Denial of service via NULL-pointer dereference in strongSwan's x509 plugin affects versions 4.2.0 through 6.0.x, triggered during verification of X.509 attribute certificates. An unauthenticated remote attacker can crash the charon IKE daemon by presenting a crafted attribute certificate during VPN handshake negotiation, taking the gateway offline. Vendor-released fix is strongSwan 6.1.0, published September 7, 2026, as part of a coordinated batch of six CVE patches; no public exploit has been identified at time of analysis.
Denial of service via infinite loop in strongSwan's x509 plugin affects all deployments that process X.509 attribute certificates. An unauthenticated remote attacker can craft a malformed attribute certificate that triggers CWE-835 (infinite loop) during parsing, causing the IKE daemon to hang indefinitely and disrupting all VPN connectivity. The vendor fixed this in strongSwan 6.1.0 alongside six other vulnerabilities disclosed on 2026-09-07; no public exploit has been identified at time of analysis.
Unauthenticated remote exploitation of Dell Secure Connect Gateway (SCG) 5.0 - both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) - exposes a critical function with no authentication gate, allowing a network-adjacent or internet-facing attacker to trigger high-availability-impact operations without any credentials. Dell's advisory DSA-2026-382 classifies this under CWE-306 (Missing Authentication for Critical Function), indicating the affected endpoint simply lacks access control rather than having a bypassable one. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the fully unauthenticated network vector with low complexity represents a credible operational risk for any exposed SCG deployment.
Privilege escalation in WP Fusion (Pro) for WordPress allows authenticated attackers with Subscriber-level access to create new administrator accounts and achieve full site compromise. The vulnerability resides in the ThriveCart Auto Login handler's `thrivecart()` function, which fails to enforce authorization on the `role` parameter during user account creation, enabling callers to self-assign the `administrator` role. The required access_key is distributed openly to all ThriveCart customers as part of the plugin's documented setup, substantially lowering the practical barrier for anyone who has transacted with the target site's ThriveCart storefront; no public exploit or CISA KEV listing has been identified at time of analysis.
Input validation failure in Net::IP::LPM before 1.12 for Perl allows malformed CIDR prefix lengths to silently poison the longest-prefix-match lookup table. Non-numeric strings, Unicode digits (Arabic-Indic, fullwidth), hex notation, and integers exceeding 31 bits are all accepted and numified to zero or silently truncated by the XS/C layer, causing the malformed entry to be recorded as a /0 default route. A single such entry causes every subsequent lookup to succeed, rendering any IP-based allow-list universally permissive and any deny-list universally blocking. No public exploit has been identified at time of analysis, and EPSS is 0.17% (7th percentile).
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows remote unauthenticated attackers to bypass TLS protection mechanisms, enabling man-in-the-middle interception or modification of communications to and from the gateway. Both the Appliance form factor (versions prior to 5.36.00.16) and Application form factor (versions prior to 5.36.00.00) are confirmed affected by Dell advisory DSA-2026-382. No public exploit code exists and EPSS scoring of 0.14% (4th percentile) reflects very low current exploitation probability, consistent with SSVC's 'none' exploitation status.
Signature verification bypass in MCUboot's Direct XIP multi-image boot sequence allows an adjacent unauthenticated attacker to cause a radio co-processor to execute from an unauthenticated firmware slot. When the main application image and radio image reside in mismatched active slots, MCUboot's bare/upstream configuration lacks cross-image slot consistency enforcement - the main application passes the wrong slot address to the radio core, which then executes unverified firmware. No public exploit has been identified at time of analysis, but the advisory originates from Nordic Semiconductor's security portal, indicating vendor-confirmed scope across Direct XIP multi-core deployments.
Improper TLS certificate validation in Dell Secure Connect Gateway 5.0 allows an unauthenticated remote attacker occupying a man-in-the-middle network position to intercept and tamper with encrypted SCG communications, leading to unauthorized access. Both the physical Appliance variant (fixed in 5.36.00.16) and the virtual Application variant (fixed in 5.36.00.00) are affected across all 5.0.x releases preceding those thresholds, per Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified at time of analysis.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 allows a high-privileged remote attacker to inject arbitrary OS commands through the application's management interface, achieving privilege escalation beyond the application boundary to OS-level access. Both the SCG 5.0 Appliance (prior to 5.36.00.16) and SCG 5.0 Application (prior to 5.36.00.00) are affected, confirmed by Dell advisory DSA-2026-382. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; Dell has released patched versions for both product variants.
