Privilege escalation in F5 BIG-IP and BIG-IQ allows any authenticated user - regardless of assigned role - to create administrative accounts on the device by sending an undisclosed request to the Traffic Management User Interface (TMUI). The flaw is a control-plane-only issue (no data-plane exposure) but grants a low-privileged attacker full administrative authority over the BIG-IP management plane, including traffic policy, certificate management, and device configuration. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the low attack complexity and broad affected version scope make this a high-priority patching target for any organization running BIG-IP.
Privilege escalation in Craft CMS before 5.10.11 allows authenticated non-admin users holding the administrateUsers permission to perform a full control-panel takeover by minting valid password reset URLs for administrator accounts. The actionGetPasswordResetUrl endpoint omits a check that the caller holds admin status, and the downstream actionSetPassword endpoint validates only the cryptographic verification code without inspecting the caller's session - meaning any valid reset token is redeemable regardless of who requested it. No public exploit or KEV listing exists at time of analysis, but the attack is mechanically straightforward for any user who has been delegated the administrateUsers permission.
Cross-site authorization bypass in Craft CMS before 5.10.11 allows authenticated GraphQL API token holders to escape their assigned site scope and read, modify, or delete content entries belonging to sites they are not authorized to access. The flaw exists in GraphQL entry mutation resolvers, where ArgumentManager::prepareArguments() accepts a caller-supplied siteId argument without verifying the token's authorization against the requested site. The vendor-released patch at 5.10.11 addresses the issue; no active exploitation or public exploit code has been identified at time of analysis.
Unauthenticated access to the internal organization loadOrSearch endpoint in APITable through 1.13.0-beta.1 exposes complete workspace member directories-including names, email addresses, and team hierarchy-to any remote attacker who possesses a valid space identifier. Space identifiers are trivially obtainable from shared links or public templates, making this effectively a zero-prerequisite information disclosure against any APITable deployment with sharing enabled. No public exploit code or active exploitation has been identified at time of analysis, but the attack requires only standard HTTP tooling and no credentials.
SQL injection in Baserow 2.3.3's index() formula function allows low-privileged authenticated users to supply an undocumented fourth argument that is interpolated directly into a PostgreSQL expression without sanitization. Because formula recalculation runs through Baserow's shared database connection, injected SQL executes with the Baserow PostgreSQL role's privileges - bypassing application-layer access controls and granting read and write access to all database contents reachable by that role. Reported by Fluid Attacks; no public exploit code or CISA KEV active exploitation listing exists at time of analysis.
Remote unauthenticated denial-of-service conditions in Cisco IOS XR Software stem from multiple insufficient control flow management flaws (CWE-691) discovered during an internal Cisco security hardening review. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) indicates network-accessible, zero-friction exploitation with scope change, meaning the availability impact can propagate beyond the directly targeted device to affect connected or dependent network infrastructure. No active exploitation has been identified and no public proof-of-concept exists at time of analysis; Cisco has proactively released software hardening builds addressing these issues.
Configuration injection in NGINX Gateway Fabric allows authenticated Kubernetes users with CRD or Secret write permissions to embed arbitrary NGINX directives into the generated server configuration. The vulnerability originates in the NGINX configuration generator component, which renders Authentication Filter fields - clientID, cookieName, and clientSecret - directly into configuration templates without sanitization. Successful exploitation is limited to the control plane; no data-plane traffic is directly manipulated, but an attacker can introduce directives that compromise confidentiality and integrity of the NGINX Plus configuration. No public exploit has been identified and the issue is not listed in CISA KEV at time of analysis.
Stored XSS in SiYuan before v3.8.2 enables authenticated users with upload access to bypass the asset extension blocklist by using file types such as .xht, .ehtml, .xsl, .xbl, or .rdf that browsers render as executable documents. When a victim opens or previews the malicious asset, embedded JavaScript runs in the SiYuan application context, allowing theft of API tokens and full workspace compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; the fix is available in v3.8.2.
Prototype pollution in the TOON serialization library (all versions prior to 2.3.1) allows unauthenticated remote attackers to corrupt Object.prototype in any Node.js application that decodes attacker-controlled TOON input. The vulnerability spans multiple decode paths - dotted-key expansion via __proto__, plain nested objects, tabular rows, quoted keys, and streaming decode - as well as the encoder's normalization pipeline. Depending on the downstream dependency tree, exploitable outcomes range from reliable denial of service to remote code execution via prototype-pollution gadget chains; no public exploit or active exploitation is confirmed at time of analysis.
