Privilege escalation to root in Plesk for Linux (18.0.34 up to 18.0.79.9 / 18.0.80.5) lets a customer- or reseller-level account with shell access run OS command injection (CWE-78) to take over the entire hosting server. Any tenant permitted to use - or to toggle on - their own shell access can break out of their restricted account and reach the root identity, collapsing the isolation between shared-hosting customers and the host. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the vendor rates it critical (CVSS 9.0) and has shipped fixed builds.
Remote denial-of-service in Rockwell Automation RSLinx Classic allows an unauthenticated network attacker to crash the RSLinx Classic service by sending a single crafted CIP (Common Industrial Protocol) packet, after which the service must be manually restarted to restore communications. The flaw is rooted in an integer-overflow (CWE-190) style mishandling of a malformed packet and carries a CVSS 4.0 base score of 9.2 driven by high availability impact on both the service and dependent systems. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Source code disclosure in Manacle Technologies' Multi-Tenant ERP System allows unauthenticated remote attackers to reconstruct the application's source by downloading an exposed, web-accessible .git directory (CWE-527). Because the version-control metadata can be walked to recover full repository history, attackers can harvest hardcoded credentials, API keys, database schemas, and business logic that enable follow-on attacks. No public exploit or CISA KEV listing exists at this time, but .git exposure is trivially exploited with widely available off-the-shelf tooling.
Sensitive-data exposure in Manacle Technologies' Multi-Tenant ERP System allows an unauthenticated remote attacker to read other users' data by manipulating a parameter on a vulnerable API endpoint. The flaw stems from missing authorization checks (IDOR) on an endpoint reachable without credentials, and in a multi-tenant deployment it can enable cross-tenant data access. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported by CERT-In (CIVN-2026-0430).
Use of uninitialized memory in Mozilla Thunderbird's MIME parser allows a remote attacker who sends a specially crafted email to trigger an error condition in certain MIME bodies, causing the client to read uninitialized memory. Depending on what previously occupied that memory, this can leak sensitive process data or crash the application. The flaw was fixed in Thunderbird 155, 140.15 ESR, and 153.2; no public exploit has been identified and EPSS exploitation probability is low (0.15%, 4th percentile).
Sensitive data disclosure in TMT Machine Industry and Trade's Talassoft Industrial Management Software (versions V.4 through pre-V.16) stems from hard-coded credentials embedded in the application, allowing remote attackers to retrieve protected sensitive data without authentication. The flaw was reported by Turkey's national CERT (TR-CERT/USOM) and carries a CVSS 9.1 rating. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated denial of the guest Wi-Fi service on the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) is possible because the guest_wifi_sync function performs no access control on messages arriving at the internal cs_broker MQTT component. Any attacker able to reach the broker can publish a crafted MQTT message to tear down the guest virtual AP interfaces, disrupting guest connectivity without credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code as a privileged user on the appliance's underlying operating system, resulting in complete host compromise. HPE notes exploitation depends on 'certain preconditions outside of the attacker's control,' which is reflected in the CVSS high attack complexity (AC:H). No public exploit is identified at time of analysis and the flaw is not listed in CISA KEV.
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated low-privilege operator to inject persistent script that executes in an administrator's browser session, enabling privilege escalation within the appliance interface. HPE (advisory hpesbnw05133) assigned a CVSS 3.1 base score of 9.0, driven largely by a scope change (S:C) and full C/I/A impact against the higher-privileged admin context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Missing authentication in Dell PowerStore's SDNAS (software-defined NAS) component allows a remote, unauthenticated attacker to reach a critical function and obtain filesystem access, per Dell advisory DSA-2026-330. The flaw (CWE-306) affects PowerStore T-series storage arrays and carries a CVSS 9.0, with high confidentiality, integrity, and availability impact and a changed scope. No public exploit identified at time of analysis and it is not listed in CISA KEV.