Incomplete destructive-command denylist in Continue CLI's headless and auto modes enables indirect prompt injection to trigger irreversible data destruction on the invoking user's filesystem. The sole safety gate, isCriticalCommand in packages/terminal-security/src/evaluateTerminalCommandSecurity.ts, blocks only eight path prefixes and misses /home, /root, /var, /opt, and /srv entirely; a secondary bypass exists because shell-quote reduces $HOME to an empty token during the path check while the shell correctly re-expands the variable at execution. Because the agent autonomously consumes untrusted content - fetched web pages, repository files, and issue text - a malicious payload planted in any such source can cause an unattended run to destroy user data; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Server-side request forgery in Hugo static site generator (versions 0.91.0 through 0.165.0) allows an attacker who can supply a URL through site content - via front-matter fields or a connected CMS - to silently fetch loopback, RFC 1918, or cloud-metadata endpoints during the build process, embedding the internal response directly into the published static output. The security.http.urls allowlist, Hugo's only guard on resources.GetRemote outbound fetches, evaluates hostname strings without performing DNS resolution, meaning any registered domain whose A record points to a private or metadata IP bypasses the policy entirely, and no dial-time hook in the HTTP client provides a second check. No public exploit code has been identified at time of analysis, but the attack requires only DNS control and content-write access, making it operationally straightforward in CI/CD-integrated deployments.
Path traversal in RansomLook's GroupPost.get API handler allows an attacker controlling a malicious upstream instance to exfiltrate arbitrary files readable by the RansomLook process, including configuration secrets and API credentials. The screen field stored in the database is concatenated directly with the application's source/ directory path without boundary validation, enabling traversal sequences such as ../config/generic.json to escape the intended directory. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the federation import mechanism means a compromised upstream instance can poison a victim's database without holding any account on the victim system.
Email header injection in CakePHP's Mailer component allows CRLF sequences embedded in custom header values to split SMTP headers and introduce attacker-controlled fields. All supported release lines are affected - 4.5.x, 4.6.x, 5.1.x, 5.2.x, and 5.3.x - when applications pass user-controlled data to Message::setHeaders() or Message::addHeaders(). An attacker who can influence those header values can inject arbitrary SMTP headers (e.g., Bcc, Reply-To, Content-Type), potentially hijacking email routing or silently copying messages; no public exploit identified at time of analysis.
PDF export in RansomLook allows authenticated analysts to read arbitrary server-side files and conduct server-side request forgery by embedding crafted resource references in analysis documents. Prior to the patch, WeasyPrint's default URL fetcher resolved any scheme - including file:// and http:// - using the privileges and network access of the RansomLook server process, enabling exfiltration of local configuration and credentials or enumeration of internal network services. No public exploit code or CISA KEV listing exists at time of analysis; a fix is confirmed via GitHub commit 34dc0285583dae483b4d48c8e98fff942b755f5f, which introduces a strict URL allowlist restricting rendering to data: URIs, the report logo, and analysis asset files.
Remote code execution in D-Link DI-8100G firmware 17.12.20A1 is achievable by unauthenticated attackers positioned on the adjacent network via a crafted `flag` parameter in the `msp_info` CGI handler. The flaw (CWE-94, Code Injection) permits full compromise of device confidentiality and integrity with no privileges or user interaction required, yielding a CVSS 8.1 (High) rating. A researcher-published proof-of-concept exists on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.17% reflects low observed exploitation probability at the time of analysis.
Command injection in the D-Link DI-7001 MINI_5G router (firmware 19.10.31A1) allows unauthenticated attackers on the adjacent network to execute arbitrary OS commands via the `flag` parameter of the `msp_info` endpoint. The vulnerability is rooted in CWE-77 (improper neutralization of command-special elements), and a public proof-of-concept writeup has been published on GitHub, lowering the exploitation bar. No active exploitation has been confirmed by CISA KEV, and EPSS sits at 0.17% (6th percentile), indicating limited observed exploitation activity at time of analysis.
