Unauthenticated remote code execution affects mims-harvard ToolUniverse through 1.2.6, where the python_code_executor tool runs caller-supplied Python in a sandbox that can be escaped and the HTTP/MCP servers listen on all interfaces with no authentication. Any attacker who can reach the exposed port executes arbitrary code as the server process, since the deny-list source inspection can be bypassed via dunder attribute traversal and a per-call flag that widens the import allow-list. No public exploit code is identified at time of analysis, but the flaw is reported by VulnCheck and carries a CVSS 4.0 base score of 9.3; it is fixed in version 1.3.0.
Missing authentication on the mcp-router CLI's MCP aggregator exposes every backend MCP server it fronts to any network-reachable attacker. In releases before 0.6.3, the `serve` command bound to the all-interfaces address (0.0.0.0) on fixed port 3283 by default and only enforced a token when the operator explicitly passed the `--token` flag, so a normal `mcpr-cli serve ...` invocation published the aggregator unauthenticated to the entire network. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit code or active-exploitation reporting is identified at time of analysis.
OS command injection in Liman server management software (limanmys/core) before version 2.2.2 - 1103 lets an authenticated administrator run arbitrary operating-system commands on the host via the log rotation configuration endpoint. The unsanitized `ip_address` parameter is concatenated into a shell command, allowing single-quote shell-escape to break out and execute attacker-controlled commands. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed in 2.2.2 - 1103.
Unauthenticated reboot and factory-reset of Ebyte NE2-D11 gateways is possible from the adjacent network when default credentials have not been changed. The vendor configuration utility (CWE-306) enforces no authentication gate on high-impact administrative actions under that condition, allowing an attacker with LAN access to erase device configuration and cause sustained service outages. Reported by ICS-CERT via advisory ICSA-26-237-06; no public exploit identified at time of analysis and no active exploitation confirmed.
Arbitrary file upload in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) lets a user holding the Editor role (or higher) upload files of dangerous types, typically leading to web shell placement and remote code execution on the host. The flaw carries a CVSS 9.1 rating driven by a scope-changed, full-CIA-impact chain, but requires an authenticated privileged account. No public exploit or active-exploitation evidence is present in the supplied data; the issue was catalogued by Patchstack.
Persistent session hijacking is possible in Flowintel version 3.3.0 and later because the application fails to invalidate existing authenticated sessions when a user changes their password. An attacker who already holds a valid session token (from prior access or theft) keeps full authenticated access to the account even after the victim resets the password, since the old session remains usable until natural expiry. No public exploit has been identified at time of analysis, and the issue is not in CISA KEV; a vendor fix commit exists.
Improper authorization in Spring Security's embedded UnboundID test LDAP server (UnboundIdContainer) exposes an administrative directory account to the network: the container unconditionally registers an admin credential and binds its listener to all local interfaces (0.0.0.0) rather than loopback. Affected releases span 5.7.0-5.7.25, 5.8.0-5.8.27, 6.4.0-6.4.18, 6.5.0-6.5.11, 7.0.0-7.0.6 and 7.1.0; any application that instantiates this container becomes reachable by remote unauthenticated clients that can then read and modify directory contents using the known admin bind. No public exploit has been identified, and EPSS is low (0.29%, 21st percentile).
Out-of-bounds write across all Bendix EC80ESP Brake ECU variants enables an unauthenticated attacker with adjacent vehicle-network access to deliver a crafted payload that establishes an arbitrary write primitive, crashing the safety-critical brake Electronic Control Unit. Reported by ICS-CERT and documented in CISA advisory ICSA-26-237-05, all ten identified EC80ESP hardware configurations are affected with no version constraint specified in the CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the safety implications of a crashed brake ECU demand prioritized attention by fleet operators beyond what the base score alone conveys.
Safety-guard bypass in the Spring Framework SpEL engine (VMware/Broadcom) lets attacker-controlled expression input escape the restricted SimpleEvaluationContext sandbox when the SpEL bytecode compiler is active, affecting Spring Framework 5.2.x through 7.0.8 across the 5.3, 6.0, 6.1, 6.2 and 7.0 lines. Because SimpleEvaluationContext is the API applications are told to use to safely evaluate untrusted expressions, this bypass can escalate a data-binding-only context into broader method invocation with high integrity and availability impact (CVSS 9.1, CWE-913). There is no public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), indicating no observed mass exploitation yet.
