Unauthenticated access to the DUML command interface over Bluetooth on sixteen DJI drone models allows any attacker within Bluetooth range to overwrite Wi-Fi credentials, reconfigure wireless parameters, and bridge onto the drone's internal Wi-Fi network - from which the flight control interface is reachable and flight commands can be issued. The vulnerability stems from a complete absence of authentication on a critical management protocol (CWE-306), affecting consumer and prosumer models across the Neo, Flip, Air, Avata, Mavic, and Mini product lines prior to their respective patched firmware versions. Beyond credential hijacking, the same unauthenticated DUML channel permits denial-of-service by disabling or restarting wireless interfaces mid-flight, severing the operator's control, video, and telemetry links - a safety-critical consequence. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
CRLF injection in TIM Flow before 26.0.6 allows remote unauthenticated attackers to split HTTP responses by embedding unsanitized carriage return and line feed sequences in the rt URL parameter and access_token cookie, both of which are reflected into Set-Cookie response headers. Crafted requests targeting authenticated users can inject arbitrary response body content, enabling JavaScript execution in the victim's browser to steal session tokens or modify account credentials. No public exploit code has been identified at time of analysis and this vulnerability does not appear in the CISA KEV catalog, though the CVSS 4.0 score of 8.5 reflects high confidentiality and integrity impact once user interaction is obtained.
Heap buffer overflow in RustDesk's Windows clipboard redirection (wf_cliprdr.c) allows a malicious or compromised remote peer to overwrite heap memory in the local paste consumer process (typically explorer.exe) when the local user pastes clipboard file contents offered by the remote side. The OLE paste consumer calls IStream::Read with a buffer of cb bytes, but CliprdrStream_Read blindly copies req_fsize bytes - taken verbatim from the peer's CLIPRDR FileContentsResponse - before the only bounds check (req_fsize < cb) is ever evaluated, meaning an oversized peer response writes attacker-controlled data past the end of the caller's heap allocation. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed; however, an upstream fix PR (#15515) exists and the root cause is precisely documented, lowering the bar for exploit development. The identical defect was fixed in the upstream FreeRDP library as CVE-2026-68579 in FreeRDP 3.30.0, providing a public reference implementation of the fix.
SQL Injection in WP Project Manager Pro versions 4.0.1 and below allows authenticated subscriber-level users to execute arbitrary SQL queries against the WordPress database, potentially exposing the full database contents including credentials and sensitive user data. The vulnerability carries a CVSS 8.5 (High) with scope change, meaning exploitation reaches beyond the plugin itself to the underlying WordPress database. Reported by Patchstack and tracked as EUVD-2026-64802; no active exploitation (CISA KEV) has been confirmed, and no public exploit code has been identified at time of analysis.
SQL injection in the ProLancer Element WordPress plugin (≤1.4.8) enables subscriber-level authenticated users to execute arbitrary SQL queries against the WordPress database, with a scope change indicating access beyond the plugin's own data boundary. Reported by Patchstack and corroborated by ENISA EUVD-2026-64799, the flaw requires only the lowest WordPress user role, making it exploitable on any site with open subscriber registration. No public exploit or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in Hi.Events (all versions prior to 1.11.1-beta) allows an authenticated platform user to exfiltrate responses from internal network services, including cloud metadata endpoints, by exploiting a time-of-check/time-of-use gap in webhook URL validation. The registration-time guard in NoInternalUrlRule is never repeated at dispatch, and Guzzle's default redirect-following allows a destination that answers with a redirect to a loopback or RFC-1918 address to cause the server to issue the secondary request. Critically, this is not blind SSRF: WebhookResponseHandlerService stores the response body and WebhookLogResource exposes it via the webhook logs API, enabling direct credential or secret exfiltration. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
CSV formula injection in exceljs-hardened before version 5.0.0 allows attackers who can influence exported cell values to embed spreadsheet formulas in generated CSV output by supplying values beginning with =, +, -, or @. When a victim opens the resulting CSV in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, injected formulas execute in the spreadsheet context, enabling data exfiltration or unauthorized actions within that application. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.4 reflects high confidentiality impact and a scope change to the subsequent spreadsheet application system.