Stack-based buffer overflow in the GPU component of Google Chrome on Windows (prior to 152.0.7977.75) enables full sandbox escape and arbitrary code execution on the host operating system. Exploitation is a two-stage chained attack: an attacker must first compromise the renderer process (via a separate vulnerability or exploit), then leverage this GPU flaw to break out of Chrome's sandbox and execute code with elevated host privileges. Google has released a patch in the stable channel update for desktop; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in Google Chrome's Browser process prior to version 152.0.7977.75 enables sandbox escape, allowing an attacker who has already compromised the renderer process to execute arbitrary code outside the Chrome sandbox via a crafted HTML page. The CVSS vector (AV:N/AC:H/S:C/C:H/I:H/A:H) reflects both the network-reachable delivery and the scope change from renderer to host-level execution. No public exploit or CISA KEV listing has been identified at time of analysis, but sandbox-escape primitives of this class are highly valued in exploit chains.
Sandbox escape in Google Chrome's TabStrip component (versions prior to 152.0.7977.75) allows a remote attacker who has already achieved renderer process compromise to execute arbitrary code outside the Chrome sandbox via incorrect authorization in tab management IPC. The attack chain requires two conditions to be met simultaneously: a prior renderer exploit and social engineering to deliver a crafted HTML page - placing this firmly in the chained-exploit category despite the high CVSS base score. A vendor-released patch is available in Chrome 152.0.7977.75; no public exploit code or active exploitation has been identified at time of analysis.
Protection mechanism failures in Cisco IOS XR Software allow remote unauthenticated attackers to achieve high availability disruption and limited integrity impact against affected routers. Discovered through Cisco's own internal security audit, this CVE bundles multiple CWE-693 class weaknesses addressed in a coordinated hardening release. No active exploitation has been identified, but the combination of network-reachability, no authentication requirement, and an A:H CVSS impact score makes this a high-priority patch for service-provider and carrier-grade router deployments.
curl and libcurl through version 8.21.0 incorrectly handle domain-scoped cookies for Public Suffix List (PSL) domains, permitting a malicious server to set cookies scoped to a PSL entry rather than rejecting them as standards require. This flaw enables cross-subdomain cookie propagation under shared public suffix registries (e.g., github.io, co.uk), potentially exposing session tokens or enabling session fixation against other services the victim connects to under the same PSL domain. No public exploit code exists and CISA KEV listing is absent; the vulnerability was fixed in curl 8.22.0 released September 2, 2026.
Arbitrary file deletion in the WP File Download WordPress plugin (all versions, by JoomUnited) allows any authenticated subscriber-level user to delete files outside the plugin's intended directory, with trivial escalation to remote code execution by targeting wp-config.php. The vulnerability stems from two AJAX endpoints - file.save and file.delete - that lack both WordPress capability checks and nonce enforcement, permitting the two-stage exploit chain against any authenticated session. No public exploit code has been confirmed at time of analysis, but the Wordfence advisory describes the precise two-request mechanism in sufficient detail to enable rapid weaponization.
Authentication bypass in self-managed Grafana allows a low-privileged, already-authenticated user to be resolved as a different — potentially higher-privileged — user, up to Grafana Administrator, when Auth Proxy authentication is combined with identity caching (sync_ttl greater than zero). The flaw is a cache-key collision: the identity cache concatenated the username and forwarded proxy attributes without a delimiter, so crafted attribute values can produce the same key as a victim's cached entry. Only self-managed Grafana OSS and Enterprise deployments behind an Auth Proxy with caching enabled are affected; Grafana Cloud, default configurations, and instances without Auth Proxy caching are not. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is low (0.34%, 27th percentile) despite the high CVSS base of 8.1.
Remote code execution in Progress Telerik UI for ASP.NET AJAX (prior to v2026.3.812) is achievable by an attacker who has first obtained the application's encryption key material and uses it to forge or tamper with dialog request parameters consumed by the RadEditor file browser component. By manipulating the folder paths the file browser reads from, writes to, and uploads into, the attacker can redirect uploads to a web-accessible directory and plant a malicious ASPX webshell, achieving server-side code execution. No public exploit has been identified at time of analysis, and the prerequisite of key material compromise meaningfully constrains real-world exploitation despite the high CVSS score.