Arbitrary file deletion in Veno File Manager (VFM) 4.4.9 lets attackers destroy files outside the intended scope by supplying a crafted path in the `remove=` parameter of the translations-update handler (/vfm-admin/index.php?section=translations&action=update). Because path traversal is not neutralized, an attacker can delete configuration, application, or user files anywhere the web server has write access, enabling denial of service, defacement, or removal of security-relevant files. Publicly available exploit code exists (GitHub PoC), though EPSS remains low (0.16%) and the flaw is not in CISA KEV.
Remote code execution is possible in Silicon Labs Bluetooth Mesh SDK 6.1.4 and earlier through malformed Bluetooth extended advertisements that trigger out-of-bounds writes and stack corruption. The vulnerability is reachable only from devices already provisioned into the target mesh network, and only on provisioner nodes that have enabled extended advertisement support. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 base score of 8.9 reflects the high impact if exploitation conditions are met.
PHP Object Injection in the Booking and Rental Manager WordPress plugin (by magepeopleteam, versions <= 2.7.5) allows an authenticated contributor-level user to pass malicious serialized payloads through unsanitized input handled by the plugin. If a PHP Property-Oriented Programming (POP) chain is present in the WordPress environment - commonly supplied by WooCommerce or co-installed plugins - exploitation can yield full confidentiality, integrity, and availability compromise of the underlying server. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA Known Exploited Vulnerabilities catalog.
Path traversal via unsanitized MIME attachment filenames in Dolibarr's EmailCollector module allows any email sender to write attacker-controlled files outside the intended attachment directory, affecting versions 9.0.0 through 23.0.4. Because the EmailCollector is designed to ingest mail from unauthenticated external senders - such as a support or ticket inbox - no Dolibarr account is required to exploit this flaw. On hardened deployments with a read-only htdocs tree, the attacker can corrupt or forge documents belonging to other objects; on installations where htdocs is writable, the same write primitive reaches web-executable PHP paths, enabling remote code execution. No public exploit identified at time of analysis.
Unauthenticated remote destruction of pending-deletion accounts is possible in APITable through 1.13.0-beta.1, where two internal user-management endpoints are reachable by any network client without credentials. The InternalUserController annotates both getUserHistories and closePausedUserAccount with requiredLogin = false, causing ResourceInterceptor to skip all session and API-key validation; the bundled nginx gateway forwards every /api request to the backend, giving external attackers a direct path. An attacker can enumerate accounts in the 30-day deletion cooling-off window and then permanently destroy each one - wiping PII, cancelling subscriptions, removing space memberships, and revoking OAuth bindings - with no possibility of recovery. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in V8, Chrome's JavaScript engine, enables remote code execution confined within the renderer sandbox on all platforms running Chrome prior to 151.0.7922.72. The flaw is triggered by a specially crafted HTML page, requiring only that a user visit a malicious site - no authentication or elevated privileges are needed from the attacker. No public exploit code has been identified and no active exploitation is confirmed; EPSS probability stands at 0.30%, aligning with SSVC's 'exploitation: none' classification despite the high CVSS score.
Error-based SQL injection in Toools iSquad's `/ws/apitribuna/ultimosVideos` API endpoint enables unauthenticated remote attackers to manipulate MariaDB queries and extract sensitive database contents. The `limit_videos` parameter is concatenated unsanitized into the SQL query, a textbook CWE-89 flaw. The application returns database error messages and stack traces on injection, exposing schema details and backend implementation specifics. No active exploitation is confirmed (not in CISA KEV) and no public POC has been identified, but the unauthenticated network vector with high confidentiality impact warrants prompt remediation.
SQL injection in Toools Isquad's '/ws/apiprensa/getVideo' endpoint exposes the MariaDB backend to unauthenticated remote attackers who can manipulate the 'id_ambito' GET parameter. Direct string concatenation of user input into SQL statements - without parameterized queries - causes query structure breakage and leaks raw PDOException error messages, actively confirming exploitability and revealing database schema details. No public exploit is identified at time of analysis, but INCIBE has documented this as one of multiple vulnerabilities in this product and a vendor patch is available.
