Unauthenticated administrator account takeover affects the TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress in all versions through 3.3.1, where the 'trp_get_translations_regular' AJAX action returns raw translation-dictionary entries without access control. Because an administrator's password-reset URL can be persisted into the secondary-language dictionary as a translatable string, an unauthenticated attacker can read the plaintext reset key and login parameters and seize the admin account. Reported by Wordfence; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote code execution in SENAITE.CORE (senaite.core) 2.0.0 through 2.6.0 lets any network-reachable attacker run arbitrary Python in the Zope worker process by chaining a missing authorization check with an eval() sink in the JSON API. The anonymous-reachable /@@API/update route calls eval() on attacker-supplied RecordsField/RecordField values before any permission or write check fires, and a public working PoC (tested against the stock senaite/senaite:v2.6.0 Docker image) demonstrates credential-free command execution. Publicly available exploit code exists; the flaw is not listed in CISA KEV, so there is no confirmation of active exploitation.
Cross-namespace privilege escalation in Kyverno 1.18.0-1.18.1 lets any tenant who can create a NamespacedMutatingPolicy in their own namespace force the cluster-privileged admission controller to generate resources (ConfigMaps, Secrets, NetworkPolicies, RoleBindings) in arbitrary namespaces, including kube-system. The nmpol CEL compiler unintentionally exposes the generator library to matchConditions, and neither the mpol validator nor GenerateResources enforces namespace scope on the generator.apply() target. A working proof-of-concept is published in the vendor advisory (GHSA-79gf-7frw-68m9); there is no KEV listing or evidence of active exploitation, and the issue is fixed in 1.18.2.
Remote command injection in Ubiquiti's UniFi Talk Application lets a network-positioned attacker run arbitrary commands on the underlying host device due to improper input validation (CWE-20). Ubiquiti rates it CVSS 10.0 with a changed scope, meaning a successful attack escapes the application boundary to fully compromise the host. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Command injection in Ubiquiti UniFi Protect Application lets a network-positioned, unauthenticated attacker run arbitrary OS commands on the underlying host device, per the CVSS:3.1/AV:N/PR:N/UI:N vector and CWE-20 improper input validation root cause. The maximal 10.0 score reflects full confidentiality, integrity, and availability compromise with a scope change (S:C), meaning code executes on the host beyond the application boundary. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the trivial complexity and lack of authentication make it a top-priority patch for any exposed NVR.
Command injection in Ubiquiti's UniFi Protect Application lets a low-privileged, network-adjacent user run arbitrary operating-system commands on the host device (typically a UniFi NVR, Cloud Key, or Dream Machine running the Protect service). The CVSS 3.1 score of 9.9 reflects a scope change: an attacker who already holds a low-privilege application account escapes the application boundary to gain full control of the underlying host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralization of CRLF sequences (CWE-93) to gain access to affected consoles and gateways. It impacts a broad line of UniFi OS devices - Cloud Keys, Dream Machines/Routers, Network Video Recorders, Cloud Gateways, Enterprise Firewall/Fortress and NAS appliances, and the UniFi OS Server. Vendor-rated CVSS 10.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Missing authentication on KubePi's SSO configuration endpoints (versions up to and including 1.6.15) lets unauthorized or low-privileged users read, create, and modify the global SSO/OIDC/SAML authentication configuration because those management routes share the public routing boundary with the SSO login/callback endpoints. An attacker can inspect or tamper with authentication settings - potentially leading to account takeover or privilege escalation - abuse the SSO connectivity-test as an SSRF primitive, and harvest authentication-related fields leaked by the user-list API. There is no public exploit identified at time of analysis; the issue is fixed in KubePi 2.0.0.
Command injection in Ubiquiti's UniFi Protect Application lets a network-adjacent attacker holding only low-privileged credentials run arbitrary OS commands on the underlying host device. The CVSS 3.1 base score is 9.9 with a scope change, reflecting that a foothold in the application escalates into full control of the host operating system. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the near-maximal score and low exploitation barrier make it a high-priority patch.
