Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthenticated attackers to execute arbitrary code by injecting special elements into the template engine (CWE-1336). Rated CVSS 10.0 with a changed scope, the flaw requires no user interaction and grants code execution in the context of the current user, per Adobe advisory APSB26-146. No public exploit has been identified at time of analysis, but the maximal score and unauthenticated network reach make this a top-priority patch for e-commerce operators.
Stack-based buffer overflow in the D-Link DIR-822A (firmware A_101) router allows attackers to corrupt memory in the udhcpd DHCP server via an unbounded strcpy in serverpacket.c while parsing TR-111 DHCP Option 125. The exploit writeup and VulDB entry are public (publicly available exploit code exists), and successful exploitation can crash the DHCP service or achieve code execution on the device. No confirmed active exploitation (not in CISA KEV), but a working POC lowers the bar for opportunistic use against reachable devices.
Authentication bypass in the LibreNMS REST API (all versions before 26.8.0) lets unauthenticated remote attackers reach protected endpoints by submitting a small integer (0-9) in place of a string API token, abusing MySQL loose type coercion so the integer matches a stored token hash. Successful bypass exposes device credentials and administrative functionality, and can be chained to remote code execution through alert templates. Reported by VulnCheck; no public exploit is identified at time of analysis, though the type-confusion technique is fully described in the advisory.
Command injection in Advantech WISE-6610 LoRaWAN gateway firmware 1.2.1_20251110 allows a remote low-privileged attacker to execute arbitrary OS commands by manipulating the act parameter in the Basic Station Certificate-Deletion Handler (basicstation_apply function). All 13 WISE-6610 hardware variants are affected, spanning NB, EB, TB, JB, CB, EL-series, and P-series models deployed in industrial IoT environments. A public proof-of-concept exploit has been disclosed; upgrading to firmware 1.2.4_20260821 resolves the issue.
OS command injection in Linksys RE7000 firmware 2.0.15 allows authenticated low-privilege attackers to execute arbitrary commands on the device by manipulating the pingTestIp, pingTestPktSize, or pingTestTimes parameters of the PingTest CGI handler. The /cgi-bin/json.cgi?PingTest endpoint passes these parameters unsanitized to underlying shell commands, resulting in full device compromise and potential impact to adjacent network infrastructure. A public proof-of-concept exploit is available on GitHub, substantially lowering the exploitation barrier.
Command injection in Advantech WISE-6610 series industrial IoT gateways allows a remotely authenticated attacker with low privileges to execute arbitrary OS commands via the Node-RED Library's nodered_lib_apply function. All thirteen WISE-6610 firmware variants at version 1.2.1_20251110 are confirmed affected, and a public exploit is available. Advantech has released firmware 1.2.4_20260821 as the fix, with no active exploitation (CISA KEV) confirmed at time of analysis.
Off-by-one memory corruption in D-Link DIR-605 B1v202WWB03 allows unauthenticated remote attackers to trigger an out-of-bounds write via a crafted L2TP Host Name AVP in the `peer_hostname` argument of `tunnel_set_params`. The flaw resides in the router's L2TP Control Message Parser (`progs.gpl/pppd.alpha/l2tp/tunnel.c`) and carries full C/I/A impact on the device. A public proof-of-concept writeup explicitly confirming out-of-bounds write primitives has been published, though exploitation complexity is rated high.
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remote unauthenticated attackers assume Directory Manager authority without valid credentials. A stale SASL auxiliary identity left over from a failed SASL PLAIN bind is incorrectly installed onto the connection when a later, unrelated bind (e.g. SASL ANONYMOUS) succeeds on the same connection. No public exploit was identified at time of analysis, and the flaw is not listed in CISA KEV, but the trivially reproducible bind sequence makes weaponization straightforward.
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine administrators-group membership. The self-managed OTP token ACI does not require authentication and fails to restrict which attributes may be added alongside a token entry; chained with a separately-tracked directory-server ACI evaluation flaw, an unauthenticated LDAP client can create an attacker-controlled Kerberos principal and place it in the administrators group. Assigned CVSS 9.8 (CWE-306, Missing Authentication); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated remote attacker to escape the intended directory and execute arbitrary code by supplying crafted path input. Both the Appliance (versions before 5.36.00.16) and the Application (versions before 5.36.00.00) deployments of SCG 5.0 Virtual Edition are affected. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; EPSS is a modest 0.43% (36th percentile), but the network-reachable, unauthenticated path-traversal-to-RCE profile warrants prompt patching.
