Heap out-of-bounds read in libtpms during TPM 2.0 state restoration allows an adjacent unauthenticated attacker to crash the swtpm process and deny TPM services to dependent virtual machines. The flaw arises in the state-blob parser: an attacker-controlled oversized skip-block length drives the internal INT32 size counter negative; subsequent bounds checks cast that counter to UINT32, wrapping it to a large positive value and bypassing the check, which then drives the parser to read memory outside the heap buffer. Vendor and upstream commit confirm the impact is denial of service only - no data corruption or information disclosure was confirmed. No public exploit or CISA KEV listing has been identified.
Authorization bypass in JeecgBoot's SystemApiController (versions 3.9.2 and earlier) allows any authenticated user - regardless of role or privilege level - to enumerate the entire user directory through four underpermissioned API endpoints. Missing fine-grained permission checks on queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds, combined with incomplete data desensitization, expose sensitive PII including real names, phone numbers, email addresses, employee numbers, and role definitions for all system users. No public exploit has been identified at time of analysis, though the vulnerability is publicly documented in GitHub issues #9670 and #9674.
Denial of service in IBM i 7.3 through 7.6 is achievable by any remote authenticated low-privilege user via a NULL pointer dereference, causing complete availability loss with no data exposure. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms low-complexity network exploitation requiring only a valid user account and no user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis; IBM has released a patch via its support portal.
Path traversal in IBM Langflow OSS versions 1.0.0 through 1.10.2 allows an authenticated low-privileged attacker to read arbitrary files on the underlying server by injecting dot-dot sequences (/../) into crafted URL requests. The CVSS 3.1 score of 6.5 (C:H/I:N/A:N) reflects a read-only disclosure vector with no write or denial-of-service capability, but the confidentiality impact is materially significant given that Langflow deployments commonly store LLM API keys, pipeline configurations, and model secrets on the host filesystem. No public exploit code or CISA KEV listing has been identified; IBM has released a patch via its support portal.
Unauthenticated-equivalent version disclosure in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows any authenticated user - including the low-privileged Standard role - to retrieve detailed system fingerprinting data via the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi. The endpoint returns operatingsystem and gatewayversion fields without enforcing role-based access controls, exposing exact firmware and OS version strings that enable targeted follow-on attacks against known vulnerabilities. A proof-of-concept is publicly available on GitHub (SilviaMun/vulnerability-research); no CISA KEV listing is present.
Stack-based buffer overflow in IBM i 7.3 through 7.6 allows remote authenticated attackers to cause a denial of service by sending specially crafted network input that exceeds a stack-allocated buffer in a network-accessible component. The vulnerability is gated behind low-privilege authentication (PR:L) and carries no confidentiality or integrity impact, as IBM's advisory scores it CVSS 4.3 with A:L. No public exploit code or active exploitation has been identified; a vendor-released patch is available via the IBM support portal.
Cleartext credential exposure in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows any authenticated user - including those with only the low-privileged Standard role - to retrieve OPC-UA server authentication credentials by querying the `opcua-configuration` method of the gateway's JSON API at `/cgi-bin/wwwugw.cgi`. The vulnerability stems from insufficient access control on a sensitive API response, meaning credential data is returned regardless of the requesting user's permission tier. A public researcher repository on GitHub (SilviaMun/vulnerability-research) documents the finding, lowering the exploitation threshold, though no active exploitation has been confirmed by CISA KEV.
XML external entity injection in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1) and IBM Integration Bus for z/OS (10.1.0.0-10.1.0.7) enables a remote authenticated attacker to exfiltrate sensitive information from the server via maliciously crafted XML input. The CWE-611 flaw allows the underlying XML parser to resolve attacker-controlled external entity references, potentially exposing local files, environment data, or internal network resources. No active exploitation has been identified at time of analysis, and IBM has released a patch via advisory 7286372.
XML External Entity (XXE) injection in IBM App Connect Enterprise and IBM Integration Bus for z/OS enables authenticated remote attackers to exfiltrate sensitive server-side information. Affected versions span IBM App Connect Enterprise 12.x through 13.x and IBM Integration Bus for z/OS 10.1.x. The vulnerability arises from insufficient restriction of XML external entity processing within the integration platform, and a vendor patch is available via IBM's support portal. No public exploit code or active exploitation has been identified at time of analysis.
