Remote code execution in the Silverstripe userforms module allows any authenticated CMS author to inject PHP into the email recipient's subject field, which is evaluated server-side by the Silverstripe template engine during form submission email dispatch. Affected are composer package silverstripe/userforms versions below 6.4.9, 7.0.0-7.0.6, and 7.1.0, all of which pass the EmailSubject field through the template parser without sanitizing PHP-bearing localization tags. No CISA KEV listing and no standalone public exploit exist at time of analysis, though the patch PR documents the exact payload format, materially lowering the exploitation barrier for any attacker holding CMS credentials.
go-wind-cms (GoWind) before 1.0.0 exposes all administrative APIs to any authenticated user because NewAuthorizer() returns a no-operation authorization engine (noop.State{}), rendering the authz middleware completely inert. Any account holder - regardless of assigned role or tenant membership - can invoke privileged operations including user deletion, password resets, and tenant creation. A publicly available proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated remote code execution in Unitree G1 EDU firmware through 1.5.2 allows any network-adjacent attacker to gain a root shell on the robot by chaining three design flaws without credentials or user interaction. The attack exploits an open WebRTC-to-DDS bridge on TCP port 9991, a hardcoded world-readable AES-128 key, and a path traversal flaw in the chat_go knowledge upload API to plant and execute arbitrary scripts as uid 0 via the bashrunner service. Publicly available exploit code (UniBLEed on GitHub) and a full technical writeup confirm reliable exploitation; no KEV listing has been observed, but the adjacent-network vector makes this a real priority for any institution operating these robots on shared campus or lab networks.
Command injection in luci-app-https-dns-proxy on OpenWrt allows authenticated web-interface users to execute arbitrary shell commands on the router as the rpcd service account (typically root) by supplying shell metacharacters in the name parameter to the setInitAction RPC endpoint. The vulnerability exists in versions preceding the 2026-01-17 PR #15 fix across both the stangri and mossdef-org forks. A public exploit repository is available, though EPSS remains low (0.18%) and no CISA KEV listing exists, suggesting limited observed in-the-wild exploitation at time of analysis.
Server-Side Request Forgery (SSRF) in GitLab AI Gateway allows authenticated users with Duo Agent Platform access to exfiltrate Google Vertex AI or AWS Bedrock cloud service credentials by injecting a malicious endpoint into crafted model metadata, causing the gateway to proxy requests - including cloud credentials - to an attacker-controlled server. All AI Gateway releases from 18.9.0 through 19.2.2 are affected across three version branches; GitLab has confirmed remediation. A public exploit exists per the HackerOne reference, and the CVSS Scope Change metric (S:C) reflects that successful exploitation extends compromise to external cloud infrastructure beyond the GitLab instance itself.
Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or delete arbitrary files as root by injecting directory traversal sequences into the srcip field of alert-triggering log events. Versions prior to 4.14.7 are affected when ip-customblock is configured as an active response - the block action creates an empty file at an attacker-controlled path, while the unblock action deletes it, both executing as root and enabling destruction of credentials, configuration, or other critical files. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though the missing validation is trivially observable by comparing ip-customblock.c against its sibling scripts.
Root code execution in Unitree G1 EDU robot firmware through version 1.5.2 is achievable by proximate unauthenticated attackers via a chained BLE GATT and WiFi provisioning exploit requiring no pairing or credentials. Crafted BLE writes overflow a fixed BSS buffer in the SSID chunk accumulator, corrupting an adjacent mainloop function pointer dispatch entry; the cleanup path subsequently invokes this corrupted pointer, passing attacker-controlled data to system() as uid 0. A public proof-of-concept (UniBLEed) is available, and the CVSS 4.0 score of 7.7 reflects the adjacent attack vector and high complexity of the exploit chain.
Use-after-free in Redis's TLS pending-data handler (`tlsProcessPendingData()`) enables remote attackers to potentially execute arbitrary commands at the privilege level of the Redis server process. The flaw spans all major active Redis release lines and is confirmed fixed in versions 6.2.24, 7.2.16, 7.4.11, 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1 - exploitation is gated on TLS being explicitly configured, which is non-default. A public proof-of-concept exists; SSVC rates technical impact as total but automation as not feasible, and the vulnerability is not currently listed in CISA KEV.
