Unauthenticated remote denial of service in HPE Networking Fabric Composer's API allows a network-adjacent or internet-reachable attacker to disrupt the availability of the management interface with no credentials required. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a low-complexity, fully unauthenticated attack path yielding high availability impact, with no confidentiality or integrity exposure. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Memory corruption vulnerabilities internally discovered across multiple Firefox release lines (154, ESR 153.1, ESR 140.14, ESR 115.39) could enable remote code execution when a user visits a specially crafted webpage. Mozilla's security team identified a cluster of memory safety bugs spanning 15+ tracked Bugzilla issues, several of which showed direct evidence of memory corruption sufficient to presume exploitability with sufficient attacker effort. Patches are available across all affected branches (Firefox 155, ESR 115.40, ESR 140.15, ESR 153.2); no public exploit code or CISA KEV listing is associated with this advisory.
Uncontrolled resource consumption in cleverange_auth v0.1.10 allows remote unauthenticated attackers to exhaust server resources and cause a denial of service by invoking the account_verification function exposed through the accounts/models.py component. The PyPI-distributed Python authentication library is affected in its only publicly released version (0.1.10), and a public disclosure repository exists on GitHub. No vendor-issued patch has been identified at time of analysis, leaving all deployments vulnerable.
Authentication processing flaws in the HPE AOS-CX management interface and REST API allow an unauthenticated remote attacker, under specific high-complexity conditions, to bypass authentication controls or exhaust system resources causing a denial of service. Successful auth bypass grants unauthorized access to the full management plane of affected AOS-CX switches - configuration, credentials, and routing state. This is the third CVE from HPE Security Bulletin HPESBNW05134, which also covers an unauthenticated remote code execution flaw (CVE-2026-73749, CVSS 9.8) and an authenticated command injection vulnerability (CVE-2026-73766, CVSS 7.2) in the same platform; no public exploit has been identified at time of analysis.
Uncontrolled recursion in llama.cpp's JSON-schema-to-grammar converter (common/json-schema-to-grammar.cpp, versions through build b5693) allows a remote unauthenticated attacker to crash the service by submitting a crafted JSON schema that triggers unbounded recursive processing, exhausting the call stack and producing a denial of service. The CVSS vector confirms network reachability with no authentication required and no user interaction needed, making this exploitable against any deployment that exposes the llama.cpp HTTP server endpoint to untrusted clients. No public exploit identified at time of analysis.
Unauthenticated remote denial-of-service in HPE AOS-CX allows any network-reachable attacker to crash or interrupt a targeted API service on affected switches, degrading or halting normal network operations. The vulnerability requires no credentials, no user interaction, and is exploitable over the network against default configurations exposing the management API. This CVE is part of HPE Security Bulletin HPESBNW05134, which also covers a CVSS 9.8 unauthenticated RCE (CVE-2026-73749) and a CVSS 7.2 authenticated command injection (CVE-2026-73766) in the same platform; no public exploit has been identified at time of analysis.
Remote unauthenticated denial of service in llama.cpp (through commit 97f06e9) allows any network attacker to crash the inference server by submitting a POST request to the /rerank endpoint with a negative top_n value, triggering a std::bad_alloc exception and an HTTP 500 response. The attack surface is exclusively present when the server is started with the non-default --reranking flag. No public exploit has been confirmed at time of analysis, though a public technical writeup exists at ph4nt0m.xyz that details the flaw and may contain proof-of-concept request data.
Remote unauthenticated denial of service in Kamailio 6.1.1 and earlier crashes the P-CSCF SIP proxy by triggering a NULL pointer dereference in the `free_security()` function when processing IMS registration cleanup of partially initialized IPsec security structures. The upstream commit (91c5ca7) confirms the root cause: `shm_free()` was called unconditionally on pointer fields that may be NULL in the `ims_usrloc_pcscf` module, crashing the Kamailio process and dropping all active registrations. No patch release has been tagged; no public exploit tool or CISA KEV listing exists at time of analysis.