Resource exhaustion in IBM MQ Agent CD (v1.0.0-v2.0.1) allows any authenticated console user to monopolize the LLM agent worker pool by submitting arbitrarily large or computationally expensive requests. When multiple such requests are issued concurrently, all available agent workers remain occupied for extended periods - from tens of seconds to over ten minutes each - causing complete unavailability of the AI Agent feature for all other IBM MQ Console users. No public exploit code has been identified at time of analysis, and exploitation requires a valid authenticated session.
Arbitrary file write in IBM Langflow OSS 1.0.0-1.11.2 allows low-privileged authenticated attackers to plant files at any server-writable path via the SaveToFileComponent's unsanitized path handling on the /api/v1/run/{flow_id} endpoint. The root cause is CWE-22 path traversal: user-supplied path values-including absolute paths and traversal sequences such as ../../-are incorporated into local filesystem operations without sufficient sanitization. Successful exploitation enables unauthorized file creation or modification, with potential for further compromise (e.g., overwriting application scripts or configuration) depending on the Langflow process's file-system permissions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary IDE configuration file writes in IBM Langflow OSS 1.0.0 through 1.11.2 are achievable by authenticated remote attackers who spoof the X-Forwarded-For HTTP header to impersonate a localhost connection, bypassing the platform's IP-based restriction on MCP (Model Context Protocol) server configuration installation. The direct impact is unauthorized writes to files such as ~/.cursor/mcp.json, which define MCP server endpoints loaded by AI-integrated IDEs; a malicious entry in these files can redirect the IDE to an attacker-controlled MCP server, enabling downstream code execution within the developer's environment. No public exploit has been identified at time of analysis; a vendor-released patch is available per IBM advisory 7285646.
Sensitive process information disclosure in IBM i's PASE subsystem allows authenticated network users to access details about processes they lack permission to view. Affected versions span IBM i 7.3 through 7.6, covering a wide range of currently-supported releases. The vulnerability is limited to confidentiality impact; no integrity or availability degradation results. No public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in IBM UrbanCode Deploy and IBM DevOps Deploy exposes sensitive deployment secrets in plaintext to authenticated users who should only see redacted values. The root cause is a character-parsing failure in the redaction engine: when a secure property value begins with certain non-ASCII characters, the masking logic fails to suppress subsequent ASCII secure values embedded within non-secure properties, rendering them visible through the UI and REST API. No active exploitation or public POC has been identified; the CVSS score of 6.5 reflects high confidentiality impact (C:H) gated behind low-privilege authentication (PR:L).
Integer overflow in Corosync's membership commit token processing crashes the daemon on 32-bit cluster nodes, enabling a denial-of-service attack from any adjacent network host. The CWE-190 flaw causes the length validation to be bypassed on 32-bit systems where arithmetic wraps before the bounds check is applied, resulting in an out-of-bounds memory access that kills the Corosync process. Modern 64-bit deployments of the same packages are explicitly not affected, substantially narrowing real-world exposure despite the CVSS 6.5 rating; no public exploit code or CISA KEV listing exists at time of analysis.
Cross-user API history disclosure in SolidInvoice prior to version 3.0.1 allows any authenticated company member to read the API request history of other users' API tokens by manipulating writable Symfony UX LiveComponent props on the DataGrid component. The root cause is an IDOR (CWE-639): the server accepts user-controlled identifiers in LiveComponent prop updates without verifying that the requesting user is authorized to view the referenced token's history. No public exploit code exists and no CISA KEV listing is present; vendor-released patch is available in version 3.0.1.
Integer overflow in IBM i versions 7.3 through 7.6 allows remote authenticated attackers to cause a denial of service condition. The vulnerability (CWE-190) is network-reachable but requires prior authentication, and its impact is limited to partial availability degradation with no confidentiality or integrity consequences. IBM has released a patch, and no public exploit code or CISA KEV listing has been identified at time of analysis.
