Authenticated low-privilege API access in HPE Networking Fabric Composer allows operator-level users to retrieve sensitive data beyond their authorized scope. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H) confirms any valid operator account can exploit this over the network with no user interaction, obtaining high-confidentiality-impact data such as network topology, service credentials, or configuration details. Per the vendor advisory, the exfiltrated data could serve as a pivot to gain further unauthorized access to network services managed by Fabric Composer. No public exploit or CISA KEV listing is present at time of analysis.
Missing authorization on an internal Kibana APM integration function exposes APM server credentials to any authenticated Kibana user. The affected endpoint was designed for APM or Fleet administrators but lacked the corresponding role-based access control check, allowing lower-privileged authenticated users to retrieve secrets that govern access to the APM backend. No public exploit code or CISA KEV listing exists at time of analysis; however, the straightforward exploitation path and high confidentiality impact from credential exposure make this a meaningful lateral-movement risk in Elastic Stack deployments.
Out-of-bounds read in the HPE AOS-CX network operating system allows adjacent unauthenticated attackers to disclose sensitive OS memory contents by sending a specially crafted packet. The flaw requires no credentials and no user interaction, but is constrained to same-segment network access (AV:A), limiting exposure to attackers who have already achieved a foothold on the target network or VLAN. This is one of several vulnerabilities disclosed in HPE advisory HPESBNW05134, which also covers more severe unauthenticated adjacent RCE issues (CVE-2026-73782, CVSS 8.8) and network-reachable RCE (CVE-2026-73749, CVSS 9.8) in the same product line - those higher-severity siblings should be prioritized alongside this finding. No public exploit has been identified at time of analysis.
Unauthenticated denial-of-service in HPE AOS-CX allows an adjacent-network attacker to crash or disrupt affected switches by sending specially crafted packets, resulting in loss of normal network operations. The vulnerability requires no credentials and no user interaction, making it exploitable by any actor with access to the same Layer-2 or adjacent network segment. No public exploit code or active exploitation has been identified at time of analysis; this is part of a multi-CVE bundle disclosed in HPE bulletin HPESBNW05134, which also covers higher-severity RCE flaws (CVE-2026-73749, CVE-2026-73782) and an auth bypass (CVE-2026-73778) in the same product line.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated operator-level user to modify system settings that the API is intended to restrict to higher-privilege roles. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms network-exploitable with low attack complexity, requiring only a valid operator credential and no user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Buffer overflow conditions in an underlying network service of HPE AOS-CX allow unauthenticated attackers on the adjacent network segment to crash the device by sending specially crafted packets, causing a denial-of-service disruption to normal OS operation. This vulnerability is one of several disclosed together under HPE advisory hpesbnw05134, affecting the CX series switch OS. No public exploit code or active exploitation has been identified at time of analysis.
Uncontrolled resource consumption in Mozilla Firefox's built-in PDF Viewer component allows a remote, unauthenticated attacker to crash or hang the browser by inducing a victim to open a specially crafted PDF file. All Firefox releases prior to version 155 are affected, as confirmed by Mozilla Security Advisories MFSA2026-82 and MFSA2026-86. No public exploit code or CISA KEV listing has been identified, and EPSS at 0.14% (4th percentile) reflects very low real-world exploitation probability.
Sensitive information exposure in HPE Networking Fabric Composer allows an authenticated low-privilege operator user with local access to upstream AFC dependencies to read data outside their authorized scope. The CVSS vector (S:C/C:H) reflects that the confidentiality breach crosses authorization boundaries within the underlying OS layer, not merely within the user's own privilege tier. No public exploit code exists and the vulnerability has not been added to CISA KEV at time of analysis, but the high confidentiality impact and scope change elevate real-world concern for multi-tenant or shared-operator deployments.
NoSQL injection in Kibana exposes unauthorized Elasticsearch data to authenticated low-privilege users who can submit crafted query input. The flaw, classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic / CAPEC-676), allows manipulation of backend NoSQL query logic to return records outside the user's authorized data scope. Elastic has released fixed versions 9.4.5 and 9.5.1 per ESA-2026-168; no public exploit or CISA KEV listing has been identified at time of analysis.