Command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network access to run arbitrary operating-system commands on the underlying host device. The flaw stems from improper input validation (CWE-20) and carries a critical CVSS 9.9 with a scope change, meaning application-level compromise pivots to full control of the host. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
OS command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network reach to run arbitrary commands on the underlying host. Because the CVSS scope is marked Changed with full High confidentiality, integrity, and availability impact, successful exploitation moves beyond the application into the host device itself. No public exploit has been identified at time of analysis and the flaw is not on CISA KEV, but the 9.9 severity and low attack complexity make it a top-priority patch.
Command injection in Ubiquiti's UniFi Access Application allows an authenticated attacker with low privileges and network access to execute arbitrary OS commands on the host device. Rated CVSS 9.9 with a scope change, the flaw stems from improper input validation and lets a low-privileged user break out of the application to compromise the underlying host. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Command injection in the Ubiquiti UniFi Enterprise Audio/Video Bridge allows a network-adjacent attacker to run arbitrary operating-system commands on the device by supplying maliciously crafted input that the firmware fails to validate. The CVSS 3.1 base score is 9.8 and the vector marks the flaw as network-reachable with no authentication or user interaction, yielding full confidentiality, integrity, and availability compromise. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Authenticated remote attackers against WebPros Plesk (versions before 18.0.79.8, and 18.0.80 through 18.0.80.3) can inject special elements into the DNS zone management functionality to read arbitrary files on the server and escalate their privileges. Because the CVSS scope is changed (S:C), a low-privileged panel user can break out of their intended boundary to compromise the underlying host with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and EPSS is low (0.29%) with SSVC exploitation status 'none', indicating no observed exploitation yet.
Privilege escalation in Ubiquiti's UniFi Access Application allows a network-adjacent attacker holding only low-privilege credentials to gain full control of the underlying host device through an improper access control flaw. Ubiquiti self-reported the issue and rates it CVSS 9.9 (scope-changing), reflecting that a constrained application account can break out to compromise the host operating system. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate their rights to full administrative control, per Ubiquiti Security Advisory Bulletin 067 (CVE-2026-77536). The flaw stems from improper access control (CWE-284) and carries a near-maximum CVSS 9.9 due to a scope-changing impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to elevate to higher privileges on the affected device or instance due to an improper access control flaw. The issue spans Ubiquiti's core managed platforms - UniFi OS Server, Cloud Keys, Dream Machines/Routers, Cloud Gateways, NVR/Enterprise NVR, Enterprise NAS, and Enterprise Firewall/Fortress Gateway - and carries a critical CVSS 9.9 with a changed scope. No public exploit has been identified at time of analysis, but the low attack complexity and low privilege requirement make it high priority.
Unauthenticated arbitrary file write in the Avada WordPress theme (versions up to and including 7.16) combined with the Fusion Builder plugin (up to and including 3.16) lets remote attackers plant attacker-controlled files - including executable PHP - leading to remote code execution and full site takeover. The flaw is a cross-component chain of broken authorization and weak input validation (CWE-862) reported by Wordfence, and requires both components active plus specific administrator-authored content to be present. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Denial of service in the Linux kernel's TI AM65 CPSW NUSS Ethernet driver (am65-cpsw-nuss) allows sporadic kernel crashes because the driver treats the full 16-bit RX DMA descriptor Source Tag as the MAC port ID, when only the lower 8 bits are valid. On affected TI Sitara/K3 (AM65x-class) hardware, the arbitrary hardware-reserved upper 8 bits produce an invalid port_id that subsequent driver code uses to access out-of-bound memory, causing kernel panics. No public exploit is identified and it is not on CISA KEV; the vendor-tagged impact is Denial Of Service, not the remote code execution implied by the automated 9.8 score.