IBM i versions 7.3 through 7.6 expose authenticated remote attackers to a denial-of-service condition via a memory leak (CWE-401). An attacker with low-privilege credentials can repeatedly trigger the vulnerable code path over the network, causing progressive memory exhaustion that degrades or halts system services. No active exploitation has been identified, and IBM has released a patch via Security Advisory 7285844.
Improper authorization in MBS-Solutions X-Serie Gateway firmware V6_00_05 permits authenticated Standard-role users to directly invoke undocumented CGI methods (ugw-ping, ugw-traceroute) via /cgi-bin/wwwugw.cgi that are intentionally hidden from the web UI. Exploitation leaks sensitive network topology data - hop paths, internal IP ranges, and reachability information - from a device positioned as a gateway, making the disclosure operationally significant. No public exploit code has been confirmed in a KEV context, though a public vulnerability research repository exists on GitHub.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.2 allows authenticated remote attackers to leverage the application server as a proxy to reach internal network resources, exposing sensitive information from systems not directly accessible to the attacker. The CVSS S:C scope-change metric signals that the primary risk extends beyond the vulnerable component itself - cloud-hosted instances are particularly exposed to metadata-service credential theft via endpoints like AWS IMDSv1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-Based XSS in the WoodMart WordPress theme (all versions before 8.3.8) allows low-privilege authenticated attackers to inject malicious scripts into the browsers of higher-privileged users visiting affected pages. The CVSS scope change (S:C) indicates the injected payload can reach beyond WoodMart's own security boundary into the broader WordPress page context, enabling session theft or privilege escalation. No public exploit code or CISA KEV listing has been identified at time of analysis; the fix is available in version 8.3.8.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.10.2 allows remote authenticated attackers to force the application server to make outbound HTTP requests to arbitrary destinations, enabling reconnaissance of internal network resources and metadata services. The S:C (scope change) in the CVSS vector confirms the vulnerability can reach internal systems beyond the Langflow application boundary - a hallmark of high-impact SSRF. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and IBM has released a patch.
CPU exhaustion via crafted chunked HTTP responses affects the Elixir Mint HTTP client library (versions 1.9.3 through before 1.10.0). The chunk-size hex parser in `lib/mint/http1/parse.ex` accumulates digits into an arbitrary-precision integer using `acc * 16 + digit` with no upper bound on digit count, producing O(N²) cost per parse pass; compounded by a re-parse-from-start design on each socket message, a server that trickles digits forces the client to pay this cost repeatedly. Benchmark data in the advisory confirms ~512,000 hex digits produces over ten seconds of CPU in a single pass, and an intermediary inspecting only headers sees a normal 200 response. No public exploit identified at time of analysis; patch is available in version 1.10.0.
Stack buffer overflow in PJSIP's (pjproject) telnet CLI front-end allows unauthenticated network attackers to crash applications that have explicitly enabled the telnet administration interface. The functions send_err_arg() and send_ambi_arg() in cli_telnet.c wrote an attacker-influenced number of bytes into a fixed 256-byte stack buffer without bounds checking, with the error-position offset derived directly from parsed command input. The vulnerability is limited to application termination (DoS); no public exploit code has been identified at time of analysis, and the upstream fix is available as commit 4472a31.
Uncontrolled memory growth in Softing smartLink HW-PN versions 1.04 through 1.09 allows a low-privileged network-adjacent attacker to trigger a resource leak that propagates high-integrity and low-availability impact to downstream subsequent systems - likely PROFINET-connected industrial devices bridged through the gateway. The vulnerability is classified CWE-401 (Missing Release of Memory after Effective Lifetime), indicating that allocated memory is not freed upon session or object expiration, accumulating over time. No public exploit code has been identified at time of analysis, though the CVSS 4.0 supplemental field marks it automatable (AU:Y), suggesting the trigger condition can be scripted without manual interaction.
Stack-based buffer overflow in PJSIP pjproject's telnet CLI front-end allows remote, unauthenticated attackers to crash the affected application by sending history-recall input sequences (arrow keys) to the `handle_up_down()` function in `cli_telnet.c`. The accumulated redraw data - comprising cursor position, current buffer length, and recalled history entry length - can exceed the fixed-size `PJ_CLI_MAX_CMDBUF` stack buffer, leading to application termination. Exploitation requires the telnet CLI front-end to be explicitly enabled; applications that do not enable this feature are entirely unaffected, and no public exploit or KEV listing has been identified at time of analysis.