Denial of service in Kibana allows an authenticated user holding Streams management privileges to crash the Kibana process by submitting specially crafted compressed content that expands to a disproportionately large volume during server-side processing, exhausting available memory. The host OS terminates the Kibana process, and the service remains unavailable to all users until manually restarted. The advisory ESA-2026-125 identifies fixed versions as 8.19.21, 9.4.6, and 9.5.2; no public exploit or KEV listing has been identified at time of analysis.
Uncaught exception handling in Kibana's Observability AI Assistant allows any low-privileged authenticated user to crash the entire Kibana Node.js process by submitting a specially crafted request, denying service to all users and spaces on that instance until an administrator manually restarts it. The blast radius is instance-wide regardless of the attacker's permission scope, making this disproportionately severe relative to its CVSS 6.5 Medium rating. Elastic confirmed the fix in versions 9.4.5 and 9.5.1 via advisory ESA-2026-115; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unbounded memory allocation in Kibana's Agent Builder feature allows any authenticated user with minimal read-level privileges to crash the Kibana process, denying service to all users of the affected instance. The vulnerability stems from CWE-770 (no resource throttling), meaning a single low-privileged user can trigger full process termination via one crafted request. Elastic has addressed this in Kibana 9.4.6 via security advisory ESA-2026-84; no public exploit or active exploitation has been identified at time of analysis.
Unthrottled resource allocation in Kibana allows an authenticated network user to submit a specially crafted request that drives excessive server-side resource consumption, potentially rendering the Kibana dashboard fully unavailable. Reported by Elastic and addressed in ESA-2026-48, the vulnerability is classified under CWE-770 and maps to the CAPEC-130 excessive allocation attack pattern. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the fix is confirmed in Kibana 8.19.19 and 9.3.5.
Denial of service in Elastic Kibana allows any authenticated low-privilege user to render the analytics interface unavailable by submitting specially crafted requests that trigger unbounded resource consumption (CWE-770, CAPEC-130). All Kibana versions prior to 8.19.17 and 9.3.0 are affected. No public exploit or CISA KEV listing exists at time of analysis; the risk is real but limited to authenticated accounts.
Argument Injection in Dell PowerStore storage appliances allows an authenticated low-privileged user to extract sensitive system information over the network without requiring additional interaction. The vulnerability (CWE-88) arises from improper neutralization of user-controlled input passed as arguments to an internal process, enabling privilege escalation of read access beyond what the account's role should permit. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and network accessibility make this a credible insider and compromised-credential threat.
Unauthenticated network attackers can elicit Java stack traces from Red Hat IdM's Dogtag CA REST enrollment endpoint (POST /ca/rest/certrequests) by submitting malformed requests, causing HTTP 500 responses that expose internal implementation details under CWE-209. The same error path simultaneously amplifies the CA debug log with large multi-line stack traces, creating a log-fill resource exhaustion vector that drives disk growth and I/O contention on affected RHEL 6 through 10 deployments. No public exploit has been identified at time of analysis, but the attack requires no authentication and low complexity, making it accessible to unskilled opportunistic attackers targeting IdM infrastructure.
Stored Cross-Site Scripting in the Live Composer - Free WordPress Website Builder plugin (all versions through 2.1.19) lets authenticated contributors inject persistent JavaScript payloads via the dslc_module_projects_output shortcode, with those payloads executing in the browser of every subsequent page visitor including site administrators. The root mechanism is WordPress's shortcode-aware kses processing, which serializes and preserves shortcode bodies as opaque placeholders before content filtering runs, allowing attacker-controlled attributes - view_all_link, main_heading_link_title, main_filter_title_all, and button_text - to reach multiple render-time output sinks in the plugin's projects module entirely unescaped. No public exploit has been identified at time of analysis, but the scope change to victim browsers creates a realistic session-hijacking path to full administrative takeover on multi-author sites.
Stored cross-site scripting in the Live Composer Free WordPress Website Builder plugin (all versions up to and including 2.1.19) allows authenticated attackers with contributor-level access to embed persistent JavaScript payloads via the dslc_module_testimonials_output shortcode. The vulnerability exploits a two-phase rendering gap: WordPress's native wp_kses_post filter sanitizes content at save time but treats shortcode markup as opaque, so attacker-controlled values in fields such as main_heading_title, view_all_link, main_heading_link_title, and main_filter_title_all are never escaped - they reach the DOM unfiltered when do_shortcode() executes at page-view time. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence confirmed the flaw through direct code-level review of the testimonials module.