Use-after-free in the Linux kernel netfilter flowtable (nf_flow_table_offload) arises from an ordering bug in how connection-tracking tuple nodes are published to the rhashtable. Because nf_flow_table_iterate() treats only the original-direction node as the owning entry, publishing it before the reply node lets the garbage collector observe and free a flow while flow_offload_add() is still inserting the reply node, producing slab-use-after-free reads and writes reachable through rht_deferred_worker, jhash, flow_offload_del and flow_offload_lookup. The flaw affects systems using software/hardware flow offload; no public exploit identified at time of analysis, though the CNA-assigned CVSS is 9.8.
Slab-out-of-bounds reads in the Linux kernel's libceph client (cls_lock_client.c decode_locker()) allow a malicious or compromised Ceph OSD to read kernel memory past a validated buffer when a client parses lock information. Any kernel Ceph/RBD client that issues the lock.get_info class method - for example during RBD exclusive lock acquisition - is affected across a wide range of stable branches. The input assigns CVSS 9.8, but no public exploit identified at time of analysis and the flaw is an out-of-bounds read (information disclosure / crash) rather than confirmed code execution, so the practical impact is narrower than the score suggests.
Out-of-bounds memory access in the Linux kernel's libceph client (net/ceph) allows a malicious or corrupted Ceph osdmap to steer requests toward a non-existent OSD index. The flaw stems from an unvalidated osd index taken from the osdmap's primary_temp mapping, which is used to index the fixed-size osd_state, osd_weight, and osd_addr arrays. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed across multiple stable trees.
Denial of service (kernel crash/oops) in the Linux kernel CephFS client affects systems mounting a Ceph filesystem alongside another journaling filesystem such as ext4. The ceph handle_reply() path stores a ceph_mds_request pointer in current->journal_info while prepopulating the inode/dentry cache from an MDS reply; if an allocation in that window enters direct reclaim and prunes dentries from an ext4 mount, JBD2 misinterprets the Ceph pointer as a journal handle and dereferences r_tid as h_transaction, causing a paging fault and kernel oops. No KEV listing and no public exploit identified at time of analysis; the reported impact class is Denial Of Service rather than the code execution implied by the supplied 9.8 score.
Memory corruption in the Linux kernel ipvlan driver arises because ipvlan devices inherit hard_header_len but leave needed_headroom and needed_tailroom at zero, so upper layers under-reserve skb space when the lower physical device needs extra header/trailer room (macsec, IPsec, WireGuard, tunnels, or veth with rx headroom). Triggering the header-prepend or tailroom-append path can cause skb headroom underflow and KASAN-detected slab-use-after-free crashes. It is tagged as Denial of Service, has a vendor fix across multiple stable branches, and shows no public exploit or CISA KEV listing at time of analysis.
Memory corruption in the Linux kernel's macvlan driver occurs because macvlan devices fail to inherit needed_headroom and needed_tailroom from their underlying lower device, leaving both at 0. On systems where a macvlan is stacked on a lower device requiring extra header/trailer space (macsec, IPsec, WireGuard, tunnels, or veth with RX headroom), the upper layers under-reserve skb space, producing headroom underflows and KASAN slab-use-after-free crashes during header insertion. Tagged as Denial Of Service; a vendor patch is available and no public exploit has been identified at time of analysis.
Kernel memory corruption in the Linux SCTP stack allows a forged COOKIE_ECHO chunk to bypass validation of AUTH parameters when cookie authentication is disabled, letting an attacker who controls the echoed cookie bytes supply unchecked RANDOM lengths, HMAC identifiers, and CHUNKS lists. A forged RANDOM length yields out-of-bounds reads during key-vector construction, and a forged HMAC identifier drives a 32-byte write past a zero-length AUTH chunk - described by the reporter as a primitive for a local privilege escalation chain. No public exploit identified at time of analysis; the issue is fixed upstream in the mainline SCTP code.
Uninitialized-data exposure in the Linux kernel's MPTCP (Multipath TCP) option parser lets a remote peer send a malformed DSS suboption with an incorrect size, followed by a second DSS or MPC+Data, causing the first suboption to be ignored while leaving stale fields populated. The kernel then acts on inconsistent or uninitialized memory when handling the MPTCP connection. The upstream fix explicitly resets the affected DSS fields; vendor stable patches are available, this maps to CWE-908/CWE-457 (use of uninitialized resource), and there is no public exploit identified at time of analysis.