Path traversal in Lektor's built-in preview and development HTTP server on Windows exposes arbitrary files to unauthenticated network attackers in all versions prior to 3.3.14. Crafted HTTP requests containing path traversal sequences exploit Windows-specific path separator handling to escape the configured web root and read any file accessible to the Lektor process, including system files and deployment configuration files that may contain credentials. A public proof-of-concept exploit is available; no confirmed active exploitation via CISA KEV has been recorded.
Remote code execution in the Silverstripe Advanced Workflow module allows high-privileged authenticated CMS users to execute arbitrary PHP on the server by injecting a crafted payload into the workflow email template field. The vulnerability affects the `symbiote/silverstripe-advancedworkflow` Composer package across three version lines, with patches released as 6.4.5, 7.1.3, and 7.2.1. No public exploit tool or CISA KEV listing exists at time of analysis, but the GitHub Security Advisory (GHSA-39mm-rwm3-29jp) and accompanying PR test case explicitly document the injection technique, lowering the reproduction barrier for any attacker who reads the advisory.
SQL injection in YzmCMS 7.5 exposes the full database to authenticated administrators who supply a crafted parentid parameter to the category management interface. The flaw arises from unsanitized string concatenation inside a FIND_IN_SET() SQL clause within the get_arrchildid() function, enabling boolean-based blind injection that can enumerate and exfiltrate the entire database. A public proof-of-concept exists on GitHub; however, EPSS at 0.15% (4th percentile) and the absence of a CISA KEV listing indicate no confirmed widespread exploitation at time of analysis.
OS command injection in ZoneMinder's event export functionality enables any authenticated user holding the View Events permission to execute arbitrary commands on the underlying server. The exportFile HTTP request parameter is passed without sanitization into PHP's exec() function, granting attackers full control over server-side command execution. Reported by ICS-CERT under ICSA-26-237-02 and tracked in GitHub Security Advisory GHSA-88m4-hrgp-m9v3, the flaw carries a CVSS 4.0 score of 8.7 across all current ZoneMinder versions, with no public exploit identified at time of analysis.
Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who controls a monitored log source to inject arbitrary arguments into firewall and account-management commands executing as root. Five scripts handling the srcip alert field (route-null.c, netsh.c, pf.c, npf.c, ipfw.c) omit IP format validation, and disable-account.c passes the dstuser field to passwd/chuser with only a root-name check, enabling injection into pfctl, npfctl, ipfw, route, netsh, and passwd. On Windows, unquoted CreateProcess concatenation in wpopenv() amplifies the impact by allowing space-delimited srcip values to append additional process arguments. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Cluster secret exposure in Wazuh 4.14.0-4.14.6 stems from a logic inversion in the RBAC masking gate that counterintuitively makes hardened accounts more exposed than default ones. Any authenticated low-privilege user whose role includes an explicit DENY on config-update actions can issue a single GET request to the manager configuration API with `raw=true` and receive the full `ossec.conf` XML with `cluster.key` in cleartext - because the broken gate treats the mere presence of a deny-rule entry as proof of update permission, disabling masking entirely. No public exploit has been identified at time of analysis, but the fix is available in 4.14.7 and the root cause is confirmed by vendor advisory and merged commit.
OS command injection in the Xiiaozet LK100W web-based management interface enables network-accessible, low-privilege authenticated attackers to execute arbitrary operating system commands with elevated privileges, resulting in potential full device compromise. Reported by ICS-CERT under advisory ICSA-26-239-01 and scored CVSS 4.0 at 8.7 (High), this is an OT/industrial device vulnerability with high confidentiality, integrity, and availability impact to the vulnerable system. No public exploit code or CISA KEV listing has been identified at time of analysis; however, an 'Authentication Bypass' tag in the source data introduces uncertainty about whether the effective exploitation prerequisite is lower than the PR:L CVSS metric indicates.
Unauthenticated access to PayRange API management endpoints exposes verbose device details for every device on the PayRange network, exploitable with or without a registered account. Classified under CWE-862 (Missing Authorization) and reported by CISA ICS-CERT as advisory ICSA-26-237-04, the flaw affects all tracked versions of the PayRange API with a CVSS 4.0 score of 8.7 reflecting high impact across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, though the network-accessible nature and low attack complexity make this a low-effort target for reconnaissance against PayRange-managed payment infrastructure.
Unauthorized administrative access in Ebyte NE2-D11 firmware is possible because the device delegates authentication state entirely to the client, performing no meaningful server-side token validation. An unauthenticated remote attacker can replay or forge authentication tokens to elevate access to administrative functionality without valid credentials. Reported via ICS-CERT advisory ICSA-26-237-06, this is an OT/ICS device vulnerability with no public exploit identified at time of analysis and no KEV listing.