Stored Cross-Site Scripting in the Blocksy Companion WordPress plugin (versions up to and including 2.1.51) allows authenticated attackers with author-level access to inject persistent malicious JavaScript via the unsanitized tagName attribute of the blocksy/dynamic-data Gutenberg block. Any visitor who loads a page containing the injected content will have the script execute in their browser context, enabling session theft, credential harvesting, or further site-level compromise. No active exploitation has been confirmed and a patched release (2.1.52) is available per the plugin Trac changeset; no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in WPBakery Page Builder for WordPress (versions through 8.7.4) allows authenticated attackers with subscriber-level access to persistently inject arbitrary JavaScript into pages viewed by any site visitor. The vulnerability stems from a sanitization bypass: the wp_kses_post function strips HTML tags but cannot neutralize base64-encoded payloads - which appear as plain alphanumeric text - and the vc_raw_html shortcode template subsequently decodes and echoes that content without escaping at render time. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the subscriber-level access barrier is low on many WordPress sites that permit open registration.
Execution-placement isolation bypass in Ansible Automation Platform's automation-controller (AWX) allows authenticated principals to route bulk jobs to instance groups they lack use-level authorization for. The Bulk Job Launch API endpoint (POST /api/v2/bulk/job_launch/) enforces only a read-level permission check on the instance_groups field, whereas the standard single-job launch path correctly requires use-level permission on the same field. A principal holding the built-in System Auditor role-or any role granting read but not use rights on instance groups-combined with execute permission on a job template can silently route automation workloads onto restricted infrastructure segments; no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in Live Composer Free WordPress Website Builder (versions ≤ 2.1.19) allows authenticated contributors to permanently embed arbitrary JavaScript into WordPress pages via the unsanitized 'custom_id' shortcode attribute. The payload is rendered verbatim into the HTML id="" attribute of div elements by dslc_modules_section_front() and dslc_modules_area_front() due to absent esc_attr() output escaping, then executes in the browser of every subsequent visitor - including administrators. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but sites permitting open contributor registration face realistic risk of admin session theft or persistent malicious redirects.
Server-side request forgery in the HPE AOS-CX web-based management interface allows an authenticated attacker with low-privilege credentials to force the switch to issue arbitrary internal HTTP requests, exposing the internal network topology and enabling limited modification of sensitive information. The vulnerability carries a Scope:Changed CVSS designation because the forged requests cross the trust boundary from the management plane into internal infrastructure the attacker cannot otherwise reach. This is the fifth CVE bundled in HPE advisory hpesbnw05134en_us alongside more severe issues including unauthenticated RCE (CVE-2026-73749, CVSS 9.8) and format-string RCE (CVE-2026-73782, CVSS 8.8). No public exploit code and no CISA KEV listing are associated with this CVE at time of analysis.
Stored cross-site scripting in the BetterDocs WordPress plugin (versions through 4.8.1) allows contributor-level authenticated attackers to inject persistent JavaScript that executes in any visitor's browser context. The flaw exploits a two-stage processing gap: entity-encoded quotes in a heading id attribute pass WordPress's wp_kses_post sanitization at save time, but are later decoded by html_entity_decode() inside process_content_for_toc(), after which a lazy regex extracts the now-unescaped value and echoes it directly into the Table of Contents HTML output. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.11) allows authenticated contributors to inject persistent malicious scripts via the 'tag' shortcode attribute, executing in the browser of any user who subsequently visits the compromised page. The scope change (S:C in CVSS) reflects the cross-context impact: scripts run under victims' browser sessions, enabling session hijacking, credential harvesting, or unauthorized actions on behalf of administrators. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored Cross-Site Scripting in the Live Composer WordPress page builder plugin (all versions through 2.1.19) allows authenticated contributors to inject persistent JavaScript payloads via the dslc_custom_field shortcode, executing in any visitor's browser session. Wordfence identified insufficient input sanitization and output escaping in shortcodes.php at multiple code paths (lines 84, 88, 89). No public exploit has been identified at time of analysis, but the vulnerable code is publicly browsable in the plugin's SVN repository and a remediation changeset has been published.