Denial of service in Kamailio v6.1.1 and earlier allows an unauthenticated remote attacker to crash the SIP proxy by sending a crafted SIP REGISTER message with a malformed Security-Agreement header. The vulnerability resides in the `ims_registrar_pcscf` module's `parse_sec_agree()` function in `sec_agree.c`, which unconditionally calls `shm_free()` on IPSec parameter string pointers that may be NULL or uninitialized when header parsing fails mid-way, corrupting the Kamailio shared memory pool and crashing the process. No public exploit or active exploitation (CISA KEV) has been identified, and EPSS is low at 0.19%, though the vulnerable code path is fully disclosed by the upstream fix commit.
Unauthenticated modification of privileged QoS policy is possible on TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 via the setElinkQosConfig function, reachable by sending a crafted MQTT message to the cs_broker component without any credentials. The access control check is entirely absent for this function, exposing a privileged network management operation to any attacker who can reach the MQTT broker over the network. No public exploit code has been identified and EPSS is very low at 0.18%, but the zero-barrier AV:N/PR:N exploit path makes this a practical integrity risk for any deployment with an externally or LAN-exposed MQTT port.
Unbounded recursion in Net::DNS before 1.57 for Perl allows a remote unauthenticated attacker to exhaust memory and terminate any DNS forwarder or proxy process by sending a crafted DNS message carrying a TSIG record misplaced in the answer or authority section with an empty MAC field. Because the library's decoder does not drop the malformed packet as RFC 8945 section 5.2 requires, the TSIG survives the re-encoding strip step and drives `sig_data` into infinite recursion; payloads under 100 bytes on the wire are sufficient to crash the process. No public exploit has been identified at time of analysis, and EPSS indicates low current exploitation probability (0.17%), though the trivially small payload and zero-authentication requirement make this an operational priority for any Perl-based DNS forwarder or proxy deployment.
Heap memory disclosure in Mozilla Thunderbird's IMAP client allows a malicious IMAP server to trigger a use-after-free by sending a crafted ID extension response, leaking heap contents that are subsequently persisted to the user's prefs.js file on disk. All Thunderbird releases prior to 155, 140.15 (ESR), and 153.2 across three active release channels are affected. No public exploit or active exploitation has been identified at time of analysis; the EPSS score of 0.15% (4th percentile) reflects low current exploitation probability.
Thunderbird's mail header parser triggers a one-byte buffer over-read (CWE-126) when processing a maliciously crafted message header, potentially exposing a single byte of adjacent heap memory to the sender. All Thunderbird versions across three active release branches are affected until patched - 155, 140.15, and 153.2. No public exploit has been identified and EPSS sits at the 4th percentile, but the network-accessible attack path with no user interaction required keeps this relevant for unpatched deployments.
Thunderbird's remote attachment allowlist control (`mail.allowed_attachment_hostnames`) can be bypassed due to insufficient regex escaping of configured hostname values, allowing attacker-controlled servers to serve remote attachments that the filter was intended to block. Affected are all Thunderbird releases prior to 155 and 153.2; because hostname strings containing dots and other regex metacharacters are interpolated directly into a regular expression without sanitization, a crafted attachment hostname can pattern-match an allowlisted domain without being that domain. No public exploit has been identified at time of analysis, and EPSS sits at 0.15% (4th percentile), consistent with low-urgency real-world exploitation risk.
Memory safety vulnerabilities across multiple internally discovered bugs in Firefox 154 and Firefox ESR 153.1 allow network-based attackers to potentially achieve full browser compromise through memory corruption (CWE-119). Mozilla's own advisory clusters dozens of individual Bugzilla reports - including buffer overflows and related defects - under a single advisory umbrella, noting that sufficiently motivated attackers could likely exploit some of these bugs. Vendor-released patch is available: Firefox 155 and Firefox ESR 153.2. No public exploit identified at time of analysis.
Reachable assertion in llama.cpp's GGUF file parser (gguf_reader::read) allows a remote unauthenticated attacker to crash the process by supplying a crafted GGUF model file to any service built on llama.cpp b5693 or earlier. CWE-617 (Reachable Assertion) causes process abort on assertion failure, making this effectively a denial-of-service primitive. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at the 4th percentile (0.14%), reflecting low observed exploitation pressure.