HTTPX2's SOCKS5 proxy implementation omits TLS negotiation for WebSocket Secure (wss://) origins, exposing the full WebSocket session - opening handshake, query parameters, Authorization headers, cookies, and message frames - in plaintext to anyone who can observe or control the proxy path. Affected are applications using Client.websocket() or AsyncClient.websocket() in HTTPX2 versions 2.6.0 through 2.9.1 when routing through a SOCKS5 proxy. An adjacent-network attacker can passively eavesdrop on or actively modify traffic, and can impersonate the WebSocket server due to the missing certificate verification step. No public exploit code has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog.
Sandbox escape in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows allows a local attacker to execute arbitrary code outside the Chrome sandbox via a crafted local program, affecting all Chrome for Windows versions prior to 152.0.7977.75. The root cause is incorrect authorization (CWE-863) within the Chromoting subsystem, where flawed authorization logic fails to restrict a local program from interacting with Chromoting in a way that crosses the sandbox boundary. Google has released a patched version (152.0.7977.75), and no public exploit has been identified at time of analysis, though the full post-sandbox C:H/I:H/A:H impact warrants prompt remediation.
OS command injection in Nuclio's local Docker platform dashboard allows remote attackers to execute arbitrary shell commands as root inside the dashboard container, which holds the Docker socket, enabling full host compromise. The function namespace value - controllable via the unauthenticated (default 'nop' auth) API - is string-interpolated without quoting into a `docker ps --filter` command executed via `/bin/sh -c`, allowing a double-quote character to break out of the filter token and inject arbitrary commands. The issue is fixed in version 1.17.4, with the patch confirmed via GitHub release tag and PR #4220; no public exploit identified at time of analysis.
Stored cross-site scripting in Jenkins SonarQube Scanner Plugin ≤2.18.3 allows attackers holding Item/Configure permission to inject javascript: scheme URLs into dashboard links the plugin constructs from SonarQube scanner results. The plugin performs no URL-scheme validation, so a malicious javascript: payload persists in the Jenkins UI and executes in any victim's browser that views or interacts with the affected dashboard link. No public exploit or active exploitation has been identified at time of analysis; the Jenkins security team confirmed and published this issue on 2026-09-02.
Command injection in rpm's `rpmbuild -t*` subcommand allows arbitrary command execution with build-user privileges when an attacker controls the path or filename of a tarball being processed. The vulnerability arises because shell metacharacters in tarball names are not sanitized before being passed to a shell invocation inside rpmbuild. Exploitation is most realistic in automated CI/CD pipelines that fetch externally supplied artifact archives and pass them directly to rpmbuild, a common pattern in open-source package maintainer workflows. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Command injection in rpmuncompress allows a local attacker to execute arbitrary commands under the invoking user's context by supplying an archive file whose filename contains shell metacharacters. Affecting all actively supported Red Hat Enterprise Linux versions (6 through 10) and Red Hat Hardened Images, the flaw is triggered when a user or automated build pipeline invokes rpmuncompress on a maliciously named archive. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and broad RHEL enterprise deployment footprint make this a meaningful risk for organizations processing untrusted archives in development or CI/CD workflows.
Privilege escalation in util-linux's nsenter --join-cgroup option allows an unprivileged local user to move and terminate root-owned host processes by exploiting a persistent file descriptor opened as root that survives across namespace and credential changes. The kernel evaluates cgroup migration requests against the credentials held at fd-open time rather than the current caller's credentials, so any program that inherits the still-open cgroup.procs fd effectively retains root's cgroup management authority. Red Hat Enterprise Linux 7-10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 are confirmed affected; no public exploit has been identified at time of analysis.
Local privilege escalation in Elastic Agent on Windows enables a low-privileged local user to achieve SYSTEM-level code execution by exploiting overly permissive access controls (CWE-732) on resources created during unprivileged-mode installation. The agent service, running as SYSTEM, will execute attacker-controlled binaries placed via the CAPEC-642 binary replacement technique. Vendor-released patches 8.19.21, 9.4.6, and 9.5.2 are available per advisory ESA-2026-150; no public exploit identified at time of analysis.
Local privilege escalation in util-linux's SUID mount(8) binary exposes all major Red Hat Enterprise Linux versions (7-10), Red Hat Hardened Images, and OpenShift Container Platform 4 to root-level file ownership and permission manipulation by low-privileged local users. The flaw stems from a time-of-check to time-of-use (TOCTOU) race: mount(8) reads the bind-mount source from fstab but does not pin the resolved inode before issuing the privileged syscall, allowing an attacker with write access to the source path or a writable ancestor to substitute an arbitrary host directory. When fstab entries additionally specify X-mount.owner, X-mount.group, or X-mount.mode, root subsequently applies chown or chmod to the attacker-redirected path, completing the privilege escalation. No public exploit code or CISA KEV listing is identified at time of analysis.