Unsafe pickle deserialization in Flair 0.15.0 and 0.15.1 allows arbitrary code execution with the privileges of the loading process when a victim calls ClusteringModel.load() on an attacker-supplied model file. The critical compounding factor is a false remediation: CVE-2024-10073 designated 0.15.0 as the fixed version after clustering was dropped from the documented API, but flair/models/clustering.py remains physically present in the PyPI-distributed wheels for both 0.15.0 and 0.15.1 and is directly importable, voiding the prior CVE's resolution. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Buffer overflow in Zscaler Client Connector on Android and ChromeOS allows local exploitation to trigger a denial-of-service condition against the connector process. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) assigns High confidentiality and integrity impact, creating a notable discrepancy with the vendor description, which characterizes impact as DoS only - this gap suggests the vulnerability may carry latent code-execution potential that the description does not fully disclose. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in webpack-dev-middleware bypasses the incomplete CVE-2024-29180 fix by embedding dot-dot sequences within path segments (e.g., 'assets..') rather than as standalone segments, causing the UP_PATH_REGEXP guard to pass while the subsequent fixed-offset slice produces a parent-directory component that resolves above outputPath on the physical filesystem. Affected versions are precisely 5.3.4+, 6.1.2+, and 7.1.0+ - the releases that introduced the original guard-and-slice logic intended to fix path traversal. Exploitation is constrained to non-default configurations where publicPath lacks a trailing slash and the physical filesystem is in use via writeToDisk: true or a custom outputFileSystem; no public exploit identified at time of analysis, though a functional PoC for the predecessor attack class exists in GHSA-wr3j-pwj9-hqq6.
Incorrect authorization in the hex.pm OAuth `client_credentials` endpoint allows any API key bearing the `repositories` permission to mint tokens scoped to arbitrary organizations' private packages. The flaw in `validate_scopes_against_key/2` accepted any scope string prefixed with `repository:` without resolving the organization name against the authenticated principal's actual memberships; because CDN edges evaluate repository access from token claims alone without querying the database, a minted token grants persistent read access to the targeted organization's private packages until expiration. No public exploit code has been identified at time of analysis, but the vulnerability mechanics are fully disclosed in the public advisory and patch diff.
Incomplete destructive-command denylist in Continue CLI's headless and auto modes enables indirect prompt injection to trigger irreversible data destruction on the invoking user's filesystem. The sole safety gate, isCriticalCommand in packages/terminal-security/src/evaluateTerminalCommandSecurity.ts, blocks only eight path prefixes and misses /home, /root, /var, /opt, and /srv entirely; a secondary bypass exists because shell-quote reduces $HOME to an empty token during the path check while the shell correctly re-expands the variable at execution. Because the agent autonomously consumes untrusted content - fetched web pages, repository files, and issue text - a malicious payload planted in any such source can cause an unattended run to destroy user data; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Server-side request forgery in Hugo static site generator (versions 0.91.0 through 0.165.0) allows an attacker who can supply a URL through site content - via front-matter fields or a connected CMS - to silently fetch loopback, RFC 1918, or cloud-metadata endpoints during the build process, embedding the internal response directly into the published static output. The security.http.urls allowlist, Hugo's only guard on resources.GetRemote outbound fetches, evaluates hostname strings without performing DNS resolution, meaning any registered domain whose A record points to a private or metadata IP bypasses the policy entirely, and no dial-time hook in the HTTP client provides a second check. No public exploit code has been identified at time of analysis, but the attack requires only DNS control and content-write access, making it operationally straightforward in CI/CD-integrated deployments.
Path traversal in RansomLook's GroupPost.get API handler allows an attacker controlling a malicious upstream instance to exfiltrate arbitrary files readable by the RansomLook process, including configuration secrets and API credentials. The screen field stored in the database is concatenated directly with the application's source/ directory path without boundary validation, enabling traversal sequences such as ../config/generic.json to escape the intended directory. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the federation import mechanism means a compromised upstream instance can poison a victim's database without holding any account on the victim system.
Email header injection in CakePHP's Mailer component allows CRLF sequences embedded in custom header values to split SMTP headers and introduce attacker-controlled fields. All supported release lines are affected - 4.5.x, 4.6.x, 5.1.x, 5.2.x, and 5.3.x - when applications pass user-controlled data to Message::setHeaders() or Message::addHeaders(). An attacker who can influence those header values can inject arbitrary SMTP headers (e.g., Bcc, Reply-To, Content-Type), potentially hijacking email routing or silently copying messages; no public exploit identified at time of analysis.