Unauthorized remote access to Dell Secure Connect Gateway (SCG) 5.0 is possible through a logic flaw rooted in CWE-480 (Use of Incorrect Operator), affecting both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00). The incorrect operator in a security-relevant conditional-likely an authentication or authorization check-produces a logic outcome that permits access without valid credentials, consistent with the CVSS PR:N vector and the 'Authentication Bypass' classification. Real-world impact spans limited confidentiality, integrity, and availability loss per the CVSS L/L/L impact ratings; no public exploit code or CISA KEV entry has been identified at time of analysis.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 exposes both Appliance and Application variants to protection mechanism bypass by unauthenticated remote attackers. The flaw (CWE-295) allows an adversary in a network-interception position to present an invalid or attacker-controlled TLS certificate that the SCG accepts without proper verification, potentially enabling interception or manipulation of communications between the gateway and backend or managed systems. Patch availability is confirmed via Dell advisory DSA-2026-382; no public exploit or CISA KEV listing is present at time of analysis.
Path traversal in the knowns MCP server's handleCodeReplace() function allows unauthenticated network attackers to overwrite arbitrary files outside the project root, including shell startup scripts (~/.bashrc, ~/.zshrc) and SSH configuration files (~/.ssh/authorized_keys). All knowns releases before v0.30.0 are affected; the root cause is the absence of path sanitization - the original code unconditionally joined caller-supplied paths onto the project root without verifying the resolved path remained within that boundary. No active exploitation confirmed in CISA KEV; no public exploit identified at time of analysis, though the GitHub security advisory and VulnCheck report provide sufficient technical detail for exploit construction.
Authorization bypass in knowns before v0.30.0 allows low-privileged users holding read-restricted sessions to escalate privileges by exploiting the permission guard's misclassification of code mutation operations as read-only. Specifically, the `code.replace`, `code.rename`, `code.insert`, and `code.delete` MCP handlers failed to enforce write-access checks, enabling a low-privilege session to overwrite `.knowns/` permission configuration files and elevate to administrative access on subsequent calls. No public exploit has been identified at the time of analysis; a vendor-confirmed patch is available as v0.30.0.
Stored cross-site scripting in the User Profile Builder WordPress plugin (Cozmoslabs, versions ≤3.15.7) permits unauthenticated attackers to inject persistent JavaScript payloads via the 'Biographical Info' registration field, which execute in any visitor's browser upon viewing the affected profile page. The vulnerability is rooted in missing input sanitization and output escaping in class-formbuilder.php and class-email-confirmation.php, enabling session hijacking, credential theft, or malicious redirects targeting administrators and other authenticated users. A patch is confirmed via WordPress.org SVN changeset 3511465; no public exploit code or active exploitation has been identified at time of analysis.
Tunneled EAP authentication in strongSwan before 6.1.0 can be bypassed when the IKEv2 responder fails to properly enforce inner EAP method authentication details, enabling a network attacker with a low-privilege outer-tunnel identity to obtain an authorized VPN session without completing the inner credential exchange. The flaw (CWE-863, Incorrect Authorization) is limited to deployments using tunneled EAP methods such as EAP-TTLS or EAP-PEAP; certificate-only or non-tunneled EAP configurations are not affected. Vendor-released patch strongSwan 6.1.0 is available; no public exploit identified at time of analysis.
Disk-exhaustion denial of service in MISP ≤2.5.45 is exploitable by any authenticated user, including read-only accounts, due to a wildcard ACL entry ('*') on the TemplatesController::uploadFile() endpoint. The handler writes uploaded content to app/tmp/files/ without verifying that the caller holds the perm_add or perm_template role, allowing repeated uploads to consume server disk space. The fix commit explicitly rules out escalation to RCE, stored XSS, or path traversal - impact is availability-only. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization in MISP versions 2.5.45 and earlier exposes cryptographic signing key material - including raw key data, key type, and fingerprint - to any authenticated user on the platform, regardless of whether they are permitted to view the associated parent event. The CryptographicKeysController::view() handler fetched CryptographicKey records directly by supplied ID without resolving or authorizing the parent event, enabling cross-event key exfiltration within shared MISP instances. No public exploit has been identified at time of analysis; a patch is available in upstream commit 2edde619b.
Server-side request forgery in MISP ≤2.5.45 allows high-privileged users who configure threat intelligence feeds or TAXII discovery endpoints to cause MISP to make outbound HTTP requests to internal network resources and to exfiltrate configured feed authentication credentials to attacker-controlled hosts via unsanitized redirect following. A secondary incomplete SSRF defense in the TAXII discovery path failed to block IPv6 loopback (::1), hex-encoded addresses (0x7f000001), and multi-record DNS responses because it relied on gethostbyname() against a short literal blocklist. No public exploit code or active exploitation (CISA KEV) has been identified; patch commits are available upstream.