Stored Cross-Site Scripting in the User Profile Builder WordPress plugin (versions up to and including 4.0.0) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'date' shortcode attribute, executing in victims' browsers whenever they visit an affected page. The vulnerability stems from insufficient input sanitization and output escaping in the format-date shortcode handler (format-date.php), identified in the plugin Trac source at lines 7 and 16. No active exploitation has been confirmed at time of analysis, and a fix appears committed upstream per changeset 3666521 on the WordPress plugin repository.
Stored Cross-Site Scripting in WP Recipe Maker Premium for WordPress (all versions ≤ 10.5.0) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'wprm-call-to-action' shortcode's unsanitized attributes. Every subsequent visitor to an injected page executes the attacker's script in their browser, enabling session hijacking, credential harvesting, or privilege escalation to administrator. No public exploit code or CISA KEV listing has been identified at time of analysis.
CPU exhaustion in Erlang/OTP's eldap library allows a malicious or compromised LDAP server to degrade availability by returning referral URLs containing port components composed of up to ~1.26 million digits. The function `eldap:parse_port/2` passes the port substring unbounded to Erlang's `list_to_integer/1`, which performs arbitrary-precision bignum arithmetic - consuming hundreds of milliseconds of CPU time per crafted referral. Exposure is limited to applications that explicitly pass server-supplied LDAP referrals to `eldap:parse_ldap_url/1`, as eldap itself never calls this function; no public exploit or CISA KEV listing exists at time of analysis.
Algorithmic complexity denial-of-service in Erlang/OTP's SNMP library allows remote, unauthenticated attackers on SNMPv1/v2c deployments to exhaust CPU by sending a single crafted PDU containing a BER INTEGER whose length field is set arbitrarily large. The unbounded function `snmp_pdus:dec_integer_notag/1` performs recursive bignum accumulation across every declared byte before any PDU validation or community string enforcement occurs, so work grows superlinearly with the declared length value and a single UDP packet can lock the SNMP agent indefinitely. Affected OTP releases span 17.0 through the unpatched branches of 27.x, 28.x, and 29.x; no public exploit code or CISA KEV listing has been identified at time of analysis.
Constraint bypass in ash_typescript typed-controller routes allows remote attackers to submit argument values outside declared allowlists or bounds by exploiting a missing validation step in the Ash type pipeline. Affected versions 0.15.0 through 0.17.x call Ash.Type.cast_input/3 but never invoke Ash.Type.apply_constraints/3, leaving constraints such as one_of, max_length, min, max, and match silently unenforced at runtime. Where these constraints gate role membership, status transitions, or other security-relevant decisions in the route handler, the bypass enables privilege escalation or state-machine abuse; a vendor-released patch is available in 0.18.0. No public exploit identified at time of analysis.
CPU exhaustion in Erlang/OTP's `inets httpc` HTTP client allows a malicious or compromised HTTP server to degrade the availability of any OTP process making outbound HTTP calls by returning numeric headers - specifically Content-Length or Retry-After - containing strings of up to approximately 1.26 million digits. Erlang/OTP versions 17.0 through 29.x are affected across three release lines, covering inets 5.10 through 9.7.2. The attack costs the requesting process hundreds of milliseconds of arbitrary-precision arithmetic per response, and the existing `max_body_size` guard offers no protection because integer conversion occurs before the bound check; the option also defaults to `nolimit`. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Sensitive application data leaks from HTTP 500 responses in ash_typescript versions 0.15.0 through 0.17.x due to an ungated code path that serializes handler return values verbatim using Elixir's inspect/2. Any unauthenticated caller who can trigger a typed-controller route whose handler falls through with a non-conn term - such as {:error, %User{}} - receives the full Elixir struct inspection, potentially including hashed passwords, session tokens, and tenant identifiers, in the JSON error body. No public exploit identified at time of analysis, but the disclosure is trivially reproducible with a standard HTTP client given the right application-layer condition.
