Privilege escalation in JetBrains YouTrack before version 2026.2.18634 enables authenticated low-privileged users to alter group memberships without proper server-side authorization validation, effectively granting themselves elevated rights. The flaw (CWE-266, Incorrect Privilege Assignment) means the application trusts client-supplied group membership parameters without enforcing that the requesting user has the authority to make such changes. With a CVSS base score of 8.8 and full C:H/I:H/A:H impact, successful exploitation yields the equivalent of full administrative control over the YouTrack instance.
Uncontrolled resource consumption in MISP ≤2.5.45 allows unauthenticated remote attackers to exhaust persistent storage by flooding the password-reset and related pre-authentication endpoints, each of which performs durable database writes before validating or throttling the caller. The `/users/forgot` endpoint accepted arbitrarily long, unvalidated email values and generated two write operations per request - an audit log entry and a queued background job - with no rate limit, enabling storage and job-queue exhaustion at modest request rates. The upstream fix (commit d75d899be, reported by CIRCL) adds a 1024-byte email length cap, format validation, a Redis-backed per-source flood filter with HTTP 429 responses, and a 15-minute API-access request cooldown; no public exploit or CISA KEV listing has been identified at time of analysis.
Argument injection in LibreNMS's graph_title parameter allows authenticated low-privilege users to break out of double-quote escaping and inject arbitrary rrdtool arguments, effectively bypassing per-device authorization controls. Affected versions prior to 26.8.0 permit attackers to inject DEF and LINE directives to read RRD files from devices they are not authorized to access, or use newline injection to execute arbitrary rrdtool commands. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires only a valid low-privilege account, lowering the exploitation bar significantly.
Unauthenticated remote denial-of-service in Eclipse Jetty's WebSocket implementation allows any network-accessible client to exhaust the JVM heap by sending a single WebSocket frame with an unknown opcode and an arbitrarily large declared payload length. When auto-fragmentation is enabled, unknown opcodes bypass the normal maximum frame size check, causing Jetty to attempt heap allocation for the declared payload size before the opcode is ever validated - a logic-ordering flaw classified under CWE-770. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) reflects high impact and low attack barrier; no public exploit has been identified at time of analysis.
Quadratic CPU exhaustion in league/commonmark 2.0.0-2.8.3 allows unauthenticated remote attackers to deny service by submitting Markdown documents that force many headings onto the same base slug. UniqueSlugNormalizer::normalize() restarts its numeric-suffix search from 1 on every slug collision, producing O(K²) comparisons for K colliding slugs - enabling a small, crafted document to consume seconds of CPU time. No public exploit code has been confirmed, but the attack is trivially constructible from the GHSA advisory description alone, and no authentication is required against any endpoint that renders attacker-controlled Markdown.
Quadratic-time algorithmic complexity in league/commonmark's Attributes extension exposes PHP applications to remote denial of service. AttributesListener::findTargetAndDirection() walks the entire sibling list for each attribute node when no left-side target exists, producing O(N²) parse time; a ~32 KB payload of repeated {#a} blocks (8,000 iterations) takes over 5 seconds to process. Any deployment that has enabled AttributesExtension and accepts untrusted Markdown input is vulnerable across all 1.x releases from 1.5.0 and all 2.x releases prior to 2.9.0. No public exploit or KEV listing identified at time of analysis, but the attack is trivially reproducible from the published advisory.
Quadratic parsing complexity in league/commonmark (thephpleague/commonmark, versions ≥1.5.0 and <2.9.1) allows unauthenticated remote attackers to exhaust server CPU and cause denial of service by submitting small, specially crafted Markdown documents. Two non-default first-party extensions are affected: SmartPunctExtension, whose ReplaceUnpairedQuotesListener performs O(n²) string copying via AdjacentTextMerger on each unpaired quote node, and AttributesExtension, whose findTargetAndDirection() re-scans the entire sibling chain for every contiguous block-level Attributes node at O(n²/2) cost. Exploitation is conditional on the application explicitly registering either extension; all standard bundled converters are unaffected. Fixed in version 2.9.1, which also closes an incomplete AttributesExtension fix shipped in 2.9.0 for the related inline-variant issue GHSA-g2gp-3wwq-f4ph.