Use-after-free in the Linux kernel block layer occurs when a disk whose driver probe fails before add_disk() is released: disk_release() calls blk_mq_exit_queue() without stopping the request_queue timeout timer, so the request_queue is freed while still linked in a timer-wheel bucket. NVMe reaches this path because nvme_update_ns_info() issues Report Zones or FDP io-mgmt-recv I/O on the namespace queue before the disk is added, and a later failure (concurrent reset setting NVME_CTRL_FROZEN, or device_add_disk() failing) leaves the timer armed on freed memory. The flaw was found by the FuzzNvme fuzzer and produces a KASAN slab-use-after-free (write) during timer teardown; no public exploit is identified at time of analysis and it is not in CISA KEV.
Improper handling of incoming MPTCP suboptions in the Linux kernel's Multipath TCP (mptcp) implementation lets a remote peer send option combinations that RFC 8684 treats as mutually exclusive and that the parsing code does not expect, potentially causing inconsistent internal state when malformed or malicious combinations (e.g. MP_CAPABLE with MP_JOIN, or MP_FASTCLOSE with a DSS) are processed on the receive path. The fix mirrors the output-side restrictions in mptcp_write_options so conflicting suboptions are ignored rather than acted upon. No public exploit identified at time of analysis, and the issue is only reachable on hosts where MPTCP is enabled and in use; the supplied CVSS of 9.8 appears automated and likely overstates real-world impact.
Privilege escalation in Ubiquiti's UniFi Protect AI Key lets a network-adjacent attacker abuse an improper access control (authentication-bypass) weakness to gain elevated privileges on the device, per Ubiquiti's own advisory (Security Advisory Bulletin 067). The CVSS 9.8 rating reflects a network-reachable, no-authentication, no-interaction path yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote command execution in JeecgBoot v3.9.2 lets attackers run arbitrary OS commands through the AI Flow module's CodeNode component, which executes user-supplied Groovy scripts. The SecurityCheck class enforces a blacklist to block dangerous calls, but Groovy's dynamic dispatch allows the blacklist to be fully bypassed via string concatenation and reflection, yielding full code execution. No public exploit is identified at time of analysis, and EPSS is low (0.22%, 13th percentile), consistent with a newly disclosed issue rather than mass exploitation.
Remote code execution in SimpleX Chat before v6.5 is claimed via the /Terminal/Notification.hs component, where a crafted payload delivered inside a normal text message is said to execute arbitrary commands with zero user interaction (CWE-94 code injection). If accurate, any user running a vulnerable build could be compromised simply by receiving a message. No public exploit identified at time of analysis and EPSS is low (0.22%, 12th percentile); the claim rests on a single third-party disclosure blog rather than a vendor advisory, so treat the severity as unconfirmed.
Authentication bypass in DWSurvey v6.14.0 lets remote unauthenticated attackers reach protected API functionality through the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' endpoint paths, which are treated as public and skip access-control checks. A public technical writeup describing the flaw exists; it is not listed in CISA KEV and the EPSS probability is low (0.18%, 8th percentile), indicating no evidence of widespread automated exploitation yet despite the critical 9.8 CVSS rating.
Heap-based buffer overflow in Das U-Boot (the Denx universal embedded bootloader) before 2026.04 allows an attacker who controls an ext4 filesystem image to trigger an integer overflow in the ext4fs_get_bgdtable() block-group descriptor table size calculation, resulting in an undersized allocation that is later overrun by memcpy(). Successful exploitation can lead to arbitrary code execution in the highly privileged pre-OS boot context, denial of service, or memory corruption. No public exploit identified at time of analysis (a referenced GitHub gist may contain a proof-of-concept but is unverified), EPSS is low at 0.18% (7th percentile), and it is not listed in CISA KEV.