PDF export in RansomLook allows authenticated analysts to read arbitrary server-side files and conduct server-side request forgery by embedding crafted resource references in analysis documents. Prior to the patch, WeasyPrint's default URL fetcher resolved any scheme - including file:// and http:// - using the privileges and network access of the RansomLook server process, enabling exfiltration of local configuration and credentials or enumeration of internal network services. No public exploit code or CISA KEV listing exists at time of analysis; a fix is confirmed via GitHub commit 34dc0285583dae483b4d48c8e98fff942b755f5f, which introduces a strict URL allowlist restricting rendering to data: URIs, the report logo, and analysis asset files.
Reflected or stored cross-site scripting in Johnson Controls Metasys 14 (before 14.1.5) and Metasys 15 (before 15.0.1) allows a low-privileged attacker to inject malicious scripts into web pages that execute in a victim user's browser. Metasys is a building automation and management system, meaning successful exploitation could enable session hijacking or unauthorized interaction with building infrastructure controls accessible through the web interface. No public exploit has been identified and no active exploitation is confirmed; a vendor-released patch is available.
Command injection in the D-Link DI-7001 MINI_5G router (firmware 19.10.31A1) allows unauthenticated attackers on the adjacent network to execute arbitrary OS commands via the `flag` parameter of the `msp_info` endpoint. The vulnerability is rooted in CWE-77 (improper neutralization of command-special elements), and a public proof-of-concept writeup has been published on GitHub, lowering the exploitation bar. No active exploitation has been confirmed by CISA KEV, and EPSS sits at 0.17% (6th percentile), indicating limited observed exploitation activity at time of analysis.
Remote code execution in D-Link DI-8100G firmware 17.12.20A1 is achievable by unauthenticated attackers positioned on the adjacent network via a crafted `flag` parameter in the `msp_info` CGI handler. The flaw (CWE-94, Code Injection) permits full compromise of device confidentiality and integrity with no privileges or user interaction required, yielding a CVSS 8.1 (High) rating. A researcher-published proof-of-concept exists on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.17% reflects low observed exploitation probability at the time of analysis.
OneNav 1.2.4's import_link() function allows any authenticated user to delete arbitrary files on the host system via path traversal, scoring CVSS 8.1 with High integrity and availability impact. Publicly available exploit code exists per SSVC assessment (exploitation: poc), though EPSS probability remains very low at 0.14% (4th percentile), indicating limited widespread exploitation activity. The attack requires only low-privilege authentication over the network with no user interaction, making it accessible to any registered user of an exposed OneNav instance.
Local File Inclusion in the Måne WordPress theme (versions ≤ 1.7) exposes sites to unauthenticated file inclusion attacks exploitable over the network, classified under CWE-98 (Improper Control of Filename for PHP Include/Require). Attackers can force the theme's PHP code to include arbitrary server-side files, potentially exposing sensitive configuration data or — when chained with a writable server location — achieving remote code execution under the web server's process identity. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis, though the vulnerability class is technically well-understood and widely targeted in WordPress ecosystems.
Local File Inclusion in the Tonda Core WordPress plugin (all versions prior to 2.6) exposes unauthenticated remote attackers to arbitrary local-file disclosure and, under secondary conditions, potential remote code execution on the host server. Reported by Patchstack and registered under ENISA EUVD-2026-64791, the flaw carries a CVSS 3.1 score of 8.1 with full C/I/A impact and no authentication requirement. A vendor-released patch is available at version 2.6; no confirmed active exploitation or public exploit code has been identified at time of analysis.
Local File Inclusion in the Tonda WordPress theme (versions below 2.6) enables unauthenticated remote attackers to manipulate PHP include statements and read arbitrary files from the server filesystem. The vulnerability is network-exploitable without authentication, but the CVSS AC:H rating indicates exploitation requires specific conditions or input validation bypass rather than trivial mass exploitation. Vendor patch is available at version 2.6; no public exploit or CISA KEV listing has been identified at time of analysis.
Local File Inclusion in the Verdure Core WordPress plugin (versions ≤ 1.2) allows unauthenticated remote attackers to include arbitrary files from the server's filesystem by passing unsanitized input to PHP include/require statements. Successful exploitation can expose sensitive server files such as wp-config.php - disclosing database credentials - and, under certain PHP configurations, may enable remote code execution through log poisoning or PHP wrapper abuse. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated attack vector lowers the barrier for opportunistic targeting of vulnerable WordPress installations.