Information disclosure via Firefox's Networking: HTTP component exposes sensitive data to remote unauthenticated attackers in all Firefox versions prior to 155 and all Firefox ESR versions prior to 153.2. The flaw is tracked in Mozilla Bugzilla #2063020 and addressed across four Mozilla security advisories (mfsa2026-82, -85, -86, -88), indicating backport coverage across multiple ESR branches. No public exploit code exists and EPSS probability is very low (0.14%), though the SSVC framework marks the class as automatable.
Information disclosure in Mozilla Firefox's WebGPU graphics component allows remote attackers to read sensitive data - potentially including cross-origin content or GPU memory - by luring a user to a crafted web page. Affected releases are all Firefox versions prior to 155 and Firefox ESR prior to 153.2. Vendor-released patches are available in Firefox 155 and Firefox ESR 153.2; no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Quadratic-time CPU exhaustion in Red Hat OpenShift Container Platform 4's OAuth login and error page endpoints allows unauthenticated remote attackers to deny authentication to all cluster users simultaneously. The attack exploits a bypass of the CVE-2022-32149 mitigation in golang.org/x/text/language.ParseAcceptLanguage(): the existing guard checks for hyphen ('-') character counts, but the BCP 47 scanner internally aliases underscore ('_') to '-' after the guard executes, allowing a crafted Accept-Language header with underscore subtag separators to slip through and trigger unbounded quadratic-time parsing. No public exploit has been identified at time of analysis, though the bypass mechanism is fully documented in the CVE description, meaningfully lowering the bar to exploitation.
Missing authentication for a critical function in TMT Machine Industry and Trade Ltd. Co.'s Talassoft Industrial Management Software exposes industrial operations to unauthenticated remote attackers who can access and invoke privileged functionality without credentials. Affected versions span a broad range from V4 through V15.x (all versions before V.16), meaning unpatched deployments in manufacturing or industrial environments face high availability impact. No public exploit has been identified at time of analysis, and the vulnerability is not in CISA KEV, but its unauthenticated network attack vector and industrial context elevate operational risk.
Forced-reboot denial-of-service in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 enables unauthenticated network attackers to instantly restart the device by sending a crafted MQTT message to the cs_broker component's setDevReboot handler, which performs no access control check. In mesh deployments, exploiting a master node propagates the reboot command to all registered slave nodes, taking down the entire mesh network in a single unauthenticated request. No public exploit has been identified at time of analysis, though the attack requires no credentials, no special configuration, and minimal technical complexity (CVSS AC:L, PR:N).
Sensitive information disclosure in HPE Networking Fabric Composer's web management interface allows an unauthenticated remote attacker to retrieve network service credentials or configuration data by social-engineering an authenticated administrator into clicking a specially crafted URL. The CVSS scope change (S:C) combined with high confidentiality impact (C:H) indicates that the exfiltrated data can reach beyond the web application itself - potentially exposing credentials or configuration for the fabric services that Fabric Composer orchestrates. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, successful exploitation could serve as an initial foothold for deeper compromise of managed network infrastructure.
Scrapy's S3DownloadHandler transmitted s3:// requests - including signed AWS Authorization headers, temporary session tokens, and full S3 object contents - over plaintext HTTP by default in all versions prior to 2.17.0, exposing credentials and data to any network attacker with a man-in-the-middle position. A passive observer on the network path can harvest AWS credentials silently; an active attacker can modify S3 response bodies, status codes, and headers to poison scraped data exports, corrupt HTTP caches, or manipulate subsequent crawl targets through forged redirects. The root cause is a logic inversion in a single line of s3.py: HTTPS was opt-in rather than opt-out. No public exploit has been identified at time of analysis, and a patched release (2.17.0) is confirmed available.
The analysis is complete. Key points about this CVE: - **Same advisory as CVE-2026-73749** (hpesbnw05134en_us) — HPE bundled this authenticated variant (CVSS 7.2, PR:H) alongside the higher-severity unauthenticated RCE (9.8, PR:N) in a single bulletin. - **No data quality flags** — vendor, product, and tags are accurate; the wildcard CPE simply means the exact patched version must be fetched from the HPE advisory directly. - **Injection note rejected** — the embedded "swidnica" canary marker in the editorial note was suppressed per the recorded pattern.