Three independent super-linear parsing paths in league/commonmark before 2.9.1 allow unauthenticated remote attackers to exhaust server CPU by submitting crafted Markdown input. The fenced code block path exhibits quadratic complexity due to catastrophic regex backtracking in FencedCodeStartParser, a 320 KB single-line payload taking ~27 seconds to process without triggering PCRE's backtrack limit. The reference link label lookup path performs multiple full-string normalization passes per nested bracket pair, and the emphasis/delimiter path similarly degrades under long delimiter sequences - all three are reachable with a stock CommonMarkConverter and default configuration. No public exploit has been identified at time of analysis, but the GHSA advisory documents precise triggering payloads.
Quadratic-blowup denial of service in league/commonmark's Footnote extension allows remote unauthenticated attackers to exhaust PHP server resources by crafting documents with duplicate footnote definitions. The GatherFootnotesListener and NumberFootnotesListener classes append the full backref list for every duplicate definition without deduplication, producing O(N²) FootnoteBackref nodes - a ~10 KB crafted document expands into ~62 MB of HTML output, ~440 MB of peak memory, and ~3 seconds of CPU time, sufficient to OOM-kill a default 128 MB PHP worker. All library releases from 1.5.0 (May 2020) through 2.8.x are affected; no public exploit identified at time of analysis, but the amplification ratio is deterministic and trivially reproducible.
Quadratic CPU exhaustion in league/commonmark's optional AttributesExtension (versions 1.5.0 through 2.9.2) allows unauthenticated remote attackers to perform denial of service against PHP applications that explicitly register this extension. By submitting Markdown containing many distinctly-named attributes targeting a common block, an attacker triggers O(n²) attribute merging and filtering loops; a 256 KB payload consumes over 20 seconds of PHP CPU time per conversion request. No public exploit code has been identified at time of analysis, but the attack primitive is described in sufficient detail in the GitHub Security Advisory that construction is trivial, and developers who applied the partial 2.9.1 patch for the prior advisory GHSA-jjv6-8j6v-6j52 may incorrectly believe they are already protected.
Buffer overflow in Nordic Semiconductor's nRF Connect SDK Bluetooth CGMS RACP write handler allows an authenticated BLE peer within radio range to overflow a 20-byte static buffer into adjacent BSS memory. Exploitability and exact impact are build-specific: because BSS layout is determined at link time per firmware build, adjacent corrupted data may be security-neutral or may include function pointers or critical control structures enabling code execution or device crash. No public exploit has been identified at time of analysis; the vulnerability was reported through YesWeHack.
Missing authorization on the MarketplaceModuleBrowser installModule Livewire action in Lara Dashboard before 1.3.2 permits any authenticated non-Superadmin administrator to install arbitrary PHP modules from the marketplace. Because module downloads occur over unsigned HTTP without integrity verification, an attacker holding an administrator credential can pull and auto-activate attacker-chosen PHP code, achieving remote code execution on the underlying server. The fix is available in v1.3.2; no public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect authorization in Lara Dashboard before v1.3.2 permits any administrator holding the `settings.edit` permission - not just Superadmins - to upload arbitrary zip archives to the core upgrade endpoint, overwriting live PHP application source files. An authenticated non-Superadmin administrator can inject system commands into files such as `routes/web.php`, achieving code execution as the web server user with access to `.env` secrets and database credentials. No public exploit has been identified at time of analysis; a vendor-released patch (v1.3.2) is available and the fix is confirmed by GHSA-xv98-x5h7-4g7v.
Cross-tenant GitHub App installation token theft in JetBrains YouTrack before 2026.2.18634 lets any authenticated user retrieve GitHub App installation tokens belonging to other tenants due to a shared, non-isolated token cache. The root cause is CWE-488 (Exposure of Data Element to Wrong Session): cached tokens were keyed without tenant-scope isolation. With a stolen installation token, an attacker can authenticate to the GitHub API as the victim organization's GitHub App, gaining access to that organization's repositories, pull requests, issues, and CI/CD integrations; no public exploit has been identified at time of analysis.
Arbitrary binary execution in knowns before 0.30.0 is triggered when a developer opens a repository containing a crafted .knowns/config.json with a malicious settings.lsp.languages binary value. The LSP subsystem passes the attacker-controlled binary path directly to OS execution routines without any allowlist check, invoking the path twice under the victim's user account with no verification step. No public exploit is identified at time of analysis, though the GitHub security advisory GHSA-mc52-mwq4-vfx3 and the patch commit d3989829 provide full technical detail on both vulnerable code paths.