Sensitive internal error data - including runtime secrets potentially carried in Ash error vars fields - leaks to unauthenticated network clients in ash_typescript 0.8.0 through 0.17.x when a configured error handler raises a FunctionClauseError on an unmatched error shape. The rescue clause in apply_error_handler/3 was intended as a safety net but fell back to returning the original, unredacted error map rather than a safe generic response, inverting the intended suppress-on-failure semantics. No public exploit code has been identified and there is no CISA KEV listing; a patched release (0.18.0) is available from the Ash Project.
Authorization bypass in gRPC-Go's xDS RBAC HTTP filter prior to v1.83.1 allows network attackers to evade DENY policies when header matcher names use mixed case. Because gRPC metadata keys are always lowercased at the protocol layer, a DENY rule configured with canonical HTTP capitalization (e.g., `X-Role`, `User-Agent`) never fires, causing the policy to fail open and permit requests it should block. The same case mismatch also enables bypass of gRFC A41 pseudo-header validation (`:Scheme`, `Grpc-Status`) and prevents `Host` from being rewritten to `:authority`. No public exploit is identified at time of analysis; a vendor-confirmed fix ships in v1.83.1.
Cross-site scripting in SVGO's opt-in removeScripts plugin allows XSS payloads embedded inside SVG foreignObject elements to survive optimization unchanged. Applications that process attacker-supplied SVG through SVGO with this plugin enabled and then serve the output in a browser context are exposed: event-handler attributes, srcdoc iframe payloads, and executable URL schemes (javascript:, vbscript:, data:text/html) in action/data/formaction/href/src attributes all pass through unmodified. No public exploit is identified at time of analysis; fixed in SVGO 2.8.4, 3.3.5, and 4.1.0.
Uncontrolled memory allocation in NousResearch hermes-agent up to 0.18.2 allows a low-privileged remote attacker to exhaust memory resources by manipulating input to the list_tools function within the MCP Tool component (tools/mcp_tool.py). The vulnerability is a denial-of-service class issue (CWE-789) with low availability impact per the CVSS 4.0 vector, and a public proof-of-concept report describing resource amplification behavior has been published on GitHub. No vendor patch exists, as the vendor did not respond to coordinated disclosure.
Denial of service in NousResearch hermes-agent affects the HermesACPAgent.prompt function within acp_adapter/session.py, exploitable by low-privileged remote users through the ACP Prompt Workflow interface. Versions up to and including 0.18.2 are confirmed affected, with no vendor patch issued following pre-disclosure contact. A public proof-of-concept exploit is available on GitHub, lowering the barrier to exploitation against exposed deployments.
Stored XSS in the Apache Spark History Server (versions 3.0.0 through 3.5.7) allows a user with Spark job submission rights to inject unsanitized HTML/JavaScript into the History Server web UI via the application name field (spark.app.name), which executes in the browser of any higher-privileged user who subsequently views that job's history page. Apache rates this low severity due to layered prerequisites - the attacker must hold job submission rights and socially engineer an administrator into visiting the History Server. No public exploit has been identified at time of analysis; the vendor-released fix is Spark 3.5.8.
Invoice Ninja's Vendor Portal Profile Update endpoint (versions up to 5.13.26) contains an IDOR flaw in VendorContactController that allows an authenticated vendor portal user to overwrite any other vendor contact's profile by substituting a different vendor_contact ID in the update request URL. The root cause is a missing authorization check - the controller accepted raw Laravel requests with no ownership validation. A public exploit write-up and POC exist, confirmed by the VulDB report and a researcher blog post, elevating urgency despite the absence of CISA KEV listing. No special conditions beyond a valid vendor portal account are required.
Stored XSS in the User Profile Builder WordPress plugin (all versions through 4.0.0) allows unauthenticated attackers to inject malicious JavaScript via the email parameter submitted during user registration. The payload persists in the unconfirmed email addresses database and executes in the browser of any administrator with manage_options capability who visits the Users > Unconfirmed Email Addresses list table and interacts with row-action links, because the row_actions() function renders the stored email value verbatim as a javascript: href. No public exploit has been identified at time of analysis, and an upstream fix is available via SVN changeset 3666521.