Remote code execution in AntFlow V2.0.0 arises because the ActivitiTest.java handler evaluates attacker-supplied JUEL (Java Unified Expression Language) expressions without any input filtering, letting an attacker run arbitrary Java code and operating-system commands on the host. The affected component is described as a front-desk (pre-authentication) endpoint, so exploitation appears to require no valid account. Publicly available exploit code exists via a GitHub write-up, though EPSS remains low (0.17%, 7th percentile) and it is not on CISA KEV.
Memory corruption in Das U-Boot's ZFS filesystem driver (all releases before 2026.04) lets an attacker who controls the on-disk ZFS metadata trigger an integer overflow (CWE-190) that leads to undersized allocation and out-of-bounds access, enabling a boot-time crash or arbitrary code execution in the pre-OS bootloader context. Rated CVSS 9.8 by the reporter, but the flaw is reached only when U-Boot parses attacker-supplied ZFS storage during boot, so realistic exploitation is local/physical rather than network-borne. EPSS is low (0.17%, 7th percentile) and there is no confirmed active exploitation.
Unauthenticated configuration disclosure in Baidu disconf 2.6.36 lets any anonymous network attacker read every configuration item and file managed by the config center. The LoginInterceptor whitelists four config-fetching endpoints (/api/config/item, /api/config/file, /api/config/list, /api/config/simple/list), bypassing authentication entirely. SSVC records a public proof-of-concept and full technical impact; EPSS is currently low (0.17%, 6th percentile), and there is no public exploit identified as actively exploited in the wild.
Unauthenticated configuration disclosure in SuperDiamond (super-diamond-server) versions 1.3.3 and earlier exposes the Netty-based configuration distribution service on TCP port 8283 without any authentication mechanism. Any remote attacker who can reach the port can send a raw TCP request and retrieve the complete configuration of any managed project, including database passwords and API keys. A public write-up exists but there is no public exploit identified as weaponized tooling, and the flaw is not in CISA KEV; EPSS is low at 0.17% (6th percentile).
Denial-of-service (and potential memory corruption) in the Stomper STOMP message broker (commit 5e2741e) lets remote attackers crash the broker process by abusing frame sequencing. By opening a connection that sends multiple CONNECT frames and subscribes a destination, then having another client SEND to that destination, an attacker triggers a heap use-after-free on a freed StompStreamSocket object. A public proof-of-concept write-up exists (no confirmed active exploitation), and because the protocol path requires no authentication by default, exploitation is straightforward against exposed instances.
SQL injection in the smart-web2 v1.3.1 backend report module lets attackers execute arbitrary SQL because the sqlResource.sql parameter, saved via ReportController.save() into the t_report_sql_resource table, is concatenated directly into Hibernate native queries without parameterization or filtering. Any actor able to reach the report-save interface can read, modify, or destroy database contents. No CISA KEV listing exists and EPSS is low (0.15%), but a public write-up detailing the flaw is available on GitHub.
Remote code execution in Cohere North AI v1.1.5 arises from an arbitrary file upload flaw in the /v1/my_drive/batch_upload endpoint, where insufficient validation of uploaded file type/content lets an attacker place a malicious file that the server subsequently executes. The affected component is part of Cohere's North enterprise AI knowledge platform, and successful exploitation yields full compromise of confidentiality, integrity, and availability. No public exploit is identified in the intelligence feeds, though a third-party technical write-up exists on GitHub; EPSS is low (0.15%, 5th percentile), indicating limited observed exploitation activity to date.
Unauthenticated SQL injection in Mingsoft MCMS versions 6.2.0 and earlier lets remote attackers inject arbitrary SQL through the size parameter of the front-end /cms/category/list endpoint. The parameter is rendered directly into the query's LIMIT clause via the FreeMarker expression ${size} without parameter binding, and the built-in SqlInjectionUtil blacklist omits CREATE/TABLE/SET/PREPARE/EXECUTE, so its filter is bypassable and stacked queries execute. No login is required; publicly available exploit/write-up code exists, though EPSS remains low (0.15%) and there is no public exploit identified as weaponized beyond the researcher proof-of-concept.