Cross-site scripting in the Network Optix Nx Witness VMS Web Administration interface (all versions before 6.1.3 on Linux, Windows, and macOS) enables an adjacent-network attacker who controls a rogue Nx server to inject arbitrary JavaScript into an authenticated administrator's browser session by setting the rogue server's site name to a script payload. The injected script executes when the administrator opens the 'Merge with Another Site' dialog, triggering session token theft and full administrator account takeover. No public exploit code or CISA KEV listing was identified at time of analysis; the vendor has released a patch at version 6.1.3.
Out-of-bounds read in Autodesk 3ds Max's SVG file parser enables crash, sensitive memory disclosure, or arbitrary code execution within the 3ds Max process context when a user opens a maliciously crafted SVG file. Affected releases span 3ds Max 2026 prior to 2026.3.4 and 3ds Max 2027 prior to 2027.2.0, as confirmed by EUVD-2026-65150. EPSS stands at 0.25% (16th percentile) with SSVC exploitation status of 'none,' indicating no current active exploitation; however, the RCE-capable impact triad warrants patching in affected professional environments.
Local privilege escalation in Entevo HMI V2 R5 P0 M4 enables a low-privileged local user to break out of Kiosk Mode and gain administrative command execution on Windows. The escape path exploits the application's built-in PDF manual viewer: opening the manual triggers an external PDF reader, whose Print dialog exposes Windows Explorer shell access, ultimately permitting arbitrary command execution as an administrator. A proof-of-concept demonstration is publicly available via GitHub gist; EPSS is low at 0.17% and CISA SSVC indicates no confirmed active exploitation, though the public POC meaningfully lowers the skill bar for any attacker with local session access.
Heap-based buffer overflow in libtiff's rgb2ycbcr command-line utility enables potential arbitrary code execution when a user processes a specially crafted TIFF image. The root cause is a CWE-190 integer overflow in the cvtRaster() function's strip buffer size computation: the arithmetic wraps to an undersized value, and subsequent YCbCr conversion writes spill beyond the allocated heap region. A publicly shared GitHub gist (okyfh) suggests proof-of-concept material may be available; an upstream fix commit exists in the libtiff GitLab repository, though no tagged release version has been independently confirmed at time of analysis.
Out-of-bounds write in Autodesk 3ds Max's FLT file parser allows an attacker to cause a crash, corrupt data, or execute arbitrary code within the process context of the application. Exploitation requires a victim to open a specially crafted FLT (OpenFlight) file, placing this firmly in the file-borne, socially engineered delivery category. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Memory corruption via maliciously crafted SVG files in Autodesk 3ds Max allows arbitrary code execution within the current process context. The vulnerability is rooted in a classic buffer overflow (CWE-120) in the application's SVG parsing subsystem, triggered when a user opens a specially crafted file. Autodesk PSIRT has issued advisory ADSK-SA-2026-0014; no public exploit code or CISA KEV listing has been identified at time of analysis, though the full C/I/A impact triad warrants prompt remediation.
Out-of-bounds write in Autodesk 3ds Max's Alembic (ABC) file parser enables arbitrary code execution in the context of the current user process when a victim opens a maliciously crafted ABC file. The vulnerability carries a CVSS 7.8 High score with high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, but the combination of low attack complexity and full process-context code execution potential makes this a credible risk for 3ds Max users who routinely open externally sourced scene files.
Improper access control in Dell ThinOS 10 (all versions prior to 2605_10.2518) enables a local low-privileged user to bypass access restrictions and gain unauthorized access to protected resources on the affected thin client system. The CVSS score of 7.8 (High) reflects complete confidentiality, integrity, and availability impact upon successful exploitation, despite requiring only local, low-privilege access with low attack complexity. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
SSRF vulnerabilities in AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) allow an authenticated organization notification administrator to cause the AWX control node to issue outbound HTTP requests to internal, loopback, or RFC-1918 addresses that are not externally reachable. Beyond basic SSRF, the webhook backend compounds the risk by following HTTP redirects and replaying configured Basic Authentication credentials to the redirect destination regardless of host change, enabling credential exfiltration to attacker-controlled endpoints; the Grafana backend similarly exposes its API key by forwarding the Authorization header verbatim to any configured target URL. No public exploit has been identified at time of analysis, but the Changed scope and high confidentiality impact in the CVSS vector reflect significant real-world risk given the network position AWX control nodes typically occupy.