Improper access control in the MBS-Solutions X-Serie Gateway firmware V6_00_05 permits an authenticated Standard-role user to write arbitrary content to gateway configuration directories via the ugw-editfile method exposed at /cgi-bin/wwwugw.cgi, bypassing the role-based restrictions that should confine write operations to administrative accounts. Exploitation is bounded by the requirement for a valid Standard-role credential but requires no further privileges, enabling persistent unauthorized modification of files under /uxx/config/ and /ugw/config/ - directories that govern gateway routing, access policies, and operational configuration. No active exploitation has been confirmed; a GitHub-hosted researcher repository linked in the references likely contains technical details but POC weaponization status is unconfirmed from available data.
Authorization bypass in phpMyFAQ before 4.1.8 allows unauthenticated network attackers to submit questions through the question/create API endpoint regardless of guest-restriction settings. The root cause is an incomplete two-setting access control check: isAddingQuestionsAllowed() enforces only the main.enableAskQuestions feature flag while silently ignoring the records.allowQuestionsForGuests restriction, nullifying administrator intent. The practical result is spam injection into the admin moderation queue; no code execution or data exfiltration is achievable through this path alone. No public exploit code has been identified at time of analysis.
Pik Online Portal through version 3.5.1 stores hashes without cryptographic salts (CWE-759), exposing stored credentials to offline cryptanalysis via rainbow table or precomputed dictionary attacks. The CVSS vector (PR:L/UI:R) indicates that a low-privileged attacker who can access hash data - and where some user interaction occurs to trigger or expose the hash - can recover plaintext passwords with high confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis; this was reported by TR-CERT (Turkish national cybersecurity authority).
Cross-site request forgery in MISP allows an unauthenticated remote attacker to trigger unauthorized state changes on behalf of any authenticated user by abusing MISP's REST detection logic. The root flaw is that CSRF and form-security exemptions were granted whenever a request was classified as REST-style - a classification controlled by the HTTP Accept header, which cross-origin pages can freely set to application/json without triggering a CORS preflight. Any authenticated MISP analyst who visits an attacker-controlled page can have events created, modified, published, or deleted against their MISP instance using their own session. No public exploit has been identified at time of analysis, but the technique requires only standard browser APIs and social engineering, placing practical exploitation complexity well below the CVSS surface complexity rating.
Sensitive information disclosure in IBM Enterprise Records (a component of IBM Cloud Pak for Business Automation) allows a local attacker to recover protected data due to the use of a broken or risky cryptographic algorithm (CWE-327). Affected versions span CP4BA releases 24.0.0 through 26.0.0 up to specific interim fix levels. No public exploit code has been identified at time of analysis, and IBM has released interim fixes addressing the cryptographic weakness.
Reflected cross-site scripting in HubCore platform 14.1.1 allows unauthenticated remote attackers to inject arbitrary JavaScript via the `language` POST parameter on the `/loginController/doLogin` endpoint, with execution occurring in the victim's browser context. Because the vulnerable endpoint is the public-facing login page - requiring no prior authentication - an attacker who delivers a crafted login link can steal session tokens, impersonate the victim, or redirect users to phishing pages. Publicly available exploit code exists in a researcher's GitHub repository; the vulnerability is not in the CISA KEV catalog and EPSS is low at 0.23%.
Stored cross-site scripting in IBM Langflow OSS 1.0.0-1.11.2 allows an unauthenticated network attacker to inject persistent malicious scripts into the Playground chat interface. When a victim user subsequently loads the chat view, the stored payload executes in their browser under the application's origin, enabling session hijacking, credential theft, or unauthorized UI manipulation. IBM has released a patch per advisory node/7285646; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Yordam Information Technology's Library Information and Document Automation Program enables unauthenticated network attackers to inject malicious scripts into pages served to authenticated library staff or patrons. Affected versions span v22.1 up to (but not including) v22.2. No active exploitation has been identified and no public proof-of-concept is known, but the vulnerability is reported by TR-CERT and carries a scope-changing CVSS vector reflecting its potential to pivot from the web app context into the victim's browser session.