Insufficient input validation in Spring Security's OAuth2 Authorization Server module (versions 7.0.0-7.0.4) allows an attacker holding a valid Initial Access Token to register a malicious OAuth2 client with crafted metadata fields via the Dynamic Client Registration endpoint. Depending on server configuration and how the metadata is subsequently rendered or fetched, the impact spans Stored XSS (targeting administrator sessions), Privilege Escalation (through insufficiently constrained scopes or grant types), or SSRF against internal infrastructure. No public exploit code or CISA KEV listing exists at time of analysis, but the SSVC framework rates the technical impact as total, warranting priority remediation for any deployment with Dynamic Client Registration explicitly enabled.
WibuKey64.sys kernel-mode driver in Wibu-Systems WibuKey up to version 6.70 for Windows allows a local, low-privileged attacker to trigger memory boundary violations by supplying out-of-scope pointer values, with outcomes ranging from denial of service (BSOD) to full SYSTEM-level privilege escalation via kernel code execution. The CVSS Scope:Changed metric reflects the critical boundary crossing from user-space into the driver's SYSTEM-privileged kernel context, meaning successful exploitation yields complete machine control from an unprivileged account. No public exploit has been identified at time of analysis and WibuKey has not been listed in the CISA KEV catalog, but the low attack complexity makes this a high-value local privilege escalation primitive for post-compromise chains.
Unrestricted file upload in the Workeera WordPress plugin before version 1.0.6 permits any subscriber-level user to upload arbitrary files - including PHP webshells - to a publicly accessible server directory via the candidate profile submission flow, achieving remote code execution. The plugin neither restricts which profile field values candidates may submit nor validates the file type before writing to the web root, mapping directly to CWE-434. No active exploitation is confirmed (CISA KEV absent, SSVC Exploitation: none), and EPSS sits at a low 0.19%, though the minimal privilege barrier makes this acutely dangerous on any multi-user WordPress job board with open registration.
Cross-Site Request Forgery in the GeoDirectory WordPress plugin (versions ≤ 2.8.176) enables remote unauthenticated attackers to perform privileged administrative actions on affected WordPress sites by tricking an authenticated user into visiting a malicious page. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact within the affected system once the victim's browser submits the forged request. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed and confirmed by Patchstack.
Stored Cross-Site Scripting in the 12 Step Meeting List WordPress plugin (versions 3.17 through before 3.19.17) allows unauthenticated remote users to inject persistent JavaScript payloads via unsanitized input that is stored in the plugin's activity log and rendered in the WordPress admin area. When a privileged user such as a site administrator views the activity log, the injected script executes in their browser session, enabling potential account takeover, unauthorized admin actions, or credential theft. No public exploit has been identified at time of analysis, and EPSS is very low (0.17%, 7th percentile), though SSVC assesses technical impact as total if exploitation is achieved.
Local privilege escalation in WibuKey for Windows before 6.71 allows any low-privileged local user to gain full SYSTEM-level control by exploiting a write-what-where primitive in the WibuKey2_64.sys kernel driver. The root cause is an untrusted pointer dereference (CWE-123) in the 64-bit kernel driver, meaning attacker-controlled data is used directly as a kernel-space pointer, enabling arbitrary writes into kernel memory - a classic and highly reliable LPE primitive. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Missing authorization on the /storage/upload endpoint in cjbi admin3 v3.0.0 permits any authenticated user - regardless of role or privilege level - to upload arbitrary files to the server. Compounding this, the storage endpoint exposes uploaded files for unauthenticated anonymous download, creating a two-stage attack surface: an authenticated insider or low-privilege account uploads a malicious payload, which any external anonymous actor can then retrieve. No public exploit identified at time of analysis beyond researcher documentation on GitHub, and EPSS sits at 0.15% despite the high CVSS score, indicating limited observed exploitation at this time.
Stack buffer overflow in Greenbone's OpenVAS Scanner and Greenbone OS allows a remote attacker holding user-level privileges to achieve full system compromise by supplying a malicious or compromised NASL vulnerability test (VT). Both the Greenbone OS platform and the openvas-scanner engine are confirmed affected, making this a meaningful risk in any multi-user GVM deployment or environment where user accounts may be compromised. No public exploit code has been identified at time of analysis, but the network-accessible, low-complexity attack vector and high-impact outcome place this in the immediate patching tier for production scanner infrastructure.