OS command injection in Westermo WeOS 5.x (versions 5.24 and later) allows an authenticated administrator to execute arbitrary shell commands on the underlying device operating system by supplying a crafted media definition through the management interface. The scope change component of the CVSS vector confirms exploitation breaks out of the management application context into the OS layer, enabling full device compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CISA issued ICS advisory ICSA-25-261-01, elevating concern for operators in critical infrastructure sectors.
Template injection in Eclipse Ditto's ImplicitThingCreationMessageMapper (versions 1.3.0 through 3.9.6) allows authenticated connection publishers to override the administrator-configured access policy of a newly provisioned digital twin by embedding JSON-breaking characters in attacker-controlled inbound message headers. The mapper substitutes header placeholder values as raw, unescaped strings into a pre-configured JSON thing-template before parsing, enabling a crafted header value containing a double-quote to escape its string context and inject an inline _policy object - effectively granting the attacker full read/write access to the twin while permanently revoking the legitimate owner's access. Exploitation requires a non-default mapper configuration and a template that reflects attacker-controllable headers; no public exploit code or active exploitation (CISA KEV) has been identified.
OS command injection in Jenkins TICS Plugin 2025.1.1 and earlier allows an authenticated, low-privileged Jenkins user who can control build environment variable values to execute arbitrary commands on the build agent hosting the job. The flaw stems from unsanitized environment variable values being passed directly to OS command invocations within the plugin, and the scope change (S:C) means impact falls on the agent node rather than the Jenkins controller. No public exploit code exists and SSVC rates exploitation status as none with non-automatable attack path, placing real-world priority lower than the raw CVSS score suggests.
Missing authorization on the `set_course_mode_price()` instructor endpoint in Open edX Platform allows any authenticated user - including learner accounts with zero course roles - to overwrite the honor-mode price and currency for any course on the platform. The view at `lms/djangoapps/instructor/views/instructor_dashboard.py:430` enforces only `@login_required` with no course-level role check, and became an orphaned API route after its companion frontend modal was removed. No public exploit code has been identified at time of analysis, but the low barrier (any valid session) makes automated mass-price manipulation trivially scripted against internet-facing LMS instances.
Unauthenticated remote denial of service in Libreswan's pluto IKE daemon allows any network attacker to repeatedly crash and restart the VPN service by sending a malformed X.509 certificate in a CERT payload during IKE handshake negotiation. The crash is triggered by a reachable assertion in `add_decoded_cert()`: when NSS's `CERT_ExtractPublicKey()` receives a certificate with an invalid RSA exponent (e.g., zero), it returns NULL, which the FIPS-mode code path does not handle, causing the daemon to abort. The vendor explicitly confirms no remote code execution is possible; impact is limited to availability. No CISA KEV listing and no public exploit code have been identified at time of analysis.
Path traversal in the RadImageEditor component of Progress Telerik UI for ASP.NET AJAX (all versions prior to v2026.3.812) allows unauthenticated remote attackers to read arbitrary files from the server by supplying crafted state values that manipulate the control's image cache lookup. The vulnerability stems from insufficient server-side validation of client-controlled input that determines which file the cache mechanism retrieves, enabling directory traversal beyond the intended image directories. No public exploit has been identified at time of analysis, but the low-complexity unauthenticated attack vector makes this a practical risk for any internet-exposed ASP.NET application using RadImageEditor.
Memory exhaustion via unbounded decompression in HTTPX2 (all versions before 2.12.0) allows any HTTP server the client contacts to cause severe memory pressure or out-of-memory process termination by returning a crafted compressed response body. The content decoders in `_decoders.py` call `decompress()` without a size cap, so a single 64 KiB compressed chunk can inflate to approximately 64 MiB in one allocation across gzip, deflate, brotli, and zstd encodings - all enabled by default. No active exploitation is confirmed in CISA KEV, and no public proof-of-concept is referenced, but the decompression-bomb technique is well understood and trivially reproducible.
Script execution enforcement failure in Sonatype Nexus Repository 3 allows privileged authenticated users to invoke pre-existing Groovy scripts via POST /service/rest/v1/script/{name}/run even after administrators explicitly set nexus.scripts.allowCreation=false to disable the scripting subsystem. The execution endpoint did not consult the administrative flag, meaning a hardening action administrators believed fully blocked script activity was silently ineffective against execution of pre-existing scripts. A vendor-released patch is available in Nexus Repository 3.96.0; no active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified.