Unrestricted authentication attempts in Ebyte NE2-D11 firmware expose password-protected deployments to automated brute-force credential attacks. The device, classified as an industrial OT product and covered by ICS-CERT advisory ICSA-26-237-06, lacks both rate limiting and account lockout controls - two standard defenses against credential guessing. A remote unauthenticated attacker who successfully brute-forces the login interface gains high-confidence read access to device configuration and data, reflected in the CVSS 4.0 VC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote access to configuration endpoints in the Ebyte NE2-D11 industrial wireless module firmware allows any network-reachable attacker to read or overwrite sensitive device settings due to missing server-side authorization (CWE-862). The CVSS 4.0 vector (PR:N/AV:N/AC:L) confirms no credentials or special conditions are needed, and full device configuration compromise is possible. Reported via CISA ICS-CERT advisory ICSA-26-237-06; no public exploit code or active KEV-listed exploitation is confirmed at time of analysis.
Cleartext transmission of authentication and session credentials in the Ebyte NE2-D11 gateway web management interface exposes credentials to any attacker capable of intercepting network traffic between a user and the device. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) reflects that no authentication is required on the attacker side - only network traffic access is needed to harvest management credentials, which then enable full unauthorized access to device management functionality. Reported by CISA ICS-CERT under advisory ICSA-26-237-06, this vulnerability affects OT/industrial gateway hardware where flat network topologies are common, elevating realistic exploitation risk beyond typical enterprise environments. No public exploit identified at time of analysis and no CISA KEV listing.
Cross-site request forgery in the Ebyte NE2-D11 firmware's web management interface allows an unauthenticated remote attacker to trigger unauthorized configuration changes or disrupt device availability on ICS/OT networking hardware. The attack requires social engineering an authenticated administrator into visiting a malicious webpage, at which point the administrator's browser silently submits forged requests to the management interface. Reported by ICS-CERT under advisory ICSA-26-237-06, all known firmware versions are affected with no confirmed patched release identified at time of analysis, and no public exploit or CISA KEV listing has been observed.
Stack-based buffer overflow in the Bendix EC80ESP brake ECU family enables adjacent-network attackers to crash the ECU or achieve remote code execution and arbitrary CAN bus traffic injection via a crafted payload. All known variants across both EC80ESP and EC80ESP+ product lines are affected, including J1708, 6S/6M, PLC, 2nd CAN, integrated TPMS, CAN Gateway, and 4S/4M configurations deployed on commercial vehicles. Successful exploitation could disable safety-critical functions including ABS, steering assist, speedometer, and automatic gear shifting. No public exploit has been identified at time of analysis; the flaw was disclosed by CISA ICS-CERT.
CodeMeter Runtime before versions 8.41a and 9.10, when configured as a server, exposes its configuration command handler to arbitrary remote peers due to absent network-origin restrictions. Unauthenticated remote attackers (PR:N per CVSS) can read sensitive configuration data and overwrite values in Server.ini, most critically the WebAdmin credential hash, enabling full WebAdmin account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 8.6 rating and PR:N attack vector make this a genuine priority for any organization running CodeMeter in server mode.
Unauthenticated reboot and factory-reset of Ebyte NE2-D11 gateways is possible from the adjacent network when default credentials have not been changed. The vendor configuration utility (CWE-306) enforces no authentication gate on high-impact administrative actions under that condition, allowing an attacker with LAN access to erase device configuration and cause sustained service outages. Reported by ICS-CERT via advisory ICSA-26-237-06; no public exploit identified at time of analysis and no active exploitation confirmed.
Out-of-bounds write across all Bendix EC80ESP Brake ECU variants enables an unauthenticated attacker with adjacent vehicle-network access to deliver a crafted payload that establishes an arbitrary write primitive, crashing the safety-critical brake Electronic Control Unit. Reported by ICS-CERT and documented in CISA advisory ICSA-26-237-05, all ten identified EC80ESP hardware configurations are affected with no version constraint specified in the CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the safety implications of a crashed brake ECU demand prioritized attention by fleet operators beyond what the base score alone conveys.
