Worker process exhaustion in Erlang/OTP's inets httpd enables unauthenticated remote denial of service by exploiting a bare-catch error-handling flaw in the chunked transfer-encoding decoder, permanently consuming HTTP worker processes until the pool is exhausted and the server becomes unresponsive to legitimate clients. The defect lies in httpd_request_handler:handle_info/2, where a throw exception raised by an invalid chunk-size is silently coerced into a normal return tuple rather than propagated as an error, leaving the worker suspended indefinitely with the request timeout already cancelled and no default byte-rate watchdog to reclaim it. Affected OTP versions span three active release lines (27.x, 28.x, 29.x) in their default configurations; no public exploit is confirmed, though the fix commit includes a regression test that is functionally equivalent to a proof-of-concept attack.
OpenAI Codex CLI and Codex Desktop's PowerShell command-safety parser failed to recognize PowerShell's stop-parsing token (--%), misclassifying file-writing Git commands embedded after that token as safe and executing them without user approval. An attacker who tricks a developer into opening a crafted repository can cause Codex to silently write an attacker-controlled configuration; when Codex subsequently loads that configuration, it launches an attacker-designated MCP server and executes arbitrary code under the user's account. No public exploit has been identified at time of analysis (EPSS 0.16%, 6th percentile), and the default filesystem sandbox on macOS and Linux can limit the damage radius by preventing writes outside permitted directories.
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated attacker on an adjacent network segment to inject persistent malicious script into the interface, which executes in any authenticated user's browser upon visiting the affected page. The CVSS 8.8 score with S:C/C:H/I:H/A:H reflects the elevated downstream impact: a successful payload executing in a network administrator's session could facilitate full session hijacking, credential theft, or unauthorized configuration changes to the managed fabric infrastructure. No public exploit or KEV listing has been identified at time of analysis.
Shortcode injection in MW WP Form WordPress plugin (versions before 5.1.5) allows unauthenticated remote attackers to execute any WordPress shortcode registered on the target site. The plugin fails to neutralize shortcode syntax in user-submitted form values before passing those values through WordPress's shortcode processing engine. A publicly available proof-of-concept exists (via WPScan), though exploitation is gated by a non-default site configuration requirement, which suppresses real-world risk despite the network-accessible attack vector.
Eval injection in cPanel's Park API (versions 11.138.0.0 and earlier) enables remote authenticated users to execute arbitrary code with root-level privileges on affected hosting servers. The vulnerability, classified under CWE-95 (Eval Injection) and reported via HackerOne, was disclosed alongside a WebPros vendor advisory on August 27, 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the direct path to root execution across a widely deployed hosting platform makes this a critical remediation priority.
Resource exhaustion in pypdf prior to 6.16.1 allows an attacker who can supply a crafted PDF to cause denial of service by triggering unbounded traversal in `_get_outline` within `pypdf/_doc_common.py`. Any application that processes untrusted PDF files and accesses document outlines is exposed - the traversal lacked global entry-count and nesting-depth limits, enabling crafted PDFs with large numbers of bookmark entries or deeply nested reused paths to consume excessive CPU and memory. No public exploit has been identified at time of analysis, and a patched release (6.16.1) is available.
Privilege escalation to root on Dell PowerStore storage appliances allows an authenticated user with limited privileges to execute arbitrary code at the operating system's highest privilege level. Affecting the full PowerStore T and Q product families (500T through 7000T confirmed via CPE), this CWE-829 flaw exploits the inclusion of functionality from an untrusted control sphere - meaning a low-privileged local user can influence a privileged execution path by supplying or manipulating untrusted code or configuration loaded by a higher-privileged process. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Remote code execution in LibreNMS versions before 26.5.0 stems from the AboutController passing the snmpget configuration value directly to shell_exec() with a validation mechanism rendered ineffective by a PHP assignment operator bug. An authenticated administrator can update the snmpget setting to reference any executable already present on the server filesystem, then trigger code execution by visiting the /about endpoint, yielding full host compromise under web server privileges. No public exploit has been identified and this vulnerability is absent from CISA KEV; vendor-released patch 26.5.0 is available.