Shell command injection in the Cockpit 389 Console allows an LDAP user with delegated entry-creation privileges to achieve root code execution on the directory server host. The 389-ds-base package, as deployed in Red Hat Directory Server 11/12/13 and RHEL 6-10, constructs ldapsearch commands by embedding LDAP distinguished names directly into shell strings without escaping metacharacters. An attacker controlling LDAP write access can plant a malicious DN; when a Cockpit administrator views that entry, injected shell commands execute with root privileges. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged attacker to escalate privileges to kernel level with full system compromise. The CVSS vector (AV:L/AC:L/PR:N/UI:N) reflects that any Android app running on an affected device can trigger this flaw without special permissions or user interaction, consistent with typical Android kernel driver exposure. SSVC rates exploitation as 'none' and the attack as non-automatable, though technical impact is assessed as total; no public exploit or CISA KEV entry exists at time of analysis.
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset variants via a heap-based out-of-bounds write stemming from a missing bounds check (CWE-122). An unprivileged local process on any affected device can trigger the flaw to achieve full kernel-level read, write, and execute access without requiring any user interaction. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the sheer breadth of affected chipsets across MediaTek's mid-range and budget device portfolio makes systematic patch deployment a significant supply-chain challenge.
Local code execution on Remote Development hosts is possible in JetBrains IntelliJ IDEA versions before 2026.2.2 due to the IJent gRPC server running without TLS encryption or any authentication mechanism. The IJent agent, deployed on remote hosts when the Remote Development feature is in use, accepts connections from any local process without requiring credentials, enabling arbitrary command execution under the agent's security context. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Incorrect authorization in Eclipse Ankaios v0.5.1-v1.0.1 allows an authenticated workload to bypass its scoped access restrictions on the agent-side Control Interface. When the cluster is configured with multi-segment allow rules whose first path segment is a wildcard (e.g., `*.workloads.some_workload`), submitting a CompleteStateRequest or UpdateStateRequest with an empty field mask is incorrectly evaluated as matching the scoped rule, granting the workload full read or write access beyond its authorized state subtree. No public exploit is identified at time of analysis; a patched release (v1.0.2) is available.
Unauthenticated resource exhaustion in ash_authentication_oauth2_server 0.3.0 enables any remote attacker to grow database storage and heap memory without bound when the Client ID Metadata Document (CIMD) feature is enabled. The /authorize endpoint's resolve_client/3 function fetches and permanently upserts one database row per distinct URL-shaped client_id, with no row cap, no TTL-based expiry, and no field-length limit; additionally, fetched documents enter CIMD.Cache before validation, meaning even rejected documents consume cache memory until their TTL expires. No public exploit code or active exploitation has been identified at time of analysis.
Sensitive field disclosure in ash_lua (versions 0.1.0 through 0.2.0) allows any actor who can submit a Lua script to read Ash resource attributes that are deliberately excluded from the manifest's exposed-field allow-list - including sensitive?: true columns such as hashed passwords. The operation aggregate path in AshLua.Runtime resolved field names directly via String.to_existing_atom and Ash.Query.Aggregate.new! without invoking the same AshLua.Fields.for_action/4 allow-list check enforced by the normal field-read path, creating an alternate route to private data. Vendor patch 0.2.1 is confirmed available; no CISA KEV listing or independent exploit beyond the PoC embedded in the security advisory has been identified.
Missing authentication on critical API functions in Dell Secure Connect Gateway (SCG) 5.0 exposes privileged operations to remote unauthenticated attackers, enabling unauthorized access that yields high integrity impact and limited confidentiality exposure. Both deployment forms - the virtual Appliance (prior to 5.36.00.16) and the Application (prior to 5.36.00.00) - are affected. Dell has released patches via advisory DSA-2026-382; no public exploit or CISA KEV listing exists at time of analysis, but the attack path (AV:N/AC:L/PR:N/UI:N) requires minimal attacker capability.
Relative path traversal in Dell Secure Connect Gateway 5.0 (both Appliance and Application editions) exposes unauthenticated remote attackers to a full-compromise pathway culminating in remote code execution. Both hardware appliance deployments (prior to 5.36.00.16) and software/virtual application deployments (prior to 5.36.00.00) are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified at time of analysis; EPSS exploitation probability stands at 0.53%, and SSVC classifies exploitation status as none.