Remote code execution is possible in Silicon Labs Bluetooth Mesh SDK 6.1.4 and earlier through malformed Bluetooth extended advertisements that trigger out-of-bounds writes and stack corruption. The vulnerability is reachable only from devices already provisioned into the target mesh network, and only on provisioner nodes that have enabled extended advertisement support. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 base score of 8.9 reflects the high impact if exploitation conditions are met.
PHP Object Injection in the Booking and Rental Manager WordPress plugin (by magepeopleteam, versions <= 2.7.5) allows an authenticated contributor-level user to pass malicious serialized payloads through unsanitized input handled by the plugin. If a PHP Property-Oriented Programming (POP) chain is present in the WordPress environment - commonly supplied by WooCommerce or co-installed plugins - exploitation can yield full confidentiality, integrity, and availability compromise of the underlying server. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA Known Exploited Vulnerabilities catalog.
Path traversal via unsanitized MIME attachment filenames in Dolibarr's EmailCollector module allows any email sender to write attacker-controlled files outside the intended attachment directory, affecting versions 9.0.0 through 23.0.4. Because the EmailCollector is designed to ingest mail from unauthenticated external senders - such as a support or ticket inbox - no Dolibarr account is required to exploit this flaw. On hardened deployments with a read-only htdocs tree, the attacker can corrupt or forge documents belonging to other objects; on installations where htdocs is writable, the same write primitive reaches web-executable PHP paths, enabling remote code execution. No public exploit identified at time of analysis.
Unauthenticated remote destruction of pending-deletion accounts is possible in APITable through 1.13.0-beta.1, where two internal user-management endpoints are reachable by any network client without credentials. The InternalUserController annotates both getUserHistories and closePausedUserAccount with requiredLogin = false, causing ResourceInterceptor to skip all session and API-key validation; the bundled nginx gateway forwards every /api request to the backend, giving external attackers a direct path. An attacker can enumerate accounts in the 30-day deletion cooling-off window and then permanently destroy each one - wiping PII, cancelling subscriptions, removing space memberships, and revoking OAuth bindings - with no possibility of recovery. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in V8, Chrome's JavaScript engine, enables remote code execution confined within the renderer sandbox on all platforms running Chrome prior to 151.0.7922.72. The flaw is triggered by a specially crafted HTML page, requiring only that a user visit a malicious site - no authentication or elevated privileges are needed from the attacker. No public exploit code has been identified and no active exploitation is confirmed; EPSS probability stands at 0.30%, aligning with SSVC's 'exploitation: none' classification despite the high CVSS score.
Error-based SQL injection in Toools iSquad's `/ws/apitribuna/ultimosVideos` API endpoint enables unauthenticated remote attackers to manipulate MariaDB queries and extract sensitive database contents. The `limit_videos` parameter is concatenated unsanitized into the SQL query, a textbook CWE-89 flaw. The application returns database error messages and stack traces on injection, exposing schema details and backend implementation specifics. No active exploitation is confirmed (not in CISA KEV) and no public POC has been identified, but the unauthenticated network vector with high confidentiality impact warrants prompt remediation.
SQL injection in Toools Isquad's '/ws/apiprensa/getVideo' endpoint exposes the MariaDB backend to unauthenticated remote attackers who can manipulate the 'id_ambito' GET parameter. Direct string concatenation of user input into SQL statements - without parameterized queries - causes query structure breakage and leaks raw PDOException error messages, actively confirming exploitability and revealing database schema details. No public exploit is identified at time of analysis, but INCIBE has documented this as one of multiple vulnerabilities in this product and a vendor patch is available.
Insufficient input validation in Spring Security's OAuth2 Authorization Server module (versions 7.0.0-7.0.4) allows an attacker holding a valid Initial Access Token to register a malicious OAuth2 client with crafted metadata fields via the Dynamic Client Registration endpoint. Depending on server configuration and how the metadata is subsequently rendered or fetched, the impact spans Stored XSS (targeting administrator sessions), Privilege Escalation (through insufficiently constrained scopes or grant types), or SSRF against internal infrastructure. No public exploit code or CISA KEV listing exists at time of analysis, but the SSVC framework rates the technical impact as total, warranting priority remediation for any deployment with Dynamic Client Registration explicitly enabled.