Symlink-following in the openssl-encrypt pip package (jahlives/openssl_encrypt) before 1.4.9 allows an evil-maid attacker with physical access to a target USB drive to bypass the verify-usb v2 integrity check and achieve code execution on the victim's machine. The attacker replaces a tool-tree directory with a symlink to a crafted copy that includes byte-identical visible source files and a planted __pycache__/*.pyc compiled bytecode file; CPython's rglob() does not enumerate symlinked directory contents, so the planted file is never counted, verify-usb reports PASSED, and the malicious bytecode executes when the victim launches the portable install. No public exploit has been identified at time of analysis, and the attack is gated behind physical drive access and victim interaction.
Uncontrolled memory allocation in jahlives/openssl_encrypt before 1.4.9 enables remote, unauthenticated denial of service by processing crafted encrypted files with arbitrarily large Argon2, scrypt, or balloon KDF cost parameters. Any application that passes attacker-controlled encrypted files or keystore data to this library can be crashed without requiring credentials, as the library performs no upper-bound validation on memory-hard KDF parameters before allocating the specified memory. No public exploit has been identified at time of analysis and it does not appear in CISA KEV, but the low attack complexity (AV:N/AC:L/PR:N/UI:N) makes exploitation straightforward wherever untrusted encrypted input reaches the library.
Arbitrary code execution in SpeechBrain before v1.1.1 is triggered during checkpoint candidate enumeration when PyYAML's unsafe loader parses attacker-controlled CKPT.yaml files in the configured checkpoint path. An attacker who can plant a crafted CKPT.yaml - for example via a malicious pretrained model distributed through a public model repository - can embed !!python/object/apply YAML tags that cause Python to instantiate arbitrary objects at parse time, achieving code execution before any checkpoint is ever selected for recovery. No public exploit specific to this CVE has been identified at time of analysis, and it is not listed in the CISA KEV catalog, but the underlying PyYAML unsafe deserialization class is extensively documented and exploit techniques are widely known.
Pre-authentication denial-of-service in jahlives/openssl_encrypt before 1.4.9 allows unauthenticated network attackers to exhaust server memory and CPU by supplying crafted files with arbitrarily large key derivation function cost parameters, crashing or permanently wedging the process before any password verification occurs. The attack requires no credentials and no user interaction, making it trivially automatable against any service that accepts attacker-supplied encrypted files as input. No public exploit code has been identified at time of analysis, and the library's niche footprint limits broad internet exposure despite the low-complexity attack vector.
CPU-pinning denial of service in NLTK's PorterStemmer component (versions ≤ 3.10.2) allows a remote unauthenticated attacker to exhaust a CPU core for seconds to minutes by submitting a single crafted token. The root cause is quadratic algorithmic complexity: _is_consonant() re-walks trailing 'y' characters on every invocation, and _measure() calls it once per stem position, resulting in O(n²) processing time. Any service that passes untrusted text through PorterStemmer.stem() without input length validation is vulnerable; a ~20-50 KB payload of repeated 'y' characters followed by a matching suffix such as 'ness' is sufficient to trigger the condition. No public exploit code is identified at time of analysis, but the attack primitive is trivially constructable from the public description. Fix is available in NLTK 3.10.3.
Uncontrolled memory allocation in the jahlives openssl_encrypt PHP library (versions before 1.4.9) exposes any application processing QR codes to remote denial of service. The library fails to validate the 'total' field within QR JSON payloads before allocating memory for range materialization, allowing an unauthenticated attacker to supply a crafted QR image containing an arbitrarily large 'total' value and exhaust host memory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is low-complexity and requires no authentication, making automated exploitation plausible against any internet-facing service that accepts QR input.
Uncontrolled memory allocation in the openssl-encrypt Python package (pip, versions ≤1.4.8) exposes any service invoking its `decrypt --stego-extract` command to unauthenticated denial of service via a crafted FLAC file. The STREAMINFO total_samples field - a 36-bit value fully controlled by the file author - is passed without bounds validation directly to NumPy as an array dimension, causing allocations of tens of gigabytes from a ~50-byte input. A vendor-released patch exists in version 1.4.9; no public exploit code has been identified at time of analysis, though the attack requires no authentication and minimal complexity.