PHP object injection in Cypht before 2.12.2 allows authenticated users to execute arbitrary OS commands as the web server process by submitting a crafted serialized payload via the logout handler. The `back_query` GET parameter is base64-decoded and passed directly to PHP's `unserialize()` with no allow-list, signature check, or type restriction, enabling gadget-chain exploitation. A vendor patch is available in v2.12.2 and no public exploit code has been identified at time of analysis.
Unauthenticated denial of service in Erlang/OTP's inets httpd allows any remote attacker to exhaust a server's process pool, memory, and file descriptors by holding open an unlimited number of TCP connections. The flaw affects all inets httpd deployments across OTP 17.x through 29.x that do not explicitly configure the max_clients option; when that option is absent, a type-comparison defect caused by Erlang's term-ordering rules makes the connection-count guard unconditionally pass, accepting connections without bound. Vendor patches are available in OTP 27.3.4.17, 28.5.0.6, and 29.0.6; no public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in Dell PowerStore allows a locally authenticated user with limited privileges to execute arbitrary commands with root privileges, achieving full appliance compromise. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 8.8) confirms low-complexity local privilege escalation with scope change to root, covering complete confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full impact triad make this a meaningful risk for environments where multiple accounts share local PowerStore access.
Remote code execution in the FS-Poster WordPress plugin (versions up to and including 8.0.1) allows any authenticated user with subscriber-level access to execute arbitrary OS commands on the underlying web server. The vulnerability combines two weaknesses: the FFmpeg path parameter accepted by the plugin's REST API is passed unsanitized to PHP's exec() function (CWE-77 command injection), and the REST API endpoints responsible for this functionality lack proper authorization checks. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege bar - a standard subscriber account - makes this accessible to any registered WordPress user.
Command injection in Dell PowerStore storage appliances allows an authenticated low-privileged local user to execute arbitrary operating system commands with root privileges, achieving full appliance compromise. The CVSS scope-change metric (S:C) reflects that root access on a storage platform threatens all data hosted on the array, extending blast radius beyond the appliance itself. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low attack complexity once local access is established makes this a priority remediation for organizations running affected PowerStore T and Q series hardware.
SQL injection in TMT Machine Industry and Trade Ltd. Co.'s Talassoft Industrial Management Software (versions V.4 through V.16) exposes industrial operations data to full database compromise by low-privileged authenticated remote attackers. Exploitation over the network requires only a valid user account, with no interaction from other users, enabling full confidentiality, integrity, and availability impact against the backend database. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and high impact make this a significant risk for affected deployments.
Heap-based buffer overflow in the gvfs SFTP backend (gvfsd-sftp) exposes GNOME desktop users to process-level denial of service or potential arbitrary code execution when connecting to a malicious SFTP server. The read_reply() function trusts the server-supplied response length without validating it against the client's allocated buffer, allowing a rogue server to overflow adjacent heap memory in the gvfsd-sftp daemon. No public exploit or CISA KEV listing is confirmed at time of analysis, but the high CVSS score of 8.8 and the C:H/I:H/A:H triad reflect worst-case RCE potential once a user mounts an attacker-controlled share.
Privilege escalation in Dell PowerStore enterprise storage appliances allows authenticated low-privileged users to bypass the platform's access control enforcement and gain elevated system privileges. Classified as CWE-693 (Protection Mechanism Failure), the flaw resides in the protection layer governing role-based access within the PowerStore management stack, spanning at least ten appliance models from the 500T to the 7000T series. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact, though network access with valid limited-privilege credentials is required; no public exploit code or active exploitation has been identified at time of analysis.
OS command injection in Dell PowerStore storage appliances enables a locally authenticated user with limited privileges to execute arbitrary commands at the root level, achieving full privilege escalation on the appliance. The CVSS scope change (S:C) reflects that root access on a storage platform extends impact beyond the immediate process boundary to the entire appliance and potentially dependent workloads. Dell has published advisory DSA-2026-330, but no specific patched version was provided in available data. No public exploit identified at time of analysis.