Hard-coded RSA-512 mesh group private key in TP-Link Deco XE75 v3, XE5300 v3.6, and WE10800 v3.6 firmware allows an adjacent attacker to impersonate a trusted mesh node without possessing any device-specific credential. Because the same private key is shared across all affected devices and embedded in firmware images that TP-Link publishes publicly on its download portal, the barrier to key extraction is low. No public exploit or active exploitation has been identified at time of analysis, but a vendor-released patch is available.
Privilege escalation in HP Easy Start for macOS (versions prior to 2.16.7.260722) allows low-privileged local users to gain elevated system access through insecure temporary file handling, classified under CWE-379. HP has released version 2.16.7.260722 to address these vulnerabilities, as detailed in advisory HPSBPI04124. No public exploit code exists and no CISA KEV listing is present at time of analysis, reducing immediate urgency despite a vendor-assigned CVSS 4.0 score of 7.7.
HP Easy Start for macOS prior to version 2.16.7.260722 is affected by privilege escalation vulnerabilities rooted in CWE-319 (Cleartext Transmission of Sensitive Information), allowing an authenticated low-privilege attacker with network positioning to intercept sensitive data and gain elevated access on the affected macOS system. The CVSS 4.0 score of 7.7 reflects high impact across confidentiality, integrity, and availability, though the attack prerequisite modifier (AT:P) indicates specific conditions must be satisfied before exploitation succeeds. No public exploit code or active exploitation has been confirmed; HP has released a patched version addressing these issues.
SQL injection in FluentCRM Pro (WordPress plugin, versions ≤ 3.1.12) allows network-accessible, high-privileged authenticated users to inject arbitrary SQL via the Author parameter, compromising full database confidentiality. The CVSS scope change (S:C) with C:H indicates successful exploitation extends read access well beyond the plugin's own tables - potentially exposing CRM contact records, campaign data, and WordPress user credential hashes stored in the underlying MySQL/MariaDB database. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsistent host canonicalization between the library's own entry points. When a scheme-relative reference (e.g., //unicode-host.example/path) is passed without an explicit scheme, fast-uri's parse, normalize, and equal functions return the host verbatim, while resolve canonicalizes it to ASCII/Punycode - meaning the same input yields different host values depending on which API is called. An application that extracts a host for an allowlist check via one code path and then resolves the URI via another can be tricked into approving one host while the actual request is dispatched to a different one. No public exploit exists and CISA KEV listing is absent, but the EPSS-independent integrity impact (CVSS I:H) is real in applications relying on fast-uri for security-critical URI validation. Fixed versions are 2.4.5, 3.1.6, and 4.1.3.
Server-side request forgery and address-policy bypass in fast-uri, the Node.js URI parser used widely in the fastify ecosystem, allows remote unauthenticated attackers to redirect outbound requests from a target application to local or private IPv6 addresses by submitting crafted bracketed IPv6 literals with invalid trailing characters. The custom IPv6 parser silently normalizes malformed literals - collapsing some to the unspecified address (loopback) and others to private-range addresses - and returns no error on the parsed result, defeating any application-level error checking. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no special privileges and low complexity, making automated exploitation plausible against any exposed application that normalizes untrusted URLs through an affected fast-uri version.
Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and host-policy bypass primitive in versions 2.4.1-2.4.4, 3.1.2-3.1.5, and 4.0.0-4.1.2. The library decodes percent escapes once during hostname parsing and again during authority recomposition, so a single normalize or resolve call on a doubly-encoded input can silently resolve to a different network destination - including loopback addresses - than the encoded form represents. Any application layer sitting fast-uri in front of outbound routing guards, redirect allow-lists, or host-policy checks is therefore vulnerable to SSRF. This is an incomplete-fix variant of CVE-2026-6322; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unbounded abort listener accumulation in js-libp2p's circuit-relay-v2 relay server allows any remote peer to exhaust memory and deny service by repeatedly sending valid RESERVE requests for the same reservation slot. The `reservation-store.ts` reservation refresh path reuses an existing `retimeableSignal` but unconditionally registers a new abort listener on every call, causing listeners and their closures to grow without bound. No authentication is required to trigger this, making it exploitable by any peer that can reach the relay server. No public exploit or CISA KEV listing exists at time of analysis, though the unauthenticated network vector and trivial trigger condition make it a credible operational risk for relay operators.
JWT claim validation in Apache Camel's Platform HTTP Main component silently fails to enforce issuer and audience constraints when neither jwtIssuer nor jwtAudience is configured, causing the embedded Vert.x HTTP server to accept any unexpired token signed by any key in the trusted keystore. Affected are Apache Camel versions 4.8.0 through 4.21.x across both the application server and management server paths. An attacker who possesses a valid JWT from any identity provider trusted by the configured keystore - such as a token legitimately issued for a different service in a shared IdP environment - can authenticate to the Camel HTTP endpoints without holding credentials intended for that service. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.