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing accounts by asserting a victim's email address without proving ownership of it. All YouTrack builds before 2025.3.161254 and 2026.1.14042 are affected. Because the flaw is a trust failure in how Helpdesk associates a self-provided email with an account, exploitation requires no credentials, no user interaction, and works against default configurations where Helpdesk is enabled. No public exploit identified at time of analysis.
Remote code execution in Next4Biz CSM (Customer Service Management) up to build 07092026 allows unauthenticated attackers to inject and execute code by supplying crafted serialized objects that the application deserializes without validation (CWE-502). Reported by Turkey's national CSIRT (TR-CERT/USOM); the vendor was contacted but did not respond, and no fixed build is confirmed. No public exploit identified at time of analysis, and no KEV/EPSS enrichment is available in the provided data.
Privilege escalation to superuser in JetBrains Hub before 2026.2.52442 allows an unauthenticated remote attacker to register a trusted service and thereby obtain full administrative (superuser) control over the identity-management server. Because Hub is the single sign-on and authorization backbone for JetBrains tooling (YouTrack, TeamCity, Upsource), compromise cascades to every application relying on it for authentication. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Command injection in the D-Link DIR-895L router's DHCP server daemon allows a network-adjacent attacker to execute arbitrary OS commands by crafting a malicious Hostname option in a DHCP request. The vulnerable code path is in the `sendACK` function of `udhcpcd/serverpacket.c`, where the client-supplied Hostname field is processed without sanitization, leading to shell injection. A public proof-of-concept exploit exists targeting firmware version A1_102b07, and no vendor patch has been identified at time of analysis.
Remote command execution in Dell Secure Connect Gateway 5.0 (Appliance versions before 5.36.00.16 and Application versions before 5.36.00.00) lets a remote, unauthenticated attacker run commands on the target by sending a specially crafted request that bypasses intended authorization checks. Dell has released fixed versions and the flaw is rated critical (CVSS 9.4). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Server-side request forgery in openagents up to 0.8.19 and 0.9.3.post20 allows unauthenticated remote attackers to manipulate the base_url argument of the test_default_model function in sdk/src/openagents/sdk/transports/http.py, causing the server to issue arbitrary outbound HTTP requests and disclose internal network responses. The vulnerability was publicly disclosed via GitHub issue #566 with a proof-of-concept. Critically, the maintainer closed the issue as inapplicable despite the identical unguarded code shipping in 0.9.3.post20 - the endpoint and both code sinks remain unchanged; only the file path was relocated in commit e277dd1a.
Unrestricted file upload in FeehiCMS up to version 2.1.1 allows unauthenticated remote attackers to upload arbitrary files through the UEditor widget endpoint (UeditorAction::init in backend/widgets/ueditor/UeditorAction.php). A named public proof-of-concept (FEHI-001-UEditor-Unauthorized-File-Upload) is available on GitHub, enabling straightforward exploitation. The vendor has not responded to the coordinated disclosure issue filed at GitHub, and no patch exists at time of analysis.
Missing authentication in SourceCodester Simple Traffic Offense System 1.0 allows unauthenticated remote attackers to create arbitrary user accounts by manipulating the `position` argument in `saveuser.php`. The user-creation endpoint fails to enforce any authentication gate (CWE-306), exposing it to direct network exploitation with no prerequisites. A public proof-of-concept exploit exists, raising the practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest.
Authentication bypass in Tenda AC9 firmware 15.03.05.14 allows unauthenticated remote attackers to circumvent the web management interface's R7WebsSecurityHandler authentication gating. Published PoC files demonstrate two concrete attack paths: unauthenticated product information disclosure via the getProduct endpoint and unauthenticated WiFi credential modification via the fast_setting_wifi_set endpoint. No public vendor patch has been identified, and exploit code is publicly available (CVSS 4.0 E:P).
Missing authorization in projeto-siga Siga's authentication controller allows unauthenticated remote attackers to bypass access controls by manipulating the `cod` or `jwt` parameters submitted to the `ExAutenticacaoController.autenticar` function. Versions up to 11.0.2.10, 11.0.2.13, and 11.1.1 of this Brazilian judicial document management platform are affected. A proof-of-concept exploit has been publicly disclosed via a GitHub issue report, and the vendor has not responded to the responsible disclosure at time of analysis.
Unverified password change in sfturing hosp_order allows unauthenticated remote attackers to arbitrarily modify any user's password through the `modifyPassWord` function in `CommonUserController.java`. The Password Recovery component fails to validate the requester's identity or current credentials before accepting a new password, enabling full account takeover without prior authentication. A public exploit has been released via the project's GitHub issue tracker, and the vendor has not responded to the disclosure.