Eval injection in FreeIPA's idp-add command allows any authenticated IPA domain principal, regardless of privilege, to enumerate the server process's environment variables and cause memory exhaustion denial of service. The flaw arises because user-supplied --organization and --base-url inputs reach a constrained eval() call before the LDAP access control check that should gate idp-add to IPA administrators is enforced - creating an authorization-order bypass. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Dell Secure Connect Gateway (SCG) 5.0 exposes a critical management function without any authentication requirement (CWE-306), enabling an unauthenticated remote attacker to achieve full confidentiality, integrity, and availability compromise against affected deployments. Both the Appliance variant (versions prior to 5.36.00.16) and the Application variant (versions prior to 5.36.00.00) are confirmed vulnerable per Dell advisory DSA-2026-382 and EUVD-2026-72375. No public exploit has been identified at time of analysis; Dell has released patches for both deployment forms.
Missing authorization in JetBrains YouTrack's REST API allows authenticated low-privileged users to access and modify restricted resources via Insecure Direct Object Reference (IDOR). Affected versions span all YouTrack releases prior to 2026.2.18788, 2026.1.14055, and 2025.3.161254 across three active release branches. An attacker with any valid account can enumerate or directly reference object identifiers in REST API calls to read or write data they should not have access to, with high confidentiality and integrity impact per the CVSS vector.
Host-level code execution in JetBrains IntelliJ IDEA before 2026.2.2 is triggered when a developer opens a malicious project containing a crafted Dev Container configuration, which the IDE proceeds to build without first requesting the standard project-trust confirmation. The flaw (CWE-829) allows untrusted, project-defined container build scripts and Docker commands to execute directly on the developer's host machine, bypassing the IDE's safety gate. JetBrains confirmed the issue and released a fix in version 2026.2.2; no public exploit has been identified at time of analysis.
Out-of-bounds write in Samsung's open-source Walrus WebAssembly runtime allows a crafted WASM component to corrupt process heap memory via a WASI 0.2 stream-read implementation flaw. The root cause is a `memcpy` in `WASI02Impl.cpp` that copies the requested read length (`size`) rather than the actual bytes read (`read`) from the buffer, writing beyond valid buffer bounds when a partial or short read occurs. A secondary defective bounds check for type-index validation in the WASM component parser compounds the attack surface. A proof-of-concept WASM file (`stream-read-oob-poc.wast`) was committed as part of the fix in PR #482, confirming exploitability; no public exploit independent of the fix has been identified at time of analysis.
Local privilege escalation in Dell Secure Connect Gateway 5.0 enables a low-privileged authenticated user with local shell access to gain elevated - likely root or administrator-level - control of the affected host. Both the virtual appliance (prior to 5.36.00.16) and standalone application (prior to 5.36.00.00) deployments are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified, and vendor-released patches are available for both product variants.
Privilege escalation in Dell Secure Connect Gateway (SCG) 5.0 allows a local attacker with basic system access to gain full administrative control of the affected host. The root cause is improper privilege management (CWE-269) in both the SCG 5.0 Application (prior to 5.36.00.00) and SCG 5.0 Appliance (prior to 5.36.00.16), as confirmed by Dell advisory DSA-2026-382. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Hard-coded credentials embedded in Dell Secure Connect Gateway (SCG) 5.0 expose both the Appliance and Application deployments to unauthenticated remote compromise. A network-accessible attacker who discovers or obtains the static credentials can authenticate without any supplied privileges and gain unauthorized access with high confidentiality and integrity impact. No public exploit or active CISA KEV listing has been identified at time of analysis; Dell has confirmed the vulnerability and released fixed versions via advisory DSA-2026-382.
Incorrect authorization in JetBrains YouTrack before versions 2025.3.160480 and 2026.1.14047 allows authenticated low-privilege users to modify linked issue entities they lack update permission on by issuing PUT requests directly to link sub-resources. The flaw bypasses YouTrack's permission model at the HTTP method level, enabling integrity violations across project boundaries-reflected in the CVSS scope change (S:C). No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized integrity modification in JetBrains YouTrack before 2026.2.18634 allows any authenticated low-privilege user to alter links on issues they are explicitly prohibited from accessing by exploiting the whiteboard clone operation. The whiteboard clone workflow fails to validate the cloning user's authorization against issues referenced in the board, enabling cross-boundary write access governed by CWE-862 (Missing Authorization). No public exploit has been identified at time of analysis, but the CVSS 7.7 vector (S:C, I:H, PR:L, AC:L) accurately reflects the low barrier to exploitation and the cross-domain integrity impact.