URI authority injection in fast-uri allows an attacker-supplied port value containing delimiter characters to demote the intended host to userinfo and redirect the parsed authority to an attacker-controlled hostname, bypassing downstream re-validation because both fast-uri and Node.js's built-in URL parser silently accept the malformed output as well-formed. Applications in the Fastify ecosystem that build URIs from parts — passing untrusted data into the port field of a URI object through serialize, normalize, or equal — on fast-uri versions before 2.4.6, 3.1.7, or 4.1.4 are affected. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV; vendor-released patches are available across all three active release lines.
Host-parsing ambiguity in fast-uri allows attackers to silently bypass SSRF denylists, redirect allowlists, and proxy routing rules by submitting URLs containing unbalanced authority brackets. Affected versions 2.4.5, 3.1.6, and 4.1.3 of the Fastify ecosystem URI parsing library return the malformed bracket-containing string as the host without raising an error, while Node.js's URL implementation and downstream HTTP clients resolve the same string to an entirely different host. Any application that reads the fast-uri-parsed host to enforce a security policy, then passes the original URL to an HTTP client, evaluates its controls against a string that is never the host the request actually reaches.
Heap-use-after-free in libcurl versions 8.14.0 through 8.21.0 allows remote unauthenticated attackers to crash applications performing concurrent TLS transfers via the multi interface. When libcurl builds against OpenSSL 3 with provider configurations, an allocated OpenSSL library context is tied to an easy handle's lifetime without an ownership reference being passed to OpenSSL; if the easy handle is destroyed while a pooled TLS connection remains active, subsequent I/O or post-handshake operations dereference the freed context, triggering a heap-use-after-free. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and EPSS remains low at 0.22% (12th percentile).
Secure-flag stripping in curl 8.13.0 through 8.21.0 allows a server to cause curl to transmit session cookies over unencrypted HTTP by returning a Set-Cookie header that places a horizontal tab character (ASCII 9) instead of a space immediately before the Secure attribute. curl's cookie parser fails to recognise the attribute under this condition, stores the cookie without its Secure constraint, and subsequently includes it in plaintext HTTP requests to the same host. No public exploit code has been identified and EPSS probability is 0.22% (12th percentile), reflecting low observed exploitation activity despite the straightforward triggering mechanism.
Connection pool mismanagement in libcurl silently reuses HTTPS connections across requests that differ in their `CURLSSLOPT_NATIVE_CA` (Native CA Store) SSL option, affecting all curl releases from 7.71.0 through 8.21.0. When an application uses a shared connection pool to the same hostname with mixed native CA settings, libcurl fails to distinguish connections by their CA trust configuration, potentially applying the wrong certificate authority validation to a subsequent request. No public exploit code exists and EPSS sits at 0.21% (12th percentile), indicating low active exploitation probability, though the vulnerability's broad version footprint - spanning several years of releases - makes it relevant wherever libcurl is deployed with mixed native CA configurations.
Connection deadlock in golang.org/x/crypto/ssh (all versions before 0.56.0) allows a malicious remote SSH peer to permanently freeze an SSH connection by flooding the incomingRequests queue of a channel that has been registered in the mux's chanList but not yet established. The attack exploits the absence of any established-state guard in the packet handler, causing a deadlock that renders the entire connection unresponsive without triggering an explicit teardown. No public exploit has been identified and no CISA KEV listing exists, but the network-accessible, no-authentication CVSS vector makes this straightforward to trigger against any Go application using this library for SSH.
Denial-of-service in the Go extended cryptography library's SSH package allows a malicious peer to deadlock an entire SSH connection by sending crafted RFC 4254 channel messages after a channel is established. All versions of golang.org/x/crypto/ssh below 0.56.0 are affected; the flaw manifests because unrecognized channel messages were buffered and allowed to block rather than being rejected as protocol errors. No public exploit or active exploitation has been identified, but the attack requires no privileges in the worst-case client scenario where a malicious SSH server targets a connecting client.