Authorization bypass in sfturing hosp_order exposes its order cancellation endpoint to manipulation of the ID parameter, allowing an attacker to cancel medical orders belonging to any patient without owning those records (CWE-639 IDOR). The vulnerable function is orderRecordsService.cancelOrder in OrderController.java within this Java/SSM-stack hospital management application. A public exploit is documented in GitHub issue #116; the project maintainer has not responded to the disclosure, leaving no remediated version available.
Authorization bypass in sfturing hosp_order allows unauthenticated remote attackers to modify hospital order records belonging to arbitrary users by supplying attacker-controlled `userID` or `id` parameters to the `updateOrderSta1` and `updateOrderdiseaseInfo` endpoints in OrderController.java. A public proof-of-concept exploit was disclosed via GitHub issue #115; the maintainer has not responded to the report. The project follows a rolling release strategy, making version-pinned remediation guidance impossible - all commits through 627f426331da8086ce8fff2017d65b1ddef384f8 are confirmed affected.
Authorization bypass through user-controlled key (IDOR, CWE-639) in sfturing hosp_order's OrderController allows unauthenticated remote attackers to access or manipulate hospital order records belonging to arbitrary users by supplying a crafted `userIdenf` parameter. The affected codebase is a Java Spring-based hospital order management system, and the vulnerability is exposed via the `/ssm_pro` web application endpoint. A public proof-of-concept exists via GitHub issue #114; the maintainer has not responded to the disclosure, and no patch has been released.
Uncontrolled resource consumption in java-json-tools json-patch up to version 1.13 allows remote unauthenticated attackers to trigger service degradation by sending crafted JSON Patch documents to the JsonPatch.apply() handler. The vulnerability resides in the Patch Operation Handler component and carries no confidentiality or integrity impact - purely availability. A public proof-of-concept has been disclosed via a GitHub issue report, though no KEV listing indicates active exploitation at this time.
Unrestricted file upload in Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000 exposes the /Report/Upload/UploadFormImg.ashx endpoint to unauthenticated remote file submission without file-type validation. An unauthenticated network attacker can upload arbitrary file types - including ASP.NET script files such as .aspx webshells - potentially chaining the upload into remote code execution on the underlying IIS server if the upload directory permits script execution. A public proof-of-concept exploit has been disclosed via a Feishu document, and no CISA KEV listing has been identified at time of analysis.
Unrestricted file upload in light0011 CMS allows unauthenticated remote attackers to upload arbitrary file types - including PHP webshells - via the Upload::upload function in the ThinkPHP-based CMS. The affected code is confirmed at commits c774dce and f72cf46 in the light0011/cms GitHub repository. A public proof-of-concept exploit has been released via a GitHub issue report; the vendor has not responded and no patched version exists.
Information disclosure in light0011 CMS exposes database debug output to unauthenticated remote attackers by manipulating the DB_DEBUG argument processed by the Debug Mode component in App/Common/Conf/config.php. The flaw allows network-accessible attackers to retrieve database diagnostic data - potentially including SQL query traces, schema details, or connection metadata - with no authentication and no user interaction required. A public proof-of-concept exploit exists via GitHub issue #17, and the vendor has not yet responded to the coordinated disclosure report, leaving all deployed instances unpatched.
Hospital Information System 1.0 by code-projects exposes its raw SQL database backup file at the web-accessible path `/HIS/his.sql`, allowing unauthenticated remote attackers to download the full database dump over HTTP with no prerequisites. The vulnerability (CWE-200) stems from placing the database export file inside the application's web root without access controls. A public proof-of-concept exploit document is available on GitHub, confirming practical exploitability; no KEV listing has been issued at time of analysis.
Unauthenticated IDOR (Insecure Direct Object Reference) in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote attackers to delete arbitrary exam records by manipulating the `ID` parameter in `delete_exam.php` without any authorization check. Any network-accessible attacker can iterate over exam IDs to destroy examination data belonging to other users or system administrators. A public proof-of-concept exploit has been disclosed on GitHub, lowering the bar for opportunistic abuse.
Hard-coded database credentials embedded in db.php of SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allow unauthenticated remote attackers to obtain and reuse valid database credentials without any prior authentication. The credentials, baked directly into the PHP source file, are exposed to any party who can read or retrieve that file over the network. Publicly available exploit code has been published per the VulDB submission and a GitHub vulnerability report covering the same product, elevating this beyond a theoretical risk.