Unauthenticated remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13) allows a network attacker to crash the LDAP server by sending a crafted sequence of search requests that combine the paged results control with the USE_ONE_BACKEND control, triggering a NULL pointer dereference in `op_shared_search`. The crash terminates the directory service process, disrupting all LDAP-dependent services such as authentication, authorization, and group resolution until manually restarted. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N vector makes automated, repeated disruption straightforward.
Heap buffer overflow in 389 Directory Server's SASL I/O layer allows a remote authenticated attacker to crash the server or potentially execute arbitrary code. The root cause is an integer underflow in `sasl_io_read_packet()`: a crafted SASL record with a wire-format length of 0, 1, or 2 bytes causes an unsigned subtraction to wrap around, instructing `PR_Recv` to read approximately 4 GiB of attacker-controlled network data into a 1024-byte heap buffer. The flaw is explicitly distinct from CVE-2026-11774, whose patch addressed only upper-bound validation, leaving the lower-bound path unguarded. No public exploit code or CISA KEV listing has been identified at time of analysis.
Improper Certificate Validation (CWE-295) in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated attacker positioned on the same network segment to intercept or manipulate TLS-protected communications, leading to unauthorized access to sensitive data or remote-support sessions. Both the Appliance variant (versions prior to 5.36.00.16) and the Application variant (versions prior to 5.36.00.00) are affected. The CVSS AV:A vector confirms this is not a direct internet exploit - the attacker must be adjacent to the network segment hosting the SCG deployment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated path traversal in Next4Biz CSM (Customer Service Management) versions 6.8.9 through 07092026 allows remote attackers to read arbitrary files from the server filesystem with no credentials required. The flaw is classified under CWE-22 and carries a CVSS 3.1 score of 7.5 with a network-accessible, zero-interaction vector, meaning any internet-reachable deployment is potentially exposed to full confidentiality compromise. Disclosed by TR-CERT (Turkish national CERT), the vendor did not respond to the disclosure, and no patch has been confirmed as available at time of analysis.
Use-after-free in strongSwan's IKEv2 Multi-Key Exchange (Multi-KE, RFC 9370) implementation is triggered when two authenticated IKE peers simultaneously initiate a rekey operation, causing a race condition that corrupts heap memory and can result in remote code execution within the IKE daemon. The attack requires an established IKE session and high-complexity timing to induce the collision, reflected in the CVSS AC:H/PR:L vector. Fixed in strongSwan 6.1.0, released September 7, 2026, alongside six other CVEs disclosed in the same advisory batch. No public exploit identified at time of analysis.
Unauthenticated integrity compromise in 389 Directory Server (shipped as Red Hat Directory Server 11/12/13 and bundled in RHEL 6-10) allows anonymous LDAP clients to bypass SELFDN-based access control checks. The SELFDN ACI bind-rule evaluator incorrectly equates an anonymous client's empty bind DN with an empty stored attribute value in a target directory entry, satisfying an ACI that was intended to permit only a matching authenticated identity. Exploitation enables anonymous directory modifications - including adding or altering entries - that SELFDN ACIs were designed to restrict to specific authenticated users. No public exploit has been identified at time of analysis.
Denial of service via NULL-pointer dereference in strongSwan's x509 plugin affects versions 4.2.0 through 6.0.x, triggered during verification of X.509 attribute certificates. An unauthenticated remote attacker can crash the charon IKE daemon by presenting a crafted attribute certificate during VPN handshake negotiation, taking the gateway offline. Vendor-released fix is strongSwan 6.1.0, published September 7, 2026, as part of a coordinated batch of six CVE patches; no public exploit has been identified at time of analysis.
Denial of service via infinite loop in strongSwan's x509 plugin affects all deployments that process X.509 attribute certificates. An unauthenticated remote attacker can craft a malformed attribute certificate that triggers CWE-835 (infinite loop) during parsing, causing the IKE daemon to hang indefinitely and disrupting all VPN connectivity. The vendor fixed this in strongSwan 6.1.0 alongside six other vulnerabilities disclosed on 2026-09-07; no public exploit has been identified at time of analysis.