Code injection in Dell PowerStore storage appliances (500T through 7000T series and potentially additional models) allows an authenticated user with limited privileges to execute arbitrary code at root privilege level, achieving full appliance compromise. The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H vector confirms that exploitation requires only local authenticated access with low-level credentials and no user interaction, with the resulting code execution crossing a privilege boundary into a root context. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Arbitrary file write in Dell PowerStore allows authenticated low-privileged users to write attacker-controlled content to arbitrary filesystem paths via a Protection Mechanism Failure (CWE-693). Exploitation requires only network access and limited credentials, making this a credible lateral movement or privilege escalation vector within storage environments. No public exploit code has been identified at time of analysis, but the low complexity and low privilege bar make this a realistic threat against enterprise storage infrastructure.
Privilege escalation to Administrator level is possible on Dell PowerStore storage appliances through an authentication bypass by spoofing vulnerability (CWE-290). Any attacker holding a low-privileged account on the PowerStore management plane can exploit this network-accessible flaw without user interaction to gain full administrative control, impacting confidentiality, integrity, and availability of the storage system. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV, but the impact of Administrator-level compromise on enterprise storage infrastructure elevates operational risk considerably.
Erlang/OTP's inets HTTP server (httpd) is vulnerable to a slow-body resource exhaustion attack exploitable by unauthenticated remote attackers across OTP versions 17.0 through 29.0. The request handler cancels its active timeout after successfully parsing request headers, then re-arms the socket for body data without installing any replacement timer, allowing an attacker to open connections with syntactically valid headers and a large Content-Length and then stall indefinitely - permanently occupying a worker process per connection. Vendor patches are available for the OTP 27.x, 28.x, and 29.x branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unsafe PyYAML deserialization in ModelScope through v1.40.0 enables remote code execution when users load model configuration files from attacker-controlled repositories. The vulnerability exists in at least two documented components - the audio TTS voice module (voice.py) and the multimodal mPLUG configuration loader (configuration_mplug.py) - which use PyYAML's unsafe yaml.Loader that processes Python object construction tags such as !!python/object: during deserialization. An attacker who publishes a poisoned model repository can achieve full code execution on any victim system that loads the model, with no public exploit identified at time of analysis.
Quadratic namespace-map allocation in xmldom's SAX parser allows unauthenticated remote attackers to exhaust the Node.js process heap by sending a compact, crafted XML document with repeated namespace prefix declarations. The unmaintained legacy `xmldom` package (versions 0.1.5-0.6.0) has no available fix, while `@xmldom/xmldom` is patched in releases 0.8.15 and 0.9.12. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the attack is trivially automatable against any application that parses untrusted XML with this library.
Two independent quadratic-complexity denial-of-service paths in the xmldom JavaScript XML parser allow remote unauthenticated callers to exhaust CPU and memory by submitting crafted XML. The `@xmldom/xmldom` package before versions 0.8.15 and 0.9.12, and all versions of the legacy `xmldom` package (0.3.0-0.6.0), expose both paths through the default `DOMParser.parseFromString()` interface, requiring no authentication or special configuration. No public exploit has been identified at time of analysis, but the security advisories and fix commits are publicly available on GitHub.
Processing-instruction target injection in the @xmldom/xmldom JavaScript library allows XML structure breakout through unvalidated characters in Document.createProcessingInstruction() targets. Versions prior to 0.8.15 and 0.9.12 - and all versions of the legacy xmldom package (0.6.0 and earlier, which has no fix) - emit malformed processing instructions when a target contains >, ?, whitespace, or other XML-Name-invalid characters, enabling injection of arbitrary XML structure into the serialized output. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog.
XML injection in the xmldom serializer allows a crafted DocumentType.name containing '>' or whitespace to prematurely close the <!DOCTYPE ...> declaration and inject arbitrary sibling markup into serialized XML output. The gap exists because XMLSerializer.serializeToString() under requireWellFormed: true validates publicId, systemId, and internalSubset but emits DocumentType.name verbatim, violating the XML Name production consistently enforced for the other fields. Affected packages are @xmldom/xmldom prior to 0.8.15 and 0.9.12, and all versions of the legacy unscoped xmldom (0.6.0 and earlier) for which no vendor-released fix will be issued; no public exploit code or CISA KEV listing has been identified at time of analysis.