Server-side request forgery in projeto-siga SIGA up to version 11.1.1 allows unauthenticated remote attackers to cause the application server to issue arbitrary HTTP requests by supplying a crafted value to the html parameter of the HTML-to-PDF conversion endpoint (ExUtilController.java, DownloadExterno.getUrl). This enables attackers to probe internal network services, exfiltrate cloud metadata, or reach otherwise-inaccessible infrastructure through the server's outbound network position. A public exploit exists and the maintainer has not responded to the responsible disclosure issue (#2492), leaving all deployments on 11.1.1 and earlier unpatched.
Unauthenticated privilege escalation in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote attackers to register as privileged users - including administrator - by manipulating the `role` parameter in the `register` function of `auth.php`. Because the application fails to enforce server-side role validation during self-registration, any unauthenticated user can tamper the role field to claim elevated privileges at account creation time. A public proof-of-concept exploit is available on GitHub, lowering the bar for opportunistic exploitation.
SQL injection in jaychouchannel's Tourism-Management-System (Java Spring Boot, up to commit 8122bf02) allows unauthenticated remote attackers to manipulate SQL queries by injecting payloads into table, column, xColumn, or yColumn path variables accepted by multiple CommonController endpoints backed by CommonDao. Successful exploitation yields limited data disclosure and modification across the application database. A public proof-of-concept is available via GitHub issue #7, and a patch has been merged as commit d44ec3aa via PR #14.
SQL injection in SourceCodester Online Voting System 1.0 allows unauthenticated remote attackers to read and manipulate the application database through the /voting/ajax.php?action=save_category endpoint. The Category parameter is passed directly into a backend SQL query without sanitization or parameterization, enabling classic error-based or UNION-based injection. A public proof-of-concept exploit is available on GitHub, making opportunistic exploitation trivially reproducible with no authentication required.
SQL injection in itsourcecode School Management System 1.0 allows unauthenticated remote attackers to manipulate the email parameter in User_Login.php, injecting arbitrary SQL into backend database queries at the pre-authentication login endpoint. With a public exploit available on GitHub, exploitation requires minimal skill and no credentials. The CVSS 4.0 vector confirms network-accessible, no-privilege exploitation with partial confidentiality, integrity, and availability impact against the underlying database.
Cleartext storage of sensitive database credentials and user data in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 exposes plaintext secrets via the `cict_portal.sql` file. The SQL dump file, commonly placed within the web-accessible directory in SourceCodester PHP projects, can be retrieved directly over the network without authentication, leaking whatever credentials or personal data it contains. A public proof-of-concept exploit is available on GitHub, confirmed by VulDB and the referenced researcher report, raising the practical exploitation risk above what the moderate CVSS 4.0 score of 6.9 might suggest at first glance.
Server-side request forgery in jackson-coreutils 2.0 allows remote unauthenticated attackers to manipulate the server into issuing arbitrary outbound HTTP requests by supplying a crafted URL to the JsonLoader.fromURL function. The vulnerability originates from insufficient URL validation in the library's JSON loading component, enabling internal network probing, access to cloud metadata endpoints, or interaction with internal services not otherwise reachable. A public proof-of-concept exists via the project's GitHub issue tracker, and the maintainer has not responded to the disclosure; no patch is available at time of analysis.
Stack exhaustion in java-json-tools json-patch ≤1.13 enables remote unauthenticated denial of service by submitting a crafted deeply-nested JSON Merge Patch document to any application endpoint that invokes JsonMergePatch.fromJson. The vulnerability triggers an uncontrolled recursive deserialization path in JsonMergePatchDeserializer.java, causing JVM thread stack exhaustion. The CVSS 4.0 vector (VC:N/VI:N/VA:L) confirms the impact is limited to availability; no confidentiality or integrity impact has been identified. A public exploit/proof-of-concept exists in the GitHub issue tracker, and no patched release version has been independently confirmed.
Unauthenticated remote user deletion is possible in SourceCodester Simple Traffic Offense System 1.0 via the delete-user.php endpoint, which processes a user-supplied ID parameter without any session or privilege check. An attacker with HTTP access to the application can delete arbitrary user accounts without logging in, impacting data integrity and application availability. A publicly available proof-of-concept exploit exists on GitHub (no public exploit identified at time of analysis applies to KEV only - PoC is confirmed); the vulnerability is not listed in CISA KEV.
Account takeover in Bahçelievler Municipality's BiHayat App (versions 2.1.7 through build 07092026) is possible because the authentication flow imposes no limit on repeated login attempts, letting remote attackers brute-force credentials or bypass authentication controls entirely. TR-CERT reported the flaw and the vendor did not respond to disclosure. There is no public exploit identified at time of analysis and it is not in CISA KEV.