Cleartext password leakage in openssl-encrypt before 1.4.9 exposes file encryption credentials in debug output when passwords are supplied via bundled short-option or abbreviated long-option argument forms. The tool's sanitizer, which is designed to redact sensitive arguments before writing the argv dump to stderr, fails to recognize spellings like -apHunter2 (bundled short option) or --passw (abbreviated long option), causing the raw password to appear in terminal scrollback, CI job logs, and persistent GUI debug logs. No public exploit identified at time of analysis; the vulnerability is trivially exploitable by any party with read access to the affected log output.
Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated attacker to crash VPN processing via specially crafted network traffic, causing a denial-of-service condition on affected Firebox appliances. Any Firebox with IPsec VPN exposed to untrusted networks is at risk across an unspecified range of Fireware OS versions. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with network-accessible, zero-authentication exploitation reflects meaningful operational urgency for perimeter security devices.
Remote unauthenticated denial-of-service in WatchGuard Fireware OS targets the iked process, which handles IKE-based VPN session negotiation. By sending specially crafted network packets to the IKE service, an attacker can trigger an integer underflow in iked, crashing VPN processing and disrupting all VPN-dependent connectivity without any authentication. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.
Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthenticated attackers to crash VPN processing by sending specially crafted network traffic, resulting in a Denial of Service condition. All Fireware OS versions appear affected per the wildcard CPE, and the vulnerability is reachable without authentication from any network path to the iked listener. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this a realistic target for disrupting VPN availability on WatchGuard appliances.
Integer underflow in WatchGuard Fireware OS iked (IKE daemon) process enables remote unauthenticated attackers to crash VPN processing by sending specially crafted network traffic. The flaw (CWE-191) resides in the IKEv1/IKEv2 key exchange handler, meaning any internet-exposed WatchGuard appliance with VPN enabled is reachable from the network perimeter without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network attack vector and availability impact of 8.7 (CVSS 4.0) make this a meaningful risk for organizations relying on WatchGuard VPN for remote access continuity.
Remote unauthenticated attackers can crash the VPN processing service on WatchGuard Fireware OS by sending specially crafted IKE network traffic that triggers a double-free memory corruption in the iked daemon. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) confirms zero prerequisites for exploitation against any internet-exposed WatchGuard appliance with IPsec VPN active. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Out-of-bounds read in the WatchGuard Fireware OS iked (IKE daemon) process allows remote unauthenticated attackers to disrupt VPN operations by sending specially crafted network packets. The flaw resides in VPN processing logic and can crash or destabilize the IKE service, cutting off IPsec/IKEv2 tunnels for connected clients and sites. No public exploit has been identified at time of analysis and CISA KEV listing is not confirmed; however, the unauthenticated network attack vector and CVSS 4.0 score of 8.7 place this in the priority triage tier for organizations relying on WatchGuard Firebox VPN connectivity.
Remote code execution in Craft CMS allows authenticated users with Twig template access to escape the sandbox via permissive Yii framework functionality, achieving full confidentiality, integrity, and availability compromise on the host system. The root cause is CWE-693 (Protection Mechanism Failure): the Twig sandbox policy was configured to permit dangerous Yii framework methods capable of executing arbitrary code, rather than enforcing a tight allowlist. The vendor confirmed and patched this as a high-severity RCE in release 5.10.7; no public exploit code has been confirmed at time of analysis, though a Hackrate hacktivity report exists referencing the issue.
WatchGuard Dimension's log listening service can be rendered unavailable by an unauthenticated remote attacker flooding it with TCP SYN packets, a classic resource exhaustion denial-of-service technique. The CVSS 4.0 base score of 8.7 reflects high availability impact with no authentication, no user interaction, and no configuration prerequisite required. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Server-side request forgery (SSRF) in Spring Cloud Gateway's JsonToGrpcGatewayFilterFactory allows an authenticated gateway administrator to specify arbitrary Spring Resource URLs as the proto descriptor location, causing the gateway to fetch attacker-controlled internal or external resources. Affected versions span the 3.x through 5.x release trains (CPE: cpe:2.3:a:vmware:spring_cloud_gateway). A successful exploit enables the gateway host to be weaponized as an HTTP pivot into internal network services, with confidentiality and integrity impact on systems beyond the gateway boundary (S:C). No public exploit or active exploitation has been identified at time of analysis.