XML injection and cross-site scripting in the xmldom JavaScript library allows attacker-controlled tag names to be injected verbatim into serialized XML or HTML output. Applications using @xmldom/xmldom prior to 0.8.14 or 0.9.11, or the legacy xmldom package at any version, are affected when they pass externally-supplied strings to Document.createElement() and then serialize the resulting DOM with XMLSerializer.serializeToString(). The serializer's requireWellFormed: true path failed to validate element qualified names and synthesized xmlns:PREFIX declarations against the XML QName production, meaning malformed names containing characters such as '>' or '<' pass through unchecked and cause XSS when the output is rendered in a browser. No public exploit has been identified at time of analysis, though the GitHub security advisory and PR diffs include explicit test cases demonstrating injection payloads.
XML injection in the xmldom JavaScript library allows crafted attribute names to break out of attribute context during serialization, enabling injection of arbitrary attributes — including event handlers — into browser-consumed XML/HTML output. Applications using @xmldom/xmldom before 0.8.14 or 0.9.11, or any version of the legacy xmldom package (≤0.6.0), are affected when attacker-controlled data reaches Element.setAttribute() and the result is serialized via XMLSerializer.serializeToString(). No public exploit is identified at time of analysis, but the vulnerability class is well-understood and the injection mechanism is straightforward for any attacker who can influence attribute name input.
Quadratic attribute-processing complexity in xmldom's DOMParser enables remote unauthenticated denial of service against any Node.js application that parses externally supplied XML. When a well-formed XML element contains many distinct attributes, DOMHandler.startElement repeatedly calls NamedNodeMap.setNamedItem, which in turn performs a full linear scan of previously inserted attributes on each insertion - producing O(N²) comparisons for N attributes and stalling the Node.js event loop before any application-level validation can execute. @xmldom/xmldom 0.8.15 and 0.9.12 contain the fix; the legacy xmldom package (≤0.6.0) has no patch and will not receive one. No public exploit has been identified at time of analysis, though the attack is trivially constructable from the published advisory alone.
XML injection in @xmldom/xmldom versions 0.9.10 and 0.9.11 bypasses the requireWellFormed serializer's DocumentType validation due to a multiline-flag inheritance bug in the PubidLiteral and SystemLiteral regex matchers: a publicId or systemId whose first line is a valid literal passes the check while ECMAScript line terminators (U+000A, U+000D, U+2028, U+2029) and breakout markup on subsequent lines are emitted verbatim into the <!DOCTYPE ...> declaration. This is a bypass of the mitigation introduced for the earlier DocumentType injection advisory; applications that treat requireWellFormed: true as a serialization-time security boundary against DOCTYPE injection are directly exposed. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 0.9.12.
XML injection in @xmldom/xmldom 0.9.11 allows attackers who supply crafted element or attribute names containing ECMAScript line terminators (U+000A, U+000D, U+2028, U+2029) to bypass the requireWellFormed: true serialization guard and emit arbitrary markup verbatim into serialized XML output. The bypass exploits the multiline flag inherited by the QName_exact regex in lib/grammar.js, which causes the anchors to match at line boundaries rather than string boundaries - directly circumventing the strict-name validation introduced to close earlier injection advisories. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Erlang/OTP's inets HTTP server (httpd) fails to enforce an administrator-configured request body-size limit when processing chunked transfer-encoded requests, enabling unauthenticated remote attackers to exhaust server memory and cause denial of service. Affected OTP branches span 17.x through 27.3.4.16, 28.x through 28.5.0.5, and 29.x through 29.0.5, covering inets versions 5.10 through 9.7.1. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog, but the zero-authentication, low-complexity network attack path makes this an operationally straightforward DoS risk for any deployment exposing inets httpd to untrusted clients.
XML injection in @xmldom/xmldom 0.9.0-0.9.11 allows an attacker to embed malicious markup into serialized XML output by supplying element or attribute names containing ECMAScript line terminators (U+000A, U+000D, U+2028, U+2029). The QName_exact regex in lib/grammar.js is compiled with JavaScript's multiline flag, causing the ^ and $ anchors to match per-line rather than over the full string - a name whose first line is a valid QName passes validation while subsequent lines carry injected markup, bypassing both the default serialization path and requireWellFormed: true. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with no prerequisites reflects the high-integrity impact when an application passes attacker-controlled input to createElementNS, createAttributeNS, createDocumentType, or createAttribute.