OneNav 1.2.4's import_link() function allows any authenticated user to delete arbitrary files on the host system via path traversal, scoring CVSS 8.1 with High integrity and availability impact. Publicly available exploit code exists per SSVC assessment (exploitation: poc), though EPSS probability remains very low at 0.14% (4th percentile), indicating limited widespread exploitation activity. The attack requires only low-privilege authentication over the network with no user interaction, making it accessible to any registered user of an exposed OneNav instance.
Local File Inclusion in the Måne WordPress theme (versions ≤ 1.7) exposes sites to unauthenticated file inclusion attacks exploitable over the network, classified under CWE-98 (Improper Control of Filename for PHP Include/Require). Attackers can force the theme's PHP code to include arbitrary server-side files, potentially exposing sensitive configuration data or — when chained with a writable server location — achieving remote code execution under the web server's process identity. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis, though the vulnerability class is technically well-understood and widely targeted in WordPress ecosystems.
Local File Inclusion in the Tonda Core WordPress plugin (all versions prior to 2.6) exposes unauthenticated remote attackers to arbitrary local-file disclosure and, under secondary conditions, potential remote code execution on the host server. Reported by Patchstack and registered under ENISA EUVD-2026-64791, the flaw carries a CVSS 3.1 score of 8.1 with full C/I/A impact and no authentication requirement. A vendor-released patch is available at version 2.6; no confirmed active exploitation or public exploit code has been identified at time of analysis.
Local File Inclusion in the Tonda WordPress theme (versions below 2.6) enables unauthenticated remote attackers to manipulate PHP include statements and read arbitrary files from the server filesystem. The vulnerability is network-exploitable without authentication, but the CVSS AC:H rating indicates exploitation requires specific conditions or input validation bypass rather than trivial mass exploitation. Vendor patch is available at version 2.6; no public exploit or CISA KEV listing has been identified at time of analysis.
Local File Inclusion in the Verdure Core WordPress plugin (versions ≤ 1.2) allows unauthenticated remote attackers to include arbitrary files from the server's filesystem by passing unsanitized input to PHP include/require statements. Successful exploitation can expose sensitive server files such as wp-config.php - disclosing database credentials - and, under certain PHP configurations, may enable remote code execution through log poisoning or PHP wrapper abuse. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated attack vector lowers the barrier for opportunistic targeting of vulnerable WordPress installations.
Cross-site scripting in the Network Optix Nx Witness VMS Web Administration interface (all versions before 6.1.3 on Linux, Windows, and macOS) enables an adjacent-network attacker who controls a rogue Nx server to inject arbitrary JavaScript into an authenticated administrator's browser session by setting the rogue server's site name to a script payload. The injected script executes when the administrator opens the 'Merge with Another Site' dialog, triggering session token theft and full administrator account takeover. No public exploit code or CISA KEV listing was identified at time of analysis; the vendor has released a patch at version 6.1.3.
Out-of-bounds read in Autodesk 3ds Max's SVG file parser enables crash, sensitive memory disclosure, or arbitrary code execution within the 3ds Max process context when a user opens a maliciously crafted SVG file. Affected releases span 3ds Max 2026 prior to 2026.3.4 and 3ds Max 2027 prior to 2027.2.0, as confirmed by EUVD-2026-65150. EPSS stands at 0.25% (16th percentile) with SSVC exploitation status of 'none,' indicating no current active exploitation; however, the RCE-capable impact triad warrants patching in affected professional environments.
Local privilege escalation in Entevo HMI V2 R5 P0 M4 enables a low-privileged local user to break out of Kiosk Mode and gain administrative command execution on Windows. The escape path exploits the application's built-in PDF manual viewer: opening the manual triggers an external PDF reader, whose Print dialog exposes Windows Explorer shell access, ultimately permitting arbitrary command execution as an administrator. A proof-of-concept demonstration is publicly available via GitHub gist; EPSS is low at 0.17% and CISA SSVC indicates no confirmed active exploitation, though the public POC meaningfully lowers the skill bar for any attacker with local session access.
Heap-based buffer overflow in libtiff's rgb2ycbcr command-line utility enables potential arbitrary code execution when a user processes a specially crafted TIFF image. The root cause is a CWE-190 integer overflow in the cvtRaster() function's strip buffer size computation: the arithmetic wraps to an undersized value, and subsequent YCbCr conversion writes spill beyond the allocated heap region. A publicly shared GitHub gist (okyfh) suggests proof-of-concept material may be available; an upstream fix commit exists in the libtiff GitLab repository, though no tagged release version has been independently confirmed at time of analysis.
