, but the full-compromise impact (C:H/I:H/A:H on the vulnerable system) warrants prompt patching to v2.4.3.
Privilege escalation vulnerabilities in HP Easy Start for macOS, versions prior to 2.16.7.260722, allow a local low-privileged user to gain elevated system access. Classified under CWE-1104 (Use of Unmaintained Third-Party Components), the root cause likely involves outdated bundled libraries within the printer setup utility. HP has released version 2.16.7.260722 as the remediation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated access to the DUML command interface over Bluetooth on sixteen DJI drone models allows any attacker within Bluetooth range to overwrite Wi-Fi credentials, reconfigure wireless parameters, and bridge onto the drone's internal Wi-Fi network - from which the flight control interface is reachable and flight commands can be issued. The vulnerability stems from a complete absence of authentication on a critical management protocol (CWE-306), affecting consumer and prosumer models across the Neo, Flip, Air, Avata, Mavic, and Mini product lines prior to their respective patched firmware versions. Beyond credential hijacking, the same unauthenticated DUML channel permits denial-of-service by disabling or restarting wireless interfaces mid-flight, severing the operator's control, video, and telemetry links - a safety-critical consequence. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
CRLF injection in TIM Flow before 26.0.6 allows remote unauthenticated attackers to split HTTP responses by embedding unsanitized carriage return and line feed sequences in the rt URL parameter and access_token cookie, both of which are reflected into Set-Cookie response headers. Crafted requests targeting authenticated users can inject arbitrary response body content, enabling JavaScript execution in the victim's browser to steal session tokens or modify account credentials. No public exploit code has been identified at time of analysis and this vulnerability does not appear in the CISA KEV catalog, though the CVSS 4.0 score of 8.5 reflects high confidentiality and integrity impact once user interaction is obtained.
Heap buffer overflow in RustDesk's Windows clipboard redirection (wf_cliprdr.c) allows a malicious or compromised remote peer to overwrite heap memory in the local paste consumer process (typically explorer.exe) when the local user pastes clipboard file contents offered by the remote side. The OLE paste consumer calls IStream::Read with a buffer of cb bytes, but CliprdrStream_Read blindly copies req_fsize bytes - taken verbatim from the peer's CLIPRDR FileContentsResponse - before the only bounds check (req_fsize < cb) is ever evaluated, meaning an oversized peer response writes attacker-controlled data past the end of the caller's heap allocation. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed; however, an upstream fix PR (#15515) exists and the root cause is precisely documented, lowering the bar for exploit development. The identical defect was fixed in the upstream FreeRDP library as CVE-2026-68579 in FreeRDP 3.30.0, providing a public reference implementation of the fix.
SQL Injection in WP Project Manager Pro versions 4.0.1 and below allows authenticated subscriber-level users to execute arbitrary SQL queries against the WordPress database, potentially exposing the full database contents including credentials and sensitive user data. The vulnerability carries a CVSS 8.5 (High) with scope change, meaning exploitation reaches beyond the plugin itself to the underlying WordPress database. Reported by Patchstack and tracked as EUVD-2026-64802; no active exploitation (CISA KEV) has been confirmed, and no public exploit code has been identified at time of analysis.
SQL injection in the ProLancer Element WordPress plugin (≤1.4.8) enables subscriber-level authenticated users to execute arbitrary SQL queries against the WordPress database, with a scope change indicating access beyond the plugin's own data boundary. Reported by Patchstack and corroborated by ENISA EUVD-2026-64799, the flaw requires only the lowest WordPress user role, making it exploitable on any site with open subscriber registration. No public exploit or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in Hi.Events (all versions prior to 1.11.1-beta) allows an authenticated platform user to exfiltrate responses from internal network services, including cloud metadata endpoints, by exploiting a time-of-check/time-of-use gap in webhook URL validation. The registration-time guard in NoInternalUrlRule is never repeated at dispatch, and Guzzle's default redirect-following allows a destination that answers with a redirect to a loopback or RFC-1918 address to cause the server to issue the secondary request. Critically, this is not blind SSRF: WebhookResponseHandlerService stores the response body and WebhookLogResource exposes it via the webhook logs API, enabling direct credential or secret exfiltration. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
CSV formula injection in exceljs-hardened before version 5.0.0 allows attackers who can influence exported cell values to embed spreadsheet formulas in generated CSV output by supplying values beginning with =, +, -, or @. When a victim opens the resulting CSV in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, injected formulas execute in the spreadsheet context, enabling data exfiltration or unauthorized actions within that application. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.4 reflects high confidentiality impact and a scope change to the subsequent spreadsheet application system.
Unsafe pickle deserialization in Flair 0.15.0 and 0.15.1 allows arbitrary code execution with the privileges of the loading process when a victim calls ClusteringModel.load() on an attacker-supplied model file. The critical compounding factor is a false remediation: CVE-2024-10073 designated 0.15.0 as the fixed version after clustering was dropped from the documented API, but flair/models/clustering.py remains physically present in the PyPI-distributed wheels for both 0.15.0 and 0.15.1 and is directly importable, voiding the prior CVE's resolution. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Buffer overflow in Zscaler Client Connector on Android and ChromeOS allows local exploitation to trigger a denial-of-service condition against the connector process. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) assigns High confidentiality and integrity impact, creating a notable discrepancy with the vendor description, which characterizes impact as DoS only - this gap suggests the vulnerability may carry latent code-execution potential that the description does not fully disclose. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in webpack-dev-middleware bypasses the incomplete CVE-2024-29180 fix by embedding dot-dot sequences within path segments (e.g., 'assets..') rather than as standalone segments, causing the UP_PATH_REGEXP guard to pass while the subsequent fixed-offset slice produces a parent-directory component that resolves above outputPath on the physical filesystem. Affected versions are precisely 5.3.4+, 6.1.2+, and 7.1.0+ - the releases that introduced the original guard-and-slice logic intended to fix path traversal. Exploitation is constrained to non-default configurations where publicPath lacks a trailing slash and the physical filesystem is in use via writeToDisk: true or a custom outputFileSystem; no public exploit identified at time of analysis, though a functional PoC for the predecessor attack class exists in GHSA-wr3j-pwj9-hqq6.
Incorrect authorization in the hex.pm OAuth `client_credentials` endpoint allows any API key bearing the `repositories` permission to mint tokens scoped to arbitrary organizations' private packages. The flaw in `validate_scopes_against_key/2` accepted any scope string prefixed with `repository:` without resolving the organization name against the authenticated principal's actual memberships; because CDN edges evaluate repository access from token claims alone without querying the database, a minted token grants persistent read access to the targeted organization's private packages until expiration. No public exploit code has been identified at time of analysis, but the vulnerability mechanics are fully disclosed in the public advisory and patch diff.