Unauthenticated atom table exhaustion in ash_typescript 0.1.0-0.17.x allows any network attacker to crash the entire Erlang/BEAM node by submitting RPC requests with attacker-controlled field names. The library's `convert_to_field_atom/2` function calls `String.to_atom/1` on client-supplied strings without validation, minting permanent, non-garbage-collected atoms until the VM hits its table limit and aborts. Additionally, field names exceeding 255 characters trigger an uncaught `SystemLimitError`. No public exploit is identified at time of analysis, but exploitation is trivial given no authentication or special configuration is required.
ReDoS in @xmldom/xmldom versions 0.7.0 through 0.8.14 allows remote unauthenticated attackers to stall the Node.js event loop by submitting a small crafted XML document containing a malformed end tag. The SAX parser in lib/sax.js uses an unanchored global regex /[ \t\n\r]+$/g to trim end-tag names; a tag with N whitespace characters followed by one non-whitespace character causes the engine to retry the match from every character position with O(N) backtracking per position, yielding O(N²) total work that blocks the single-threaded event loop. No public exploit code or CISA KEV listing is identified at time of analysis, but the CVSS 4.0 score of 8.7 with VA:H and PR:N reflects the severity of unauthenticated, network-reachable availability impact.
Quadratic CPU and memory exhaustion in @xmldom/xmldom 0.9.0-beta.1 through 0.9.11 allows denial-of-service via small crafted HTML documents passed to DOMParser.parseFromString(). The parseHtmlSpecialContent function uses a case-sensitive indexOf() to locate closing tags for raw-text elements; when a mixed-case tag like </ScRiPt> is not found, indexOf() returns -1, and the subsequent substring(-1) call destabilizes parser progression and triggers O(N²) output amplification. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the attack is unauthenticated and requires no access complexity beyond supplying crafted HTML to the parser.
Quadratic regex backtracking in @xmldom/xmldom versions 0.9.0-beta.9 through 0.9.10 allows unauthenticated remote attackers to stall the Node.js event loop by supplying a small malformed XML document containing an unterminated processing instruction with a long whitespace tail. The flaw resides in the processing-instruction production regex in lib/grammar.js, where the greedy S+ separator and lazy Char*? data group endlessly repartition whitespace when the required closing ?> is absent, causing O(n²) backtracking in both parsePI and parseProcessingInstruction. No public exploit has been identified at time of analysis, but the fix commit and GitHub Security Advisory GHSA-g53g-w8rj-fmg7 fully document the vulnerable code path, making independent reproduction straightforward. Vendor-released patch: 0.9.11.
UNION-based SQL injection in AVideo through version 29.0 allows unauthenticated remote attackers to read arbitrary database contents via the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed unsanitized into SQL queries without prepared statement binding, enabling direct extraction of password hashes and sensitive configuration data from the underlying database. No public exploit has been identified at time of analysis, but the UNION-based technique is elementary and well within reach of automated scanning tooling.
Rate-limit bypass in WWBN AVideo (all versions) allows unauthenticated remote attackers to perform unlimited credential-guessing against login endpoints by rotating arbitrary X-Real-IP or X-Forwarded-For header values per request. The enforceRateLimit() function uses the attacker-supplied header as the client identifier without verifying the request originates from a trusted proxy, nullifying IP-based throttling entirely. No public exploit code has been identified at time of analysis, but the technique requires no specialised tooling beyond basic HTTP scripting.
Cross-site request forgery in WWBN AVideo's referer-validation logic allows unauthenticated remote attackers to trick administrative users into issuing forged requests that modify live server configuration. The flaw resides in the get_domain() and isSameDomain() functions, which fail to reject origins from sibling subdomains or malformed long-gTLD URLs, enabling forged admin-level ObjectYPT writes. No public exploit code or active exploitation has been identified at time of analysis, but the bypass is straightforward to weaponize against any deployment where an attacker can influence an admin to visit a malicious page.