Missing authentication in Knowns (knowns-dev/knowns) before 0.30.0 exposes the management API on all network interfaces (0.0.0.0) by default with no password set on fresh installs, letting anyone with network reachability drive the server. Attackers can call the unauthenticated /api/tunnel/start endpoint to spin up a public tunnel that republishes the entire management API at an internet-reachable address, escalating a LAN-only exposure into full public exposure. Reported by VulnCheck and fixed in v0.30.0; publicly available exploit code exists in the sense that the vulnerable endpoints and fix are documented, but no active exploitation is confirmed (not in CISA KEV).
Authentication bypass in the WebGUI of NEC's UNIVERGE IX-R/IX-V series network routers allows remote attackers to tamper with WebGUI messages and execute arbitrary CLI commands on the device without valid credentials. Because the affected management interface can be reached over the internet, an unauthenticated attacker can gain administrative-level command execution, effectively compromising the router's configuration and traffic-handling. No public exploit has been identified at time of analysis, but the CVSS 4.0 base score of 9.3 reflects the low complexity and high impact.
Local privilege escalation to root in Dell Secure Connect Gateway (SCG) 5.0 lets a low-privileged operator with SSH access to the appliance host obtain full root control without a password by abusing the exposed Docker socket (CWE-250, Execution with Unnecessary Privileges). Affected builds are the SCG Appliance prior to 5.36.00.16 and the SCG Application prior to 5.36.00.00. The same socket exposure also enables container escape: an attacker who compromises any service inside the orchestrator container can break out to host-level control. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the technique (writable/accessible Docker socket) is a well-known and reliable escalation path.
Unauthorized remote access to Dell Secure Connect Gateway (SCG) 5.0 is possible because the product fails to properly validate TLS certificates (CWE-295), affecting the Appliance edition before 5.36.00.16 and the Application edition before 5.36.00.00. An unauthenticated network attacker able to intercept or interpose on connections can defeat the trust chain and gain access to protected resources or data. A vendor patch is available (DSA-2026-382); no public exploit identified at time of analysis and EPSS is low (0.15%).
Path traversal in knowns before v0.30.0 permits unauthenticated remote attackers to write files outside the designated imports directory by embedding directory traversal sequences in the import name parameter of the import routes API. Any file writable by the server process can be overwritten, making this a potential remote code execution primitive if configuration files, scripts, or other executable content reside within the process's write reach. No public exploit has been identified at time of analysis, but the patch commit and security advisory are publicly accessible on GitHub, lowering the barrier to reproduction.
Unrestricted Java deserialization in Red Hat EAP's embedded Apache ActiveMQ Artemis broker allows authenticated JMS clients to achieve remote code execution by sending crafted ObjectMessage payloads. The flaw stems from a logical inversion in the allow-list guard: when no allow-list is configured (the default), `isTrustedType()` unconditionally returns true, rendering the entire class-filtering mechanism inoperative. Affected products include Red Hat AMQ Broker 7, JBoss EAP 7 and 8, and Red Hat builds of Apache Camel - all widely deployed in enterprise Java environments. No public exploit or KEV listing has been identified at time of analysis, but deserialization gadget chains targeting common Java libraries are extensively documented.
Relative path traversal in Dell Secure Connect Gateway (SCG) 5.0 allows a low-privileged remote attacker to traverse directory boundaries and achieve remote code execution on affected systems. Both the Appliance variant (versions prior to 5.36.00.16) and the Application variant (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis, and Dell has issued a patch under advisory DSA-2026-382.
Path traversal in knowns (a Go-based MCP-integrated knowledge management server) before version 0.30.0 allows authenticated remote attackers to read, create, overwrite, and delete arbitrary Markdown files accessible to the server process by supplying directory traversal sequences in MCP tool arguments. The flaw is rooted in the absence of any path containment validation in the storage layer (doc_store.go and memory_store.go), meaning MCP-issued file paths were passed directly to filesystem operations without sanitization. No public exploit is identified at time of analysis, though the fix commit, patch diff, and security advisory are all publicly available.
Path traversal in the knowns template-preview API (versions before 0.30.0) allows unauthenticated remote attackers to read arbitrary server-side files by injecting directory traversal sequences into the `templateFile` parameter of `POST /api/templates/preview`, with file contents returned directly in the JSON response. Sensitive targets include credential files, database configuration, and API keys accessible to the knowns process user. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept exploit is identified in available data, though the attack class is trivially executable with any HTTP client against an exposed instance.