WibuKey64.sys kernel-mode driver in Wibu-Systems WibuKey up to version 6.70 for Windows allows a local, low-privileged attacker to trigger memory boundary violations by supplying out-of-scope pointer values, with outcomes ranging from denial of service (BSOD) to full SYSTEM-level privilege escalation via kernel code execution. The CVSS Scope:Changed metric reflects the critical boundary crossing from user-space into the driver's SYSTEM-privileged kernel context, meaning successful exploitation yields complete machine control from an unprivileged account. No public exploit has been identified at time of analysis and WibuKey has not been listed in the CISA KEV catalog, but the low attack complexity makes this a high-value local privilege escalation primitive for post-compromise chains.
Unrestricted file upload in the Workeera WordPress plugin before version 1.0.6 permits any subscriber-level user to upload arbitrary files - including PHP webshells - to a publicly accessible server directory via the candidate profile submission flow, achieving remote code execution. The plugin neither restricts which profile field values candidates may submit nor validates the file type before writing to the web root, mapping directly to CWE-434. No active exploitation is confirmed (CISA KEV absent, SSVC Exploitation: none), and EPSS sits at a low 0.19%, though the minimal privilege barrier makes this acutely dangerous on any multi-user WordPress job board with open registration.
Cross-Site Request Forgery in the GeoDirectory WordPress plugin (versions ≤ 2.8.176) enables remote unauthenticated attackers to perform privileged administrative actions on affected WordPress sites by tricking an authenticated user into visiting a malicious page. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact within the affected system once the victim's browser submits the forged request. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed and confirmed by Patchstack.
Stored Cross-Site Scripting in the 12 Step Meeting List WordPress plugin (versions 3.17 through before 3.19.17) allows unauthenticated remote users to inject persistent JavaScript payloads via unsanitized input that is stored in the plugin's activity log and rendered in the WordPress admin area. When a privileged user such as a site administrator views the activity log, the injected script executes in their browser session, enabling potential account takeover, unauthorized admin actions, or credential theft. No public exploit has been identified at time of analysis, and EPSS is very low (0.17%, 7th percentile), though SSVC assesses technical impact as total if exploitation is achieved.
Local privilege escalation in WibuKey for Windows before 6.71 allows any low-privileged local user to gain full SYSTEM-level control by exploiting a write-what-where primitive in the WibuKey2_64.sys kernel driver. The root cause is an untrusted pointer dereference (CWE-123) in the 64-bit kernel driver, meaning attacker-controlled data is used directly as a kernel-space pointer, enabling arbitrary writes into kernel memory - a classic and highly reliable LPE primitive. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Missing authorization on the /storage/upload endpoint in cjbi admin3 v3.0.0 permits any authenticated user - regardless of role or privilege level - to upload arbitrary files to the server. Compounding this, the storage endpoint exposes uploaded files for unauthenticated anonymous download, creating a two-stage attack surface: an authenticated insider or low-privilege account uploads a malicious payload, which any external anonymous actor can then retrieve. No public exploit identified at time of analysis beyond researcher documentation on GitHub, and EPSS sits at 0.15% despite the high CVSS score, indicating limited observed exploitation at this time.
Stack buffer overflow in Greenbone's OpenVAS Scanner and Greenbone OS allows a remote attacker holding user-level privileges to achieve full system compromise by supplying a malicious or compromised NASL vulnerability test (VT). Both the Greenbone OS platform and the openvas-scanner engine are confirmed affected, making this a meaningful risk in any multi-user GVM deployment or environment where user accounts may be compromised. No public exploit code has been identified at time of analysis, but the network-accessible, low-complexity attack vector and high-impact outcome place this in the immediate patching tier for production scanner infrastructure.
Symlink-following in the openssl-encrypt pip package (jahlives/openssl_encrypt) before 1.4.9 allows an evil-maid attacker with physical access to a target USB drive to bypass the verify-usb v2 integrity check and achieve code execution on the victim's machine. The attacker replaces a tool-tree directory with a symlink to a crafted copy that includes byte-identical visible source files and a planted __pycache__/*.pyc compiled bytecode file; CPython's rglob() does not enumerate symlinked directory contents, so the planted file is never counted, verify-usb reports PASSED, and the malicious bytecode executes when the victim launches the portable install. No public exploit has been identified at time of analysis, and the attack is gated behind physical drive access and victim interaction.
Uncontrolled memory allocation in jahlives/openssl_encrypt before 1.4.9 enables remote, unauthenticated denial of service by processing crafted encrypted files with arbitrarily large Argon2, scrypt, or balloon KDF cost parameters. Any application that passes attacker-controlled encrypted files or keystore data to this library can be crashed without requiring credentials, as the library performs no upper-bound validation on memory-hard KDF parameters before allocating the specified memory. No public exploit has been identified at time of analysis and it does not appear in CISA KEV, but the low attack complexity (AV:N/AC:L/PR:N/UI:N) makes exploitation straightforward wherever untrusted encrypted input reaches the library.