Sensitive-data exposure in Cohere North AI v1.1.5 stems from the server accepting cross-origin requests without validating the Origin header, letting any untrusted website read authenticated API responses in a victim's browser. Affects the North enterprise AI platform; tagged as CORS misconfiguration / information disclosure. No public exploit or active exploitation is identified, and EPSS is low (0.14%, 4th percentile), though the NVD-published CVSS of 9.8 likely overstates real-world impact.
SQL injection in Funiture 1.0.0 lets remote unauthenticated attackers manipulate backend database queries through the /sys/tool/select.json and /sys/tool/update.json tool-management endpoints (CWE-89). Publicly available exploit code exists (a GitHub write-up and VulDB entry), though the flaw is not listed in CISA KEV and its EPSS probability is low (0.14%, 4th percentile), suggesting no widespread automated exploitation yet despite a CVSS of 9.8.
SQL injection in super-diamond-server (versions <= 1.3.3) lets remote attackers manipulate backend database queries via the front-end preview endpoint /superdiamond/preview/{projectCode}/{module}/{type}. The module path parameter is split with StringUtils.split() and concatenated directly into a SQL IN clause without parameterization, giving unauthenticated attackers (per CVSS PR:N) a path to read, alter, or destroy configuration data. Publicly available exploit code exists (referenced write-up), though EPSS remains low at 0.14% and there is no evidence of active exploitation.
Arbitrary file upload in DocSys-master V2.02.85 lets remote attackers upload malicious files through the uploadMarkdownPic interface in DocController.java, bypassing intended image-only restrictions on the Markdown picture-upload endpoint. Because a webshell or other executable payload can be written into a web-accessible path, this can escalate to full server compromise and remote code execution. Publicly available exploit code exists (a GitHub write-up with reproduction steps); it is not listed in CISA KEV and EPSS is low (0.14%, 4th percentile), indicating no evidence of widespread automated exploitation yet.
Out-of-bounds kernel memory read in the Linux kernel's libceph client (decode_watchers()) lets a malicious or compromised Ceph OSD trigger a 4-byte read past a validated buffer when it returns an obj_list_watch_response_t reply with struct_len=0. Any kernel client issuing CEPH_OSD_OP_LIST_WATCHERS is affected; the leaked garbage value is then used as a watcher count for allocation, risking information disclosure or unstable allocation behavior. Tagged as Information Disclosure with no public exploit identified at time of analysis and no CISA KEV listing, despite an NVD CVSS of 9.8.
A use-after-free / lifetime race in the Linux kernel's ovpn (in-kernel OpenVPN data-channel offload) module lets crypto completion callbacks outlive the peer and netdev they depend on. Because the callback holds both key-slot and peer references, dropping the last peer reference too early can schedule an RCU callback backed by already-freed module text after ovpn_cleanup's rcu_barrier has run, corrupting kernel memory during peer teardown or module removal. There is no public exploit identified at time of analysis, and despite the input's 9.8 CVSS this is a teardown-path race, not a remote unauthenticated RCE.
Unrestricted file upload in the wedevs WP ERP plugin (ERP: Complete HR, Accounting & CRM Suite for WooCommerce) for WordPress, in all versions through 1.17.8, allows unauthenticated attackers to write attacker-controlled PHP into wp-content/uploads/ via the save_attachments() function when the CRM IMAP Email Connect feature parses inbound email attachments. Because file extension validation and path normalization are both missing, a crafted email with a forged References header and a path-traversal filename escapes the .htaccess-protected crm-attachments directory, enabling remote code execution on hosts where PHP executes in the uploads directory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS base score of 9.8 reflects the unauthenticated, network-reachable nature of the flaw.
Remote code execution in Ubiquiti EdgeMAX EdgeSwitch devices allows an attacker on an adjacent network to fully compromise the switch by exploiting a heap-based buffer overflow in its DHCPv6 handling. The flaw affects EdgeSwitch units that have DHCPv6 enabled and requires no authentication or user interaction, only Layer 2/link-local reachability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.6 rating and network-daemon attack surface make it a high-priority patching target.