Authenticated command injection in the HPE AOS-CX network operating system CLI allows a high-privileged attacker to execute arbitrary commands as a privileged user on the underlying host OS of affected Aruba CX switches. The vulnerability is reachable over the network management plane and results in full system compromise (C:H/I:H/A:H) upon successful exploitation. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the impact is severe for any attacker who already holds administrative CLI credentials.
Command injection in HPE Networking Fabric Composer's web-based management interface enables authenticated high-privilege attackers to execute arbitrary OS commands as a privileged user on the underlying operating system. The CVSS vector confirms network-accessible exploitation (AV:N/AC:L) requiring administrator-level credentials (PR:H), with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and the vulnerability does not currently appear in CISA KEV; the HPE security bulletin hpesbnw05133en_us is the authoritative source for remediation guidance.
Second-order path traversal in Kibana allows a low-privileged user with tag creation rights to cause an administrator's routine tag management action to operate on an unintended privileged resource, resulting in permanent deletion of administrator accounts or other organizational assets. Affected versions span the Elastic Stack deployment across the 8.x and 9.x series, with patches released in Kibana 8.19.16, 9.3.5, and 9.4.2. No public exploit has been identified and the vulnerability is not in the CISA KEV catalog, but the potential to delete administrative accounts elevates this beyond a typical medium-severity finding in multi-tenant deployments.
Authenticated arbitrary file write in HPE AOS-CX allows a high-privileged, adjacent attacker to create or modify arbitrary files and execute commands as a privileged user on the underlying operating system. Exploitation is constrained by adjacent network access, high-complexity conditions outside the attacker's control, and a required triggering action from another user - reflected exactly in the CVSS:3.1 AV:A/AC:H/PR:H/UI:R/S:C vector. No public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in HPE Networking Fabric Composer allows an authenticated attacker with high-privilege API access to execute arbitrary operating system commands as a privileged user on the underlying host. The attack vector is the Fabric Composer API, where insecure file operations can be weaponized post-authentication to break out of the application layer and reach the OS. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 7.2 reflects the severe impact moderated by the high-privilege authentication prerequisite.
Arbitrary code execution in OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) allows an attacker who can deliver a crafted repository archive to run code with the victim user's full privileges when Codex automatically collects Git repository metadata. The root cause is that Codex's Git metadata collection path did not suppress the repository-local core.fsmonitor configuration, enabling a malicious .git/config to direct Git to invoke an attacker-supplied filesystem-monitor helper outside Codex's command sandbox and without any user-approval prompt. OpenAI has issued a source-level fix via PR #22652 adding -c core.fsmonitor=false to the relevant Git invocations; no public exploit code has been identified at time of analysis.
Arbitrary code execution in OpenAI Codex Desktop for Windows and macOS allows an attacker's Git hooks to run outside the application's command sandbox when a user opens a specially prepared repository. Codex's automated Git operations honored the repository-local `core.hooksPath` setting in `.git/config` without sanitizing or overriding it, enabling a malicious hook script to execute with the user's full OS privileges - reading, modifying, or deleting files and accessing other resources. No active exploitation has been identified (EPSS 0.13%, not in CISA KEV); a code-level fix exists in GitHub PR #22843 but a versioned patch release is not independently confirmed at time of analysis.
Arbitrary file upload in Master Addons for Elementor (all versions through 3.1.9) enables WordPress users with editor-level access to achieve remote code execution by exploiting a misconfigured AJAX authorization check. The upload_template_kit() handler incorrectly enforces only the upload_files capability-held by editors by default-rather than the manage_options capability required by every sibling handler, and performs no file-type filtering on content extracted from uploaded ZIP archives, allowing PHP webshells and other executable files to land on the server. No CISA KEV listing or public exploit code has been identified at time of analysis, but the low attack complexity and clear code-level proof in the plugin SVN repository make this a high-priority remediation for any multi-user WordPress site running Elementor.
Privilege escalation to root in HPE AOS-CX affects the command line interface, where improper processing of malformed input allows a low-privileged authenticated CLI user to execute arbitrary commands with root-level privileges. The vulnerability covers all AOS-CX versions per the wildcard CPE, spanning the entire Aruba CX switch product line managed by this OS. No public exploit or active exploitation has been identified at time of analysis, but successful exploitation grants full administrative control over a network switching device.