Out-of-bounds write in Autodesk 3ds Max's FLT file parser allows an attacker to cause a crash, corrupt data, or execute arbitrary code within the process context of the application. Exploitation requires a victim to open a specially crafted FLT (OpenFlight) file, placing this firmly in the file-borne, socially engineered delivery category. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Memory corruption via maliciously crafted SVG files in Autodesk 3ds Max allows arbitrary code execution within the current process context. The vulnerability is rooted in a classic buffer overflow (CWE-120) in the application's SVG parsing subsystem, triggered when a user opens a specially crafted file. Autodesk PSIRT has issued advisory ADSK-SA-2026-0014; no public exploit code or CISA KEV listing has been identified at time of analysis, though the full C/I/A impact triad warrants prompt remediation.
Out-of-bounds write in Autodesk 3ds Max's Alembic (ABC) file parser enables arbitrary code execution in the context of the current user process when a victim opens a maliciously crafted ABC file. The vulnerability carries a CVSS 7.8 High score with high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, but the combination of low attack complexity and full process-context code execution potential makes this a credible risk for 3ds Max users who routinely open externally sourced scene files.
Improper access control in Dell ThinOS 10 (all versions prior to 2605_10.2518) enables a local low-privileged user to bypass access restrictions and gain unauthorized access to protected resources on the affected thin client system. The CVSS score of 7.8 (High) reflects complete confidentiality, integrity, and availability impact upon successful exploitation, despite requiring only local, low-privilege access with low attack complexity. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
SSRF vulnerabilities in AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) allow an authenticated organization notification administrator to cause the AWX control node to issue outbound HTTP requests to internal, loopback, or RFC-1918 addresses that are not externally reachable. Beyond basic SSRF, the webhook backend compounds the risk by following HTTP redirects and replaying configured Basic Authentication credentials to the redirect destination regardless of host change, enabling credential exfiltration to attacker-controlled endpoints; the Grafana backend similarly exposes its API key by forwarding the Authorization header verbatim to any configured target URL. No public exploit has been identified at time of analysis, but the Changed scope and high confidentiality impact in the CVSS vector reflect significant real-world risk given the network position AWX control nodes typically occupy.
Hard-coded RSA-512 mesh group private key in TP-Link Deco XE75 v3, XE5300 v3.6, and WE10800 v3.6 firmware allows an adjacent attacker to impersonate a trusted mesh node without possessing any device-specific credential. Because the same private key is shared across all affected devices and embedded in firmware images that TP-Link publishes publicly on its download portal, the barrier to key extraction is low. No public exploit or active exploitation has been identified at time of analysis, but a vendor-released patch is available.
Privilege escalation in HP Easy Start for macOS (versions prior to 2.16.7.260722) allows low-privileged local users to gain elevated system access through insecure temporary file handling, classified under CWE-379. HP has released version 2.16.7.260722 to address these vulnerabilities, as detailed in advisory HPSBPI04124. No public exploit code exists and no CISA KEV listing is present at time of analysis, reducing immediate urgency despite a vendor-assigned CVSS 4.0 score of 7.7.
HP Easy Start for macOS prior to version 2.16.7.260722 is affected by privilege escalation vulnerabilities rooted in CWE-319 (Cleartext Transmission of Sensitive Information), allowing an authenticated low-privilege attacker with network positioning to intercept sensitive data and gain elevated access on the affected macOS system. The CVSS 4.0 score of 7.7 reflects high impact across confidentiality, integrity, and availability, though the attack prerequisite modifier (AT:P) indicates specific conditions must be satisfied before exploitation succeeds. No public exploit code or active exploitation has been confirmed; HP has released a patched version addressing these issues.