Server-side request forgery in Invoice Ninja up to version 5.13.26 allows authenticated remote attackers to coerce the application server into issuing arbitrary outbound HTTP requests by injecting malicious URLs into invoice note fields. The flaw lies in the `Purify::isHostSafe()` method within `app/Services/Pdf/Purify.php`, which inadequately validates the `notes` parameter before the PDF rendering pipeline processes it. A public proof-of-concept has been disclosed by the researcher; no vendor patch or acknowledgment has been issued, leaving all installations at or below 5.13.26 without an official remediation path.
Reflected cross-site scripting in the HPE Networking Fabric Composer web management interface allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim administrator's browser by tricking them into following a crafted URL. The CVSS Scope:Changed metric confirms the injected script executes across the browser security boundary, enabling session token theft, credential harvesting, or unauthorized administrative actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis.
Clickjacking in Firefox's DOM Events component allows an unauthenticated remote attacker to redirect a victim's browser interactions from an overlaid or framed context, resulting in limited confidentiality and integrity impact across an origin boundary. All Firefox versions prior to 155 and Firefox ESR versions prior to 153.2 are affected, per multiple Mozilla security advisories (mfsa2026-82, mfsa2026-85, mfsa2026-86, mfsa2026-88). No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) reflects very low observed exploitation probability.
Cross-site scripting in Firefox's DOM Navigation component allows a remote unauthenticated attacker to inject and execute script content across security origins when a victim visits a specially crafted webpage. The vulnerability is classified CWE-79 with scope change (S:C), indicating potential cross-origin impact beyond the attacked page. Mozilla patched this in Firefox 155 and Firefox ESR 153.2, with coverage across multiple advisory tracks (mfsa2026-82, -85, -86, -88). No public exploit code or active exploitation has been identified at time of analysis.
SQL injection in Xinhu Rainrock RockOA (versions up to 2.3.2) allows low-privileged remote attackers to manipulate database queries via the `Value` argument in the `toaddval` function at `/index.php?m=index&a=publicsavevalue&ajaxbool=true`. A public proof-of-concept exploit exists, and the vendor did not respond to responsible disclosure, leaving no official patch available. CVSS 4.0 rates impact as uniformly Low across confidentiality, integrity, and availability, suggesting bounded data exposure rather than full database compromise. No public exploit identified at time of analysis meets the CISA KEV threshold.
SQL injection in Xinhu Rainrock RockOA up to version 2.7.6 allows authenticated remote attackers to manipulate backend database queries via the `highorder` argument in the `getOrder` function of `webmain/webmainAction.php`. The CVSS 4.0 vector confirms network-accessible exploitation requiring low-privilege authentication, with limited but real confidentiality, integrity, and availability impact. A public proof-of-concept exploit has been published on GitHub (E:P); the vendor did not respond to coordinated disclosure, leaving no official patch available.
Command injection in ICP DAS UA-2200 and UA-5200 industrial IoT gateways (firmware up to 20260704) allows a network-authenticated attacker to execute arbitrary OS commands by manipulating the ParameterArray argument in the SetHostname CGI API endpoint. A publicly available proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving users without an official patch or mitigation guidance. Given that these are OT/ICS-class devices, successful exploitation may impact industrial operations, data integrity, and device availability beyond the immediate device itself.
Directory namespace isolation failure in Erlang/OTP's inets httpd mod_auth module allows an authenticated low-privilege user to bypass access controls on protected directories they were never granted access to. Servers using dets or mnesia persistence backends with multiple directory configuration blocks across OTP 17.x through 29.x are affected, with patched releases available for all three supported branches. No active exploitation has been confirmed and no public exploit code exists at time of analysis, but the horizontal privilege escalation within a running inets instance poses a meaningful risk to any deployment using per-directory access tiering.
Path traversal in Sage Employee Self Service's custom logo functionality exposes arbitrary server-side files to unauthenticated remote attackers. The flaw stems from insufficient sanitization of file path parameters, allowing directory traversal sequences and their URL-encoded equivalents to escape the application's intended filesystem scope and read sensitive data such as configuration files, environment settings, and logs. No public exploit or CISA KEV listing is present; Sage has remediated the issue via enhanced path validation shipped in the Q2 2026 HRMS product update.