Stored cross-site scripting in Apache SkyWalking's Booster UI dashboard widget rendering (versions 10.2.0 through 10.4.0) allows an attacker with dashboard-edit access to inject persistent JavaScript that executes in the browser of any user viewing the affected dashboard. This is an incomplete remediation of CVE-2025-54057, meaning the original patch left residual unsanitized widget input paths. No public exploit code or active exploitation has been identified at time of analysis, though the prior CVE's public disclosure increases the likelihood of targeted research against the remaining surface.
Reflected cross-site scripting in EMX Tecnologia Gestao X Business Suite 8.4 and earlier enables unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL targeting the /Configuracao/Imagens.aspx endpoint. The root cause is insufficient validation of the mensagem query parameter, which is reflected directly into the HTTP response without sanitization, enabling session hijacking, credential theft, or forced browser-side actions against authenticated users of this Brazilian ERP/business management platform. No public exploit has been confirmed at time of analysis, and EPSS scoring at 0.16% (5th percentile) indicates low current exploitation probability.
Cross-site scripting in Yordam Information Technology's Library Information and Document Automation Program (all versions before v22.2) allows unauthenticated remote attackers to inject malicious scripts into HTML attribute contexts, executing arbitrary JavaScript in victims' browsers. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C vector confirms a classic reflected XSS pattern requiring only that a target user click a crafted link. Reported by TR-CERT with no public exploit or KEV listing at time of analysis.
Use-after-free in PX4 Autopilot through v1.17.0 permits adjacent attackers with shell access to corrupt the autopilot's heap by racing task spawning against object deletion in the temperature calibration subsystem. The root cause is that `TemperatureCalibration::start()` stores the spawned task handle in an instance member variable; if the object is freed before the spawned task begins execution, the task writes into dangling heap memory, corrupting adjacent allocator metadata or unrelated objects. The upstream fix in PR #28487 promotes the task handle to a local variable, eliminating the lifecycle coupling. No public exploit code or CISA KEV listing exists at time of analysis.
HTTP/2 flow-control window mismanagement in libsoup (GNOME's HTTP client/server library) allows a malicious HTTP/2 server to abort a connecting client process or crash its HTTP/2 session. When the client sends a request body sourced from a non-pollable GInputStream, libsoup buffers the data before transmission; a server that then shrinks SETTINGS_INITIAL_WINDOW_SIZE causes the client to copy the full pre-buffered payload into a now-undersized DATA callback without a runtime bounds check, triggering a reachable assertion abort (CWE-617). No public exploit has been identified at time of analysis, and the high-complexity timing requirement constrains practical exploitation.
Resource exhaustion in undici's retry handler (versions 7.11.0-<7.29.1 and 8.0.0-<8.10.2) allows an attacker-controlled HTTP server to permanently orphan response body streams, accumulating unreleased promises and memory until application concurrency or heap is exhausted. The flaw arises when a server sends a truncated response body (with Content-Length declared), triggering a retry that returns a non-retryable status code - causing the original body stream to be abandoned without being ended or destroyed, and bypassing the body timeout because the timer is coupled to the connection parser rather than the orphaned stream. No public exploit has been identified at time of analysis, but the attack requires only two crafted HTTP responses and no persistent connection, making automated triggering straightforward against applications that use undici with retry logic enabled.
SolidInvoice's REST API authenticator, in all versions prior to 3.0.1, silently accepts long-lived bearer tokens via a `?token=` URL query parameter as a fallback to the intended `X-API-TOKEN` request header, causing credentials to be permanently recorded in server access logs, reverse-proxy logs, CDN access logs, browser history, and HTTP Referer headers forwarded to third-party origins. Any actor with read access to those artifacts - sysadmins, log-aggregation pipelines, analytics vendors receiving Referer data, or post-compromise intruders pivoting through log stores - can extract a valid API token and authenticate to the invoicing platform without exploiting any application logic. Version 3.0.1 fixes the issue by removing the query-parameter fallback and enforcing header-only delivery; no public exploit has been identified at time of analysis.