SQL injection in FluentCRM Pro (WordPress plugin, versions ≤ 3.1.12) allows network-accessible, high-privileged authenticated users to inject arbitrary SQL via the Author parameter, compromising full database confidentiality. The CVSS scope change (S:C) with C:H indicates successful exploitation extends read access well beyond the plugin's own tables - potentially exposing CRM contact records, campaign data, and WordPress user credential hashes stored in the underlying MySQL/MariaDB database. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsistent host canonicalization between the library's own entry points. When a scheme-relative reference (e.g., //unicode-host.example/path) is passed without an explicit scheme, fast-uri's parse, normalize, and equal functions return the host verbatim, while resolve canonicalizes it to ASCII/Punycode - meaning the same input yields different host values depending on which API is called. An application that extracts a host for an allowlist check via one code path and then resolves the URI via another can be tricked into approving one host while the actual request is dispatched to a different one. No public exploit exists and CISA KEV listing is absent, but the EPSS-independent integrity impact (CVSS I:H) is real in applications relying on fast-uri for security-critical URI validation. Fixed versions are 2.4.5, 3.1.6, and 4.1.3.
Server-side request forgery and address-policy bypass in fast-uri, the Node.js URI parser used widely in the fastify ecosystem, allows remote unauthenticated attackers to redirect outbound requests from a target application to local or private IPv6 addresses by submitting crafted bracketed IPv6 literals with invalid trailing characters. The custom IPv6 parser silently normalizes malformed literals - collapsing some to the unspecified address (loopback) and others to private-range addresses - and returns no error on the parsed result, defeating any application-level error checking. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no special privileges and low complexity, making automated exploitation plausible against any exposed application that normalizes untrusted URLs through an affected fast-uri version.
Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and host-policy bypass primitive in versions 2.4.1-2.4.4, 3.1.2-3.1.5, and 4.0.0-4.1.2. The library decodes percent escapes once during hostname parsing and again during authority recomposition, so a single normalize or resolve call on a doubly-encoded input can silently resolve to a different network destination - including loopback addresses - than the encoded form represents. Any application layer sitting fast-uri in front of outbound routing guards, redirect allow-lists, or host-policy checks is therefore vulnerable to SSRF. This is an incomplete-fix variant of CVE-2026-6322; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unbounded abort listener accumulation in js-libp2p's circuit-relay-v2 relay server allows any remote peer to exhaust memory and deny service by repeatedly sending valid RESERVE requests for the same reservation slot. The `reservation-store.ts` reservation refresh path reuses an existing `retimeableSignal` but unconditionally registers a new abort listener on every call, causing listeners and their closures to grow without bound. No authentication is required to trigger this, making it exploitable by any peer that can reach the relay server. No public exploit or CISA KEV listing exists at time of analysis, though the unauthenticated network vector and trivial trigger condition make it a credible operational risk for relay operators.
JWT claim validation in Apache Camel's Platform HTTP Main component silently fails to enforce issuer and audience constraints when neither jwtIssuer nor jwtAudience is configured, causing the embedded Vert.x HTTP server to accept any unexpired token signed by any key in the trusted keystore. Affected are Apache Camel versions 4.8.0 through 4.21.x across both the application server and management server paths. An attacker who possesses a valid JWT from any identity provider trusted by the configured keystore - such as a token legitimately issued for a different service in a shared IdP environment - can authenticate to the Camel HTTP endpoints without holding credentials intended for that service. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.
Unauthorized system access in HCL Hive results from the product bundling third-party components that contain publicly documented security flaws. All tracked versions (CPE: cpe:2.3:a:hclsoftware:hcl_hive:*:*:*:*:*:*:*:*) are potentially affected, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that remote, unauthenticated attackers can reach the vulnerability without user interaction. The Authentication Bypass tag indicates the inherited component flaw enables circumvention of access controls with high confidentiality impact; no active exploitation has been confirmed by CISA KEV at time of analysis.
Unauthenticated sensitive data exposure in the SiteLeads WordPress plugin (Lead Generation Contact Widget & AI Chatbot) versions 1.2.0 and earlier allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. The vulnerability stems from improper protection of sensitive system data (CWE-497), where plugin-stored data - likely including lead contact details, API credentials, or configuration values - is accessible without authentication. No public exploit or CISA KEV listing has been identified at the time of analysis, though the CVSS score of 7.5 (High) reflects the low-effort, network-accessible nature of the attack.
Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows network-accessible, unauthenticated attackers to supply percent-encoded slashes in the scheme component, causing the library to report host as undefined during parsing while serialization emits a network-path reference with an attacker-controlled authority. Applications that allowlist requests on the parsed host value, or that treat a no-authority parse result as safe to resolve against a base URI, are bypassed - enabling server-side request forgery, off-site redirects, and address-policy evasion. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special configuration, making affected deployments an immediate upgrade priority.
Incorrect default permissions in HCL Hive 1.0 expose containerized deployments to unauthorized lateral movement, container breakout, and interception of sensitive inter-service communications by network-accessible attackers requiring no authentication. The flaw (CWE-276) means the platform ships with overly permissive defaults - not a misconfiguration by the operator - making any default deployment potentially vulnerable without additional hardening. No public exploit code exists at time of analysis, and the vulnerability has not been added to the CISA KEV catalog, but the combination of a network-accessible vector, no authentication requirement, and high confidentiality impact warrants prompt remediation.
Arbitrary file write via path traversal in the Apache Camel Google Cloud Storage consumer component affects versions 4.0.0 through 4.21.x, allowing anyone who can influence GCS bucket object names to cause the Camel process to create or overwrite files outside the configured download directory. The consumer appends blob names verbatim to the local path using the unsanitized ${file:name} token without directory containment checks, and the filter option that could restrict object names is disabled by default. No public exploit is identified at time of analysis; SSVC rates the flaw automatable once malicious object names are present in the consumed bucket, and vendor-released patches are available at 4.14.9, 4.18.4, and 4.22.0.
Denial of service in SpaceDot AcubeSAT On-Board Computer (OBC) software at commit eaf90ec is triggered by a crafted input to the cobs_decode function, exploiting an integer handling flaw (CWE-400) over the UART serial interface. Physical proximity to the hardware is required, rendering the NVD-assigned CVSS vector (AV:N) inconsistent with the description's explicit 'physically-proximate' access requirement - a likely scoring error that significantly overstates remote risk. No public exploit has been identified, EPSS is 0.15% (4th percentile), and this CVE is not listed in CISA KEV.
Stack-based buffer overflow in the SpaceDot AcubeSAT On-Board Computer (OBC) software allows remote unauthenticated attackers to crash the OBC by sending a crafted ECSS Telecommand (TC) message to the loadRawData function. The vulnerability, traced to commit eaf90ec, results in availability loss only - no confidentiality or integrity impact is indicated. No public exploit code or active exploitation has been confirmed; EPSS sits at 0.14% (4th percentile), consistent with the niche, mission-specific deployment footprint of this software.
Command injection in Black Duck blackduck-c-cpp before version 3.0.7 enables any actor with write access to a scanned build directory to execute arbitrary OS commands as the account running the scan. The scanner's package manager component traverses the build directory and incorporates discovered filesystem paths into shell command strings without quoting or escaping, making any file or directory whose name contains shell metacharacters an effective injection vector. No public exploit code or active exploitation is confirmed at time of analysis, but the mechanic is standard shell injection requiring no specialized tooling, making this a meaningful risk in shared CI/CD environments where untrusted parties can write to scanned directories.
Unauthenticated sensitive data exposure in WP Cafe Pro WordPress plugin versions prior to 3.0.15 allows any remote attacker without credentials to retrieve sensitive information directly from affected WordPress installations. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the flaw is network-exploitable with no authentication or user interaction required, yielding a CVSS 3.1 score of 7.5 (High). No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in version 3.0.15.
Unauthenticated arbitrary file download in the Super Forms WordPress plugin (versions up to and including 6.3.315) exposes any file readable by the web server process to remote attackers without any credentials. The root cause is a path traversal flaw (CWE-22) in a file download endpoint that fails to sanitize user-supplied path parameters, enabling directory traversal sequences to escape the intended file root. No public exploit or CISA KEV listing is confirmed at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial, unauthenticated remote exploitation with no special conditions required on default plugin installations.