Unauthorized system access in HCL Hive results from the product bundling third-party components that contain publicly documented security flaws. All tracked versions (CPE: cpe:2.3:a:hclsoftware:hcl_hive:*:*:*:*:*:*:*:*) are potentially affected, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that remote, unauthenticated attackers can reach the vulnerability without user interaction. The Authentication Bypass tag indicates the inherited component flaw enables circumvention of access controls with high confidentiality impact; no active exploitation has been confirmed by CISA KEV at time of analysis.
Unauthenticated sensitive data exposure in the SiteLeads WordPress plugin (Lead Generation Contact Widget & AI Chatbot) versions 1.2.0 and earlier allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. The vulnerability stems from improper protection of sensitive system data (CWE-497), where plugin-stored data - likely including lead contact details, API credentials, or configuration values - is accessible without authentication. No public exploit or CISA KEV listing has been identified at the time of analysis, though the CVSS score of 7.5 (High) reflects the low-effort, network-accessible nature of the attack.
Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows network-accessible, unauthenticated attackers to supply percent-encoded slashes in the scheme component, causing the library to report host as undefined during parsing while serialization emits a network-path reference with an attacker-controlled authority. Applications that allowlist requests on the parsed host value, or that treat a no-authority parse result as safe to resolve against a base URI, are bypassed - enabling server-side request forgery, off-site redirects, and address-policy evasion. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special configuration, making affected deployments an immediate upgrade priority.
Incorrect default permissions in HCL Hive 1.0 expose containerized deployments to unauthorized lateral movement, container breakout, and interception of sensitive inter-service communications by network-accessible attackers requiring no authentication. The flaw (CWE-276) means the platform ships with overly permissive defaults - not a misconfiguration by the operator - making any default deployment potentially vulnerable without additional hardening. No public exploit code exists at time of analysis, and the vulnerability has not been added to the CISA KEV catalog, but the combination of a network-accessible vector, no authentication requirement, and high confidentiality impact warrants prompt remediation.
Arbitrary file write via path traversal in the Apache Camel Google Cloud Storage consumer component affects versions 4.0.0 through 4.21.x, allowing anyone who can influence GCS bucket object names to cause the Camel process to create or overwrite files outside the configured download directory. The consumer appends blob names verbatim to the local path using the unsanitized ${file:name} token without directory containment checks, and the filter option that could restrict object names is disabled by default. No public exploit is identified at time of analysis; SSVC rates the flaw automatable once malicious object names are present in the consumed bucket, and vendor-released patches are available at 4.14.9, 4.18.4, and 4.22.0.
Denial of service in SpaceDot AcubeSAT On-Board Computer (OBC) software at commit eaf90ec is triggered by a crafted input to the cobs_decode function, exploiting an integer handling flaw (CWE-400) over the UART serial interface. Physical proximity to the hardware is required, rendering the NVD-assigned CVSS vector (AV:N) inconsistent with the description's explicit 'physically-proximate' access requirement - a likely scoring error that significantly overstates remote risk. No public exploit has been identified, EPSS is 0.15% (4th percentile), and this CVE is not listed in CISA KEV.
Stack-based buffer overflow in the SpaceDot AcubeSAT On-Board Computer (OBC) software allows remote unauthenticated attackers to crash the OBC by sending a crafted ECSS Telecommand (TC) message to the loadRawData function. The vulnerability, traced to commit eaf90ec, results in availability loss only - no confidentiality or integrity impact is indicated. No public exploit code or active exploitation has been confirmed; EPSS sits at 0.14% (4th percentile), consistent with the niche, mission-specific deployment footprint of this software.
Command injection in Black Duck blackduck-c-cpp before version 3.0.7 enables any actor with write access to a scanned build directory to execute arbitrary OS commands as the account running the scan. The scanner's package manager component traverses the build directory and incorporates discovered filesystem paths into shell command strings without quoting or escaping, making any file or directory whose name contains shell metacharacters an effective injection vector. No public exploit code or active exploitation is confirmed at time of analysis, but the mechanic is standard shell injection requiring no specialized tooling, making this a meaningful risk in shared CI/CD environments where untrusted parties can write to scanned directories.