Process-crashing denial of service in undici's WebSocket permessage-deflate implementation allows a remote unauthenticated attacker to terminate any Node.js process hosting the affected client by sending a crafted compressed WebSocket frame. The size-limit enforcement routine strips all event listeners - including the error handler - from the zlib inflate stream while the stream is still active; a subsequent malformed DEFLATE byte then emits an uncaught error that Node.js treats as a fatal unhandled exception, killing the process. Versions 6.25.0-6.28.0, 7.28.0-7.29.0, and 8.1.0-8.10.1 are confirmed affected; fixed releases are available per OpenJS advisory GHSA-3wwx-pv8p-q78v, and no public exploit has been identified at time of analysis.
Memory exhaustion via compression bomb in undici's decompress interceptor (versions 7.15.0-<7.29.1 and 8.0.0-<8.10.2) allows a malicious or compromised upstream HTTP server to crash a Node.js process by returning a small compressed payload that expands to hundreds of megabytes in client heap memory. The interceptor respects the untrusted Content-Encoding header and enforces no ceiling on total decompressed output size, making the attack purely asymmetric - a kilobyte-scale upstream payload can trigger unbounded client-side allocation. No public exploit has been identified and the vulnerability is not in the CISA KEV catalog; fixed versions 7.29.1 and 8.10.2 are available.
Flatpak's `org.freedesktop.Flatpak.SystemHelper` D-Bus service contains a TOCTOU race condition in the `Deploy()` function where a privileged `chmod` executes before OSTree repository validation completes, allowing a local low-privileged attacker to redirect symlinks to arbitrary system files within that timing window. A successful exploit can yield high-confidentiality impact (reading privileged files) and limited integrity and availability impact (CVSS C:H/I:L/A:L), as the unguarded chmod can be inherited by attacker-controlled symlink targets. No public exploit code or CISA KEV listing has been identified at time of analysis, and the High attack complexity (AC:H) reflects the precision timing required to win the race.
Denial-of-service exposure in IBM App Connect Enterprise and IBM Integration Bus for z/OS Toolkit allows an authenticated, network-connected user to crash or incapacitate the Toolkit by submitting crafted XML containing recursive or deeply nested entity references. The root cause is CWE-776, improper restriction of recursive entity references in DTDs - commonly called an XML Entity Expansion or 'Billion Laughs' attack. Patch is available per IBM advisory 7286372; no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated access to the stats/login endpoint in jofpin trape 1.0.0 exposes collected tracking statistics to any remote party without credentials via the core/stats.py component. The missing authentication check (CWE-287) allows the statistics interface to be queried freely over the network, leaking data about tracked individuals - a meaningful privacy concern given trape's purpose as a people-tracking OSINT tool. A proof-of-concept exploit is publicly available, and the vendor has not responded to the GitHub issue report disclosing the flaw.
SQL injection in code-projects Vehicle Management System 1.0 allows remote unauthenticated attackers to manipulate the busid parameter in /busprofile.php to inject arbitrary SQL into the underlying database. The CVSS 4.0 vector confirms no authentication, low complexity, and no user interaction is required for exploitation. A public proof-of-concept exploit is documented on GitHub, making this trivially reproducible against any network-exposed instance.
Denial of service on IBM i versions 7.3 through 7.6 is achievable by exploiting an off-by-one write in the LPD (Line Printer Daemon) queue name parser, corrupting adjacent memory and crashing the affected service. The vendor description specifies a local authenticated attacker as the threat actor, yet IBM's own submitted CVSS vector (AV:N/AC:L/PR:N/UI:N) characterizes this as an unauthenticated network-reachable flaw - a direct contradiction that materially affects risk prioritization. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stack-based buffer overflow in IBM i 7.3 through 7.6 allows an authenticated local attacker to crash the system, producing a denial of service with no confidentiality or integrity impact. The flaw is classified as CWE-121 and is limited in severity by both the access prerequisites and the bounded availability-only outcome. A vendor patch is available via IBM's support portal, and no public exploit code has been identified at time of analysis.
Credential leakage via improper logging affects IBM App Connect Enterprise 12.x-13.x and IBM Integration Bus for z/OS 10.1.x, allowing a local attacker to recover plaintext credentials from application log files without requiring elevated privileges. The root cause is CWE-532, where sensitive authentication material is written to diagnostic or operational logs during normal product operation. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch via their support advisory.