Arbitrary code execution in SpeechBrain before v1.1.1 is triggered during checkpoint candidate enumeration when PyYAML's unsafe loader parses attacker-controlled CKPT.yaml files in the configured checkpoint path. An attacker who can plant a crafted CKPT.yaml - for example via a malicious pretrained model distributed through a public model repository - can embed !!python/object/apply YAML tags that cause Python to instantiate arbitrary objects at parse time, achieving code execution before any checkpoint is ever selected for recovery. No public exploit specific to this CVE has been identified at time of analysis, and it is not listed in the CISA KEV catalog, but the underlying PyYAML unsafe deserialization class is extensively documented and exploit techniques are widely known.
Pre-authentication denial-of-service in jahlives/openssl_encrypt before 1.4.9 allows unauthenticated network attackers to exhaust server memory and CPU by supplying crafted files with arbitrarily large key derivation function cost parameters, crashing or permanently wedging the process before any password verification occurs. The attack requires no credentials and no user interaction, making it trivially automatable against any service that accepts attacker-supplied encrypted files as input. No public exploit code has been identified at time of analysis, and the library's niche footprint limits broad internet exposure despite the low-complexity attack vector.
CPU-pinning denial of service in NLTK's PorterStemmer component (versions ≤ 3.10.2) allows a remote unauthenticated attacker to exhaust a CPU core for seconds to minutes by submitting a single crafted token. The root cause is quadratic algorithmic complexity: _is_consonant() re-walks trailing 'y' characters on every invocation, and _measure() calls it once per stem position, resulting in O(n²) processing time. Any service that passes untrusted text through PorterStemmer.stem() without input length validation is vulnerable; a ~20-50 KB payload of repeated 'y' characters followed by a matching suffix such as 'ness' is sufficient to trigger the condition. No public exploit code is identified at time of analysis, but the attack primitive is trivially constructable from the public description. Fix is available in NLTK 3.10.3.
Uncontrolled memory allocation in the jahlives openssl_encrypt PHP library (versions before 1.4.9) exposes any application processing QR codes to remote denial of service. The library fails to validate the 'total' field within QR JSON payloads before allocating memory for range materialization, allowing an unauthenticated attacker to supply a crafted QR image containing an arbitrarily large 'total' value and exhaust host memory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is low-complexity and requires no authentication, making automated exploitation plausible against any internet-facing service that accepts QR input.
Uncontrolled memory allocation in the openssl-encrypt Python package (pip, versions ≤1.4.8) exposes any service invoking its `decrypt --stego-extract` command to unauthenticated denial of service via a crafted FLAC file. The STREAMINFO total_samples field - a 36-bit value fully controlled by the file author - is passed without bounds validation directly to NumPy as an array dimension, causing allocations of tens of gigabytes from a ~50-byte input. A vendor-released patch exists in version 1.4.9; no public exploit code has been identified at time of analysis, though the attack requires no authentication and minimal complexity.
Cleartext password leakage in openssl-encrypt before 1.4.9 exposes file encryption credentials in debug output when passwords are supplied via bundled short-option or abbreviated long-option argument forms. The tool's sanitizer, which is designed to redact sensitive arguments before writing the argv dump to stderr, fails to recognize spellings like -apHunter2 (bundled short option) or --passw (abbreviated long option), causing the raw password to appear in terminal scrollback, CI job logs, and persistent GUI debug logs. No public exploit identified at time of analysis; the vulnerability is trivially exploitable by any party with read access to the affected log output.
Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated attacker to crash VPN processing via specially crafted network traffic, causing a denial-of-service condition on affected Firebox appliances. Any Firebox with IPsec VPN exposed to untrusted networks is at risk across an unspecified range of Fireware OS versions. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with network-accessible, zero-authentication exploitation reflects meaningful operational urgency for perimeter security devices.
Remote unauthenticated denial-of-service in WatchGuard Fireware OS targets the iked process, which handles IKE-based VPN session negotiation. By sending specially crafted network packets to the IKE service, an attacker can trigger an integer underflow in iked, crashing VPN processing and disrupting all VPN-dependent connectivity without any authentication. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.