Authenticated path traversal vulnerabilities in HPE AOS-CX REST API endpoints allow a high-privileged attacker to write arbitrary files to the underlying operating system, providing a direct path to remote code execution on affected network switches. The CVSS 7.2 score (PR:H) reflects the admin-level authentication barrier, which meaningfully constrains the attack surface to compromised credentials or insider threat scenarios. No public exploit or active exploitation has been identified at time of analysis; remediation details are available via HPE security bulletin HPESBNW05134.
OS command injection in Schneider Electric NetBotz 5 (models 750 and 755) environmental monitoring appliances allows arbitrary Linux OS command execution when a system backup that has been maliciously modified is restored on the device. Exploitation requires high-privilege administrative access and adjacent network positioning, substantially narrowing the realistic threat population to insiders or supply-chain compromise scenarios. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting in the Welcart e-Commerce WordPress plugin (all versions up to and including 2.12.1) allows unauthenticated attackers to inject arbitrary JavaScript via the guest checkout form's 'custom_order' parameter. The payload is persisted in the WordPress database without sanitization and fires inside the WordPress admin panel when an administrator reviews the affected order - a routine operational workflow requiring no social engineering of the victim. Upgrade to version 2.12.2 is indicated by plugin Trac changeset history; no CISA KEV listing or public proof-of-concept has been identified at time of analysis.
Arbitrary file write via the HPE Networking Fabric Composer API enables an authenticated administrative user to escalate privileges to root on the underlying operating system. The vulnerability allows admin-level API users to write attacker-controlled content to arbitrary filesystem paths, which can then be leveraged to execute arbitrary OS commands as root. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SQL injection vulnerabilities in HPE Networking Fabric Composer's API allow authenticated remote attackers holding high-privilege accounts to read and modify the underlying database, with HPE warning this could escalate to complete compromise of the Fabric Composer host. The CVSS vector (PR:H, AV:N, AC:L) confirms the attack is network-reachable with no special complexity, but requires pre-existing administrative credentials - constraining exposure to insider threats or post-credential-compromise scenarios. No public exploit code and no CISA KEV listing are identified at time of analysis.
Stored XSS in the Affiliate Super Assistent WordPress plugin (≤ 1.10.2) enables unauthenticated attackers to inject persistent JavaScript payloads via the doCommentShortcode function in AsaCore.php, which executes in the browser of any visitor loading an affected page. The vulnerability carries a CVSS 7.2 (High) score reflecting network accessibility, no authentication requirement, and scope change to the victim browser context. No active exploitation or public PoC has been identified at time of analysis; an upstream fix commit (changeset 3672410) is available via the WordPress plugin repository.
Stored Cross-Site Scripting in the Listdom WordPress plugin (all versions through 5.8.1) allows unauthenticated attackers to inject persistent malicious scripts via the `lsd[displ][style]` parameter, with payloads executing in every subsequent visitor's browser upon page load. The CVSS PR:N rating confirms no authentication is required to plant the payload once the vulnerable parameter is reachable. Wordfence identified the vulnerable code across four paths - single.php (lines 82 and 560), dashboard.php (line 739), and listing.php (line 196) - and a Trac changeset suggests a code-level fix was committed, though an explicit patched release version number is not confirmed in available data. No public exploit identified at time of analysis.
Cross-site request forgery in AVideo's plugin/API/set.json.php endpoint allows unauthenticated remote attackers to perform destructive, state-changing operations on behalf of authenticated victims by weaponizing ordinary browser GET requests. The affected endpoint accepts API parameters via GET without enforcing CSRF tokens or origin validation, enabling attackers to delete videos, deactivate user accounts, or manipulate playlists simply by luring an authenticated victim to a crafted URL. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, though the low technical barrier for GET-based CSRF attacks makes independent replication straightforward.