Unauthenticated remote exploitation of Dell Secure Connect Gateway (SCG) 5.0 - both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) - exposes a critical function with no authentication gate, allowing a network-adjacent or internet-facing attacker to trigger high-availability-impact operations without any credentials. Dell's advisory DSA-2026-382 classifies this under CWE-306 (Missing Authentication for Critical Function), indicating the affected endpoint simply lacks access control rather than having a bypassable one. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the fully unauthenticated network vector with low complexity represents a credible operational risk for any exposed SCG deployment.
Privilege escalation in WP Fusion (Pro) for WordPress allows authenticated attackers with Subscriber-level access to create new administrator accounts and achieve full site compromise. The vulnerability resides in the ThriveCart Auto Login handler's `thrivecart()` function, which fails to enforce authorization on the `role` parameter during user account creation, enabling callers to self-assign the `administrator` role. The required access_key is distributed openly to all ThriveCart customers as part of the plugin's documented setup, substantially lowering the practical barrier for anyone who has transacted with the target site's ThriveCart storefront; no public exploit or CISA KEV listing has been identified at time of analysis.
Input validation failure in Net::IP::LPM before 1.12 for Perl allows malformed CIDR prefix lengths to silently poison the longest-prefix-match lookup table. Non-numeric strings, Unicode digits (Arabic-Indic, fullwidth), hex notation, and integers exceeding 31 bits are all accepted and numified to zero or silently truncated by the XS/C layer, causing the malformed entry to be recorded as a /0 default route. A single such entry causes every subsequent lookup to succeed, rendering any IP-based allow-list universally permissive and any deny-list universally blocking. No public exploit has been identified at time of analysis, and EPSS is 0.17% (7th percentile).
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows remote unauthenticated attackers to bypass TLS protection mechanisms, enabling man-in-the-middle interception or modification of communications to and from the gateway. Both the Appliance form factor (versions prior to 5.36.00.16) and Application form factor (versions prior to 5.36.00.00) are confirmed affected by Dell advisory DSA-2026-382. No public exploit code exists and EPSS scoring of 0.14% (4th percentile) reflects very low current exploitation probability, consistent with SSVC's 'none' exploitation status.
Signature verification bypass in MCUboot's Direct XIP multi-image boot sequence allows an adjacent unauthenticated attacker to cause a radio co-processor to execute from an unauthenticated firmware slot. When the main application image and radio image reside in mismatched active slots, MCUboot's bare/upstream configuration lacks cross-image slot consistency enforcement - the main application passes the wrong slot address to the radio core, which then executes unverified firmware. No public exploit has been identified at time of analysis, but the advisory originates from Nordic Semiconductor's security portal, indicating vendor-confirmed scope across Direct XIP multi-core deployments.
Improper TLS certificate validation in Dell Secure Connect Gateway 5.0 allows an unauthenticated remote attacker occupying a man-in-the-middle network position to intercept and tamper with encrypted SCG communications, leading to unauthorized access. Both the physical Appliance variant (fixed in 5.36.00.16) and the virtual Application variant (fixed in 5.36.00.00) are affected across all 5.0.x releases preceding those thresholds, per Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified at time of analysis.
Path traversal in the knowns MCP server's handleCodeReplace() function allows unauthenticated network attackers to overwrite arbitrary files outside the project root, including shell startup scripts (~/.bashrc, ~/.zshrc) and SSH configuration files (~/.ssh/authorized_keys). All knowns releases before v0.30.0 are affected; the root cause is the absence of path sanitization - the original code unconditionally joined caller-supplied paths onto the project root without verifying the resolved path remained within that boundary. No active exploitation confirmed in CISA KEV; no public exploit identified at time of analysis, though the GitHub security advisory and VulnCheck report provide sufficient technical detail for exploit construction.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 exposes both Appliance and Application variants to protection mechanism bypass by unauthenticated remote attackers. The flaw (CWE-295) allows an adversary in a network-interception position to present an invalid or attacker-controlled TLS certificate that the SCG accepts without proper verification, potentially enabling interception or manipulation of communications between the gateway and backend or managed systems. Patch availability is confirmed via Dell advisory DSA-2026-382; no public exploit or CISA KEV listing is present at time of analysis.