Broken access control in the Notification Master WordPress plugin (versions ≤ 1.7.1) exposes restricted functionality to unauthenticated remote attackers, resulting in high confidentiality impact with no authentication required. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that any network-accessible attacker can trigger the flaw with low complexity, likely exposing sensitive notification configuration data such as subscriber email addresses, phone numbers, or webhook endpoints stored by the plugin. No public exploit identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Path traversal in AWX's project_archive action plugin allows arbitrary file writes to execution node filesystems outside the intended project directory. Red Hat Ansible Automation Platform 2 is affected when processing zip or tar archives whose member filenames contain directory traversal sequences. An attacker who controls archive content - via admin-level project configuration, a compromised upstream archive source, or a man-in-the-middle attack on an unencrypted HTTP fetch - can write files as the extraction user and escalate to remote code execution through cron entries, SSH authorized_keys injection, or playbook content poisoning. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
HCL Hive employs a risky cryptographic primitive (CWE-1240) that creates systemic trust failure across the platform: if any single internal component is compromised, an attacker can exploit the weak cryptographic construction to achieve unauthorized lateral movement or harvest credentials at scale. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates the flaw is reachable over the network without authentication, though high attack complexity caps opportunistic risk. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated broken authentication in the WPLegalPages WordPress plugin (versions ≤ 3.7.0) allows remote attackers to bypass access controls on one or more plugin endpoints without any credentials or user interaction, as confirmed by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The vulnerability is classified under CWE-288, meaning an alternate path or channel exists that circumvents the intended authentication gate. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, but the low attack complexity means opportunistic scanning is a realistic threat.
Hardware fault injection via voltage and clock glitching in the Microchip SAMA5D4 ARM Cortex-A5 microprocessor enables a physically proximate attacker to subvert security-critical operations such as secure boot, cryptographic key protection, and privilege enforcement. All versions of the SAMA5D4 are affected per the vendor's CPE entry, and Microchip self-reported this vulnerability. No public exploit code has been identified and CISA has not added this to the KEV catalog, but the all-high impact scores in the CVSS 4.0 vector (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflect that successful exploitation grants total control over the affected system and any downstream components it secures.
Broken access control in HCL Hive 1.0 allows a high-privileged network attacker to bypass code verification gates and introduce unverified, malicious, or broken code directly into production environments. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity, and availability impact against the vulnerable system, contingent on high-privilege access. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Improper authorization in TIM Flow before 26.0.6 exposes a privileged dashboard Excel export endpoint to exploitation by any authenticated user, enabling arbitrary SQL query execution against the application database. The missing server-side authorization check (CWE-862) allows non-administrative accounts to craft SQL SELECT statements, submit them to the export endpoint, and receive full query results as a downloadable spreadsheet, effectively granting unrestricted read access to the database. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity makes this immediately actionable by any account holder.
Cross-client template disclosure in Ghostwriter before 7.1.2 allows authenticated users to exfiltrate proprietary report templates belonging to other clients managed within the same platform instance. The report template swap endpoint failed to enforce ownership validation, accepting user-controlled template primary keys without verifying client-scope alignment. Because template PKs are sequential integers, an attacker with any authenticated access can enumerate foreign template IDs, attach them to their own reports, and trigger report generation to read sensitive client deliverable content - including letterhead, boilerplate legal text, and pentest methodology. No public exploit identified at time of analysis, though VulnCheck has published an advisory and a researcher (geo-chen) has documented the issue in a public repository.
Process-aborting denial of service in OpenEXR 3.4.0 through 3.4.12 allows an unauthenticated remote attacker to crash any application that calls exr_start_read() on a crafted HTJ2K-compressed EXR file. The crash originates in the vendored OpenJPH library, which invokes abort() unconditionally when a QCD marker's lower five bits are zero - an assertion failure that OpenEXR's partial error handling cannot intercept because codestream read and construction calls are left unprotected. No public exploit has been identified at time of analysis; the vulnerability is patched in version 3.4.13.
Unauthenticated information disclosure in KAON PG5298A and PG5298B router firmware exposes the administrative portal password to any attacker on the same local network segment. An adjacent-network attacker can query a specific firmware endpoint without credentials and retrieve sensitive authentication material, enabling full device takeover. Vendor-released patches are available in firmware versions 3.0.82 (PG5298A) and 4.0.82 (PG5298B); no public exploit code or confirmed active exploitation has been identified at time of analysis.