Unauthenticated denial-of-service in Rockwell Automation RSLinx Classic allows a remote attacker to crash the communications service by sending a crafted CIP packet containing an oversized embedded message request. The buffer overflow (CWE-120) causes the RSLinx Classic service to terminate, requiring manual restart to restore industrial device connectivity. In OT/ICS environments where RSLinx Classic bridges engineering workstations to Allen-Bradley PLCs and HMIs, service loss can halt production operations or degrade visibility into live industrial processes. No public exploit or CISA KEV listing confirmed at time of analysis.
Denial-of-service in Rockwell Automation RSLinx Classic allows unauthenticated remote attackers to crash the communication service by sending a specially crafted CIP packet with a manipulated data length field. The root cause is an integer underflow (CWE-191) in the packet length validation routine, causing the service to terminate and requiring a manual restart to recover. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the zero-barrier network attack vector against a critical ICS communication layer makes this a high-priority remediation target.
Denial-of-service in Rockwell Automation RSLinx Classic allows unauthenticated remote attackers to crash the RSLinx Classic communication service by sending a single crafted CIP packet targeting the Forward Close service. Because RSLinx Classic acts as the primary communication bridge between engineering workstations and Allen-Bradley PLCs, a crash forces a manual service restart and can halt production operations in industrial environments. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated remote denial-of-service in Rockwell Automation CompactLogix 5380 and ControlLogix 5580 industrial controllers allows a network-adjacent attacker to trigger a Major Nonrecoverable Fault (MNRF) by sending a malformed CIP message with an invalid input length, requiring a physical power cycle to restore controller operation. The vulnerability is rooted in CWE-119 (improper buffer bounds restriction) during CIP message processing on EtherNet/IP-accessible PLCs. No public exploit code or active exploitation has been identified at the time of this analysis, but the zero-prerequisite network attack surface on safety-critical industrial hardware makes this a prioritized remediation target for OT security teams.
Denial-of-service in a Rockwell Automation industrial module allows unauthenticated remote attackers to crash the device by sending a single crafted CIP (Common Industrial Protocol) packet, requiring a manual restart to restore availability. The vulnerability affects operational technology (OT) environments where CIP is network-accessible, making it particularly dangerous in industrial control system (ICS) contexts where device downtime can disrupt physical processes. No public exploit code has been identified at time of analysis, and Rockwell Automation has published advisory SD1798 addressing the issue.
Rockwell Automation's ArmorStart LT industrial motor control device contains a denial-of-service flaw in its embedded web server, exploitable by sending a crafted HTTP PUT request with no authentication or special preconditions. The root cause (CWE-770) is improper resource throttling during HTTP PUT processing, which causes the web server to become unavailable. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the unauthenticated network attack surface in an OT/ICS context makes this a material operational risk wherever the device's web interface is reachable.
Broken authorization in OpenNebula's `one.vm.exec` API function allows any authenticated low-privilege user to execute arbitrary commands inside virtual machines owned by other users, across all versions prior to 7.4. The flaw stems from the platform's failure to verify whether the requesting user holds access rights to the target VM - only the VM's numeric identifier and an active qemu-agent are required. Full confidentiality, integrity, and availability compromise of victim VMs is achievable by any platform tenant; no public exploit has been identified at time of analysis, but the low complexity prerequisites make this a genuine priority for multi-tenant deployments.
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system information and make unauthorized changes to certain configuration settings, potentially disrupting fabric management operations. The CVSS 8.6 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) and the 'Authentication Bypass' tag confirm that no credentials are required for network-based exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Persistent account takeover in Memos 0.26.0-0.30.0 is enabled by a failure to invalidate refresh tokens upon password change. An attacker who possesses a stolen refresh token can indefinitely call the RefreshToken RPC to rotate both the refresh token and obtain fresh access tokens, making the victim's password-change security response completely ineffective. No public exploit has been identified at time of analysis, but the vulnerability is straightforward to exploit once a token is obtained, and CVSS 4.0 rates the impact as High on both confidentiality and integrity.
Remote code execution in Rockwell Automation FactoryTalk® Historian Machine Edition allows an adjacent-network attacker holding low-privilege credentials to fully compromise the historian host via a memory corruption flaw. The root cause is CWE-787 (Out-of-bounds Write), consistent with a buffer overflow in the historian's network-facing service, yielding full confidentiality, integrity, and availability impact on the affected device. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at the time of analysis.