Public key pinning enforcement in libcurl (versions 7.45.0 through at least 8.21.0) is silently bypassed when CURLOPT_PINNEDPUBLICKEY is combined with CURLOPT_SSL_VERIFYPEER=0 and CURLOPT_SSL_VERIFYHOST=0 - the exact configuration adopted by applications that rely on pinning as their sole TLS trust anchor after disabling standard certificate chain validation. When a server presents no certificate at all, libcurl's pin-check code path is never reached and the connection succeeds, enabling a network-positioned attacker to conduct MITM attacks against applications that believed pinning would protect them. No public exploit is identified at time of analysis and EPSS stands at 0.14% (4th percentile), indicating limited opportunistic exploitation activity despite the broad version range affected.
Certificate validation bypass in libcurl (curl 8.9.1 through 8.21.0) with the wolfSSL TLS backend allows a network-positioned attacker to intercept encrypted communications by exploiting a post-callback CA store reinstatement bug. When an application uses CURLOPT_SSL_CTX_FUNCTION to install a custom trust store at connection time, libcurl silently overwrites that callback-selected store with the previously cached CA bundle, causing certificates that the callback explicitly rejected to be accepted without error. EPSS is 0.13% (3rd percentile) and no active exploitation is confirmed, but exploitation against a susceptible deployment is conceptually straightforward for a MITM-positioned adversary with a suitable certificate.
Memory exhaustion via crafted HTTP stream causes a persistent denial of service on Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 running Cisco SIP Software, requiring a manual reboot to recover. The root cause is CWE-401 (missing release of memory after effective lifetime) in the device's HTTP packet processing path: an attacker sends a continuous stream of specially crafted HTTP packets, causing the phone to leak memory until it becomes unavailable. Exploitation is gated on a non-default configuration - Web Access must be explicitly enabled on devices registered to Cisco Unified Communications Manager - materially limiting real-world attack surface despite the network-accessible vector. No public exploit code and no CISA KEV listing were identified at time of analysis.
Unauthenticated sensitive data exposure in dotstore's WooCommerce Product Attachment plugin (versions <= 2.3.3) allows remote, unauthenticated attackers to retrieve product attachment files that should be access-controlled. The vulnerability stems from insufficient authorization checks on attachment retrieval endpoints, classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). No active exploitation has been confirmed by CISA KEV, and no public exploit code is identified at time of analysis, but the low attack complexity and zero-authentication requirement make opportunistic access trivial for any network-reachable attacker.
libcurl's SASL state machine for LDAP authentication incorrectly treats an incomplete cryptographic handshake as a fully verified authentication exchange, allowing a Man-in-the-Middle attacker to inject a premature termination message that bypasses peer validation entirely. All curl releases from 7.82.0 through 8.21.0 are affected, spanning a multi-year release history documented in EUVD-2026-72164 and the curl project's own advisory. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though successful exploitation grants an attacker the ability to intercept LDAP credentials and inject falsified directory responses.
Session fixation in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) allows an attacker who can serve content on the same site as Jenkins to inject a known session cookie into a victim's browser; when the victim subsequently authenticates via the persistent 'remember me' cookie without session rotation, the attacker inherits the fully authenticated session. The attack chain requires low-privilege same-site content delivery access and active victim participation in a remember-me login flow, meaningfully constraining real-world exploitability. Vendor patches (Jenkins 2.580 and LTS 2.568.3) are available per the Jenkins Security Advisory published 2026-09-02; no public exploit code or CISA KEV listing exists at time of analysis.
Privilege escalation in the Motorola Smart Connect mobile application stems from insufficient authorization controls (CWE-862) on the dashboard UI, which can be manipulated by third-party applications installed on the same device. When paired with a phishing attack targeting the device user, this manipulation enables an attacker to escalate privileges within the device or connected system. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Path traversal in Kibana's Fleet feature enables a low-privileged attacker with Fleet Settings write access to plant a malicious pathname in settings that, when subsequently acted upon by an administrator, causes deletion of privileged internal resources including user accounts and organizational assets. All Kibana versions prior to 8.19.18, 9.3.6, and 9.4.3 are affected per ESA-2026-158. No public exploit code or active exploitation has been confirmed; the two-party nature of the attack - requiring both attacker write access and administrator interaction - moderates opportunistic exploitability despite the High CVSS rating.
Cross-site scripting (XSS) in the Drupal Screenshot contributed module allows a high-privileged authenticated attacker to inject malicious script content that executes in the browser context of other users who view the affected output, crossing security boundaries as reflected by the scope-changed CVSS vector. All tracked versions of the module are affected per the wildcard CPE and EUVD-2026-70010 listing. No public exploit code and no CISA KEV listing have been identified at time of analysis; Drupal's security team published advisory SA-CONTRIB-2026-102.