Unbounded KDF iteration processing in jahlives/openssl_encrypt before 1.4.9 allows remote unauthenticated attackers to trigger sustained CPU exhaustion by supplying crafted files whose metadata contains arbitrarily high key derivation function iteration counts. Because the library reads this attacker-controlled value from file metadata and begins key derivation without enforcing any upper time or iteration ceiling, authentication can be held hostage indefinitely, starving the host of CPU resources. No public exploit has been identified at time of analysis, though the AV:N/PR:N/UI:N CVSS profile means any service that accepts encrypted file uploads from untrusted parties is exposed without prerequisite access.
Weak key derivation in openssl_encrypt before 1.4.9 exposes all files encrypted via the D-Bus CryptoService.EncryptFile handler to accelerated offline password guessing attacks that shatter the tool's documented confidentiality guarantees. The handler uses a single-pass SHA-256 hash for key derivation instead of a memory-hard algorithm such as Argon2id, enabling any attacker who obtains an encrypted file to crack the password six to seven orders of magnitude faster than the product implies. No public exploit code or active exploitation has been identified at time of analysis, though the weakness is structurally trivial to exploit with commodity GPU cracking tooling.
Cleartext credential interception in jahlives/openssl_encrypt before 1.4.9 exposes client_id values, passwords, and JWTs to network-path attackers through the login and register_with_email functions. The library accepts unencrypted http:// URLs and unconfigured host values without validation, transmitting authentication material in cleartext to keyservers and enabling full keyserver account takeover. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the network-accessible nature with no required privileges makes credential interception straightforward for anyone positioned on the traffic path.
Weak pepper wrap key derivation in openssl_encrypt (versions before 1.4.9) allows fleet-wide offline password recovery against all users from a single precomputed dictionary table. The library derives its remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, producing identical wrap keys across every user and every file - eliminating the per-user randomness that salting is designed to provide. Any attacker who obtains wrapped pepper blobs can precompute one lookup table and attack the entire user population at GPU-limited speed. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
openssl_encrypt by jahlives (versions before 1.4.9) embeds an unkeyed SHA-256 digest of each plaintext document into the encrypted file's cleartext header, creating a passive plaintext-confirmation oracle. Any party who possesses an encrypted file - including unauthorized recipients of intercepted or leaked archives - can extract this hash without the encryption password and use it to verify guessed or known plaintexts via offline dictionary attacks. Additionally, because the hash is unkeyed and deterministic, identical source documents encrypted separately under different passwords produce matching header hashes, enabling cross-file correlation and fingerprinting that undermines the confidentiality guarantees users expect from file encryption. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA KEV.
Authenticated SQL injection in WatchGuard Dimension's scheduled report feature permits arbitrary OS command execution as the Dimension WebUI process user. All versions of the product are listed as potentially affected per CPE data, with exploitation requiring a valid session holding report administration permissions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the post-authentication command execution capability represents a critical risk for any deployment where report admin credentials can be obtained.
Authenticated SQL injection in WatchGuard Dimension's audit report feature enables privilege escalation to arbitrary OS command execution, running as the Dimension WebUI process account. The vulnerability is exploitable by any user holding report administration permissions, making it a significant lateral-movement and post-compromise pivot risk within WatchGuard-managed network environments. No public exploit code or CISA KEV listing has been identified at time of analysis, though the chained SQL injection-to-command-execution primitive is high impact for attackers who have obtained admin-level credentials.
Path traversal in the openssl-encrypt pip package (versions before 1.4.9) enables a sandboxed plugin to escape its intended isolation and access or modify a sibling plugin's files when the two plugin directories share a name prefix. The flaw in PluginSandbox._is_safe_path performs a bare string-prefix match rather than an exact directory boundary comparison, so a plugin allowed under .../plugins/foo incorrectly passes the safety check for .../plugins/foobar. Vendor-released patch version 1.4.9 corrects the flaw; no public exploit code has been identified and the package is absent from the CISA KEV catalog.