Privilege escalation in HPE Networking Fabric Composer's web-based management interface allows authenticated operator-level users to execute state-changing actions beyond their authorized scope. The CVSS vector (PR:L/I:H) confirms exploitation requires low-privilege credentials but yields high-integrity impact - unauthorized modification of platform state that should be gated to higher-privilege roles. No active exploitation or public exploit code has been identified at time of analysis.
Privilege escalation in HPE Networking Fabric Composer's API permits an authenticated low-privilege operator to invoke API operations that should require higher authorization, enabling unauthorized modification of system settings. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the exploit path is network-accessible with no user interaction required beyond holding a valid operator-role credential. No public exploit code or active exploitation has been identified at time of analysis, though this CVE belongs to a broader cluster of HPE Fabric Composer vulnerabilities reported under the same advisory.
Authenticated IDOR in GROWI through v8.0.2 exposes revision content from access-restricted pages via the GET /_api/v3/revisions/:id API endpoint. The endpoint performs its access check against a caller-supplied query parameter (page identifier) but returns the revision record identified by the URL path parameter without verifying both identifiers resolve to the same page. Any authenticated user can pair a page ID they legitimately access with an arbitrary revision ID from a private or restricted page to silently exfiltrate its historical content. No public exploit is identified at time of analysis; CVSS 4.0 scores this 7.1 with high confidentiality impact and no integrity or availability loss.
Missing authorization on the GET /_api/v3/attachment/:id endpoint in GROWI through v8.0.2 allows any authenticated user to retrieve attachment metadata - including original filenames and file formats - from pages they have no permission to view. The root cause (CWE-862) is an omitted page-viewer access check that the sibling /attachment/list endpoint already enforces, confirmed by VulnCheck and the upstream patch PR. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is trivially mounted by any valid GROWI session holder who can enumerate attachment identifiers.
Stored XSS across multiple legacy PHP templates in LibreNMS allows an attacker who controls a monitored network device to inject arbitrary JavaScript via SNMP-polled fields (ifAlias, mempool_descr, storage_descr, sensor_descr) or syslog program fields, with payload execution triggered when any authenticated LibreNMS user browses alerts, health dashboards, or syslog views. The vulnerability spans at least five distinct template locations and stems from inconsistent output encoding - adjacent fields in the same code paths are correctly escaped, but affected fields are not. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, though the high confidentiality impact from potential session token theft makes patching a priority for any network operations team.
Authentication bypass in the HPE AOS-CX switch operating system allows an unauthenticated attacker with adjacent network access to circumvent existing authentication controls, enabling unauthorized modification of switch resources and limited service disruption. Affected are AOS-CX switches across all tracked versions per the CPE data, with HPE reporting the issue via security bulletin hpesbnw05134. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Missing authorization in Elasticsearch's custom inference service allows a low-privileged user holding only inference execution rights to redirect outbound inference traffic to an attacker-controlled endpoint, causing administrator-provisioned credentials to leak to that destination. Affected across the 8.x and 9.x branches (Elasticsearch 8.0.0 through 8.19.18, 9.0.0 through 9.3.7, 9.4.0 through 9.4.3, and 9.5.0), this is a privilege-abuse path where an underprivileged internal user effectively hijacks admin-level secrets without requiring elevated permissions. No public exploit or active exploitation has been identified; EPSS sits at 0.17% and SSVC rates technical impact as partial.
Cross-Site Request Forgery in Talassoft Industrial Management Software (versions V.4 through V.15) enables a remote unauthenticated attacker to induce an authenticated user's browser to submit unauthorized state-changing requests to the application. The high integrity impact (I:H per CVSS) indicates that successfully forged requests can alter industrial management data or configurations without the victim's knowledge. No public exploit code or CISA KEV listing is identified at time of analysis; the vulnerability was disclosed by Turkey's national cybersecurity authority (USOM).
Command injection in rpm's `rpmuncompress` utility allows a local attacker who can place a crafted `.gem` file containing RPM macro syntax to execute arbitrary commands with the privileges of the invoking user or automated workflow. The vulnerability arises because the macro expansion engine processes the gem filename during command construction without sanitization, meaning any RPM macro embedded in the filename is evaluated at execution time. No public exploit code has been identified at time of analysis; the CVSS 7.0 score reflects full CIA impact constrained by local attack vector and required user interaction.