Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthenticated attackers to execute arbitrary code by injecting special elements into the template engine (CWE-1336). Rated CVSS 10.0 with a changed scope, the flaw requires no user interaction and grants code execution in the context of the current user, per Adobe advisory APSB26-146. No public exploit has been identified at time of analysis, but the maximal score and unauthenticated network reach make this a top-priority patch for e-commerce operators.
Stack-based buffer overflow in the D-Link DIR-822A (firmware A_101) router allows attackers to corrupt memory in the udhcpd DHCP server via an unbounded strcpy in serverpacket.c while parsing TR-111 DHCP Option 125. The exploit writeup and VulDB entry are public (publicly available exploit code exists), and successful exploitation can crash the DHCP service or achieve code execution on the device. No confirmed active exploitation (not in CISA KEV), but a working POC lowers the bar for opportunistic use against reachable devices.
Authentication bypass in the LibreNMS REST API (all versions before 26.8.0) lets unauthenticated remote attackers reach protected endpoints by submitting a small integer (0-9) in place of a string API token, abusing MySQL loose type coercion so the integer matches a stored token hash. Successful bypass exposes device credentials and administrative functionality, and can be chained to remote code execution through alert templates. Reported by VulnCheck; no public exploit is identified at time of analysis, though the type-confusion technique is fully described in the advisory.
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remote unauthenticated attackers assume Directory Manager authority without valid credentials. A stale SASL auxiliary identity left over from a failed SASL PLAIN bind is incorrectly installed onto the connection when a later, unrelated bind (e.g. SASL ANONYMOUS) succeeds on the same connection. No public exploit was identified at time of analysis, and the flaw is not listed in CISA KEV, but the trivially reproducible bind sequence makes weaponization straightforward.
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine administrators-group membership. The self-managed OTP token ACI does not require authentication and fails to restrict which attributes may be added alongside a token entry; chained with a separately-tracked directory-server ACI evaluation flaw, an unauthenticated LDAP client can create an attacker-controlled Kerberos principal and place it in the administrators group. Assigned CVSS 9.8 (CWE-306, Missing Authentication); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated remote attacker to escape the intended directory and execute arbitrary code by supplying crafted path input. Both the Appliance (versions before 5.36.00.16) and the Application (versions before 5.36.00.00) deployments of SCG 5.0 Virtual Edition are affected. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; EPSS is a modest 0.43% (36th percentile), but the network-reachable, unauthenticated path-traversal-to-RCE profile warrants prompt patching.
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing accounts by asserting a victim's email address without proving ownership of it. All YouTrack builds before 2025.3.161254 and 2026.1.14042 are affected. Because the flaw is a trust failure in how Helpdesk associates a self-provided email with an account, exploitation requires no credentials, no user interaction, and works against default configurations where Helpdesk is enabled. No public exploit identified at time of analysis.
Remote code execution in Next4Biz CSM (Customer Service Management) up to build 07092026 allows unauthenticated attackers to inject and execute code by supplying crafted serialized objects that the application deserializes without validation (CWE-502). Reported by Turkey's national CSIRT (TR-CERT/USOM); the vendor was contacted but did not respond, and no fixed build is confirmed. No public exploit identified at time of analysis, and no KEV/EPSS enrichment is available in the provided data.
Privilege escalation to superuser in JetBrains Hub before 2026.2.52442 allows an unauthenticated remote attacker to register a trusted service and thereby obtain full administrative (superuser) control over the identity-management server. Because Hub is the single sign-on and authorization backbone for JetBrains tooling (YouTrack, TeamCity, Upsource), compromise cascades to every application relying on it for authentication. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Remote command execution in Dell Secure Connect Gateway 5.0 (Appliance versions before 5.36.00.16 and Application versions before 5.36.00.00) lets a remote, unauthenticated attacker run commands on the target by sending a specially crafted request that bypasses intended authorization checks. Dell has released fixed versions and the flaw is rated critical (CVSS 9.4). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Account takeover in Bahçelievler Municipality's BiHayat App (versions 2.1.7 through build 07092026) is possible because the authentication flow imposes no limit on repeated login attempts, letting remote attackers brute-force credentials or bypass authentication controls entirely. TR-CERT reported the flaw and the vendor did not respond to disclosure. There is no public exploit identified at time of analysis and it is not in CISA KEV.
Missing authentication in Knowns (knowns-dev/knowns) before 0.30.0 exposes the management API on all network interfaces (0.0.0.0) by default with no password set on fresh installs, letting anyone with network reachability drive the server. Attackers can call the unauthenticated /api/tunnel/start endpoint to spin up a public tunnel that republishes the entire management API at an internet-reachable address, escalating a LAN-only exposure into full public exposure. Reported by VulnCheck and fixed in v0.30.0; publicly available exploit code exists in the sense that the vulnerable endpoints and fix are documented, but no active exploitation is confirmed (not in CISA KEV).
Authentication bypass in the WebGUI of NEC's UNIVERGE IX-R/IX-V series network routers allows remote attackers to tamper with WebGUI messages and execute arbitrary CLI commands on the device without valid credentials. Because the affected management interface can be reached over the internet, an unauthenticated attacker can gain administrative-level command execution, effectively compromising the router's configuration and traffic-handling. No public exploit has been identified at time of analysis, but the CVSS 4.0 base score of 9.3 reflects the low complexity and high impact.
Local privilege escalation to root in Dell Secure Connect Gateway (SCG) 5.0 lets a low-privileged operator with SSH access to the appliance host obtain full root control without a password by abusing the exposed Docker socket (CWE-250, Execution with Unnecessary Privileges). Affected builds are the SCG Appliance prior to 5.36.00.16 and the SCG Application prior to 5.36.00.00. The same socket exposure also enables container escape: an attacker who compromises any service inside the orchestrator container can break out to host-level control. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the technique (writable/accessible Docker socket) is a well-known and reliable escalation path.
Unauthorized remote access to Dell Secure Connect Gateway (SCG) 5.0 is possible because the product fails to properly validate TLS certificates (CWE-295), affecting the Appliance edition before 5.36.00.16 and the Application edition before 5.36.00.00. An unauthenticated network attacker able to intercept or interpose on connections can defeat the trust chain and gain access to protected resources or data. A vendor patch is available (DSA-2026-382); no public exploit identified at time of analysis and EPSS is low (0.15%).
Remote code execution in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated remote attacker to exploit a path-traversal flaw and execute code on the appliance. Both the Appliance edition (before 5.36.00.16) and the Application edition (before 5.36.00.00) of the SCG 5.0 virtual-edition telemetry/remote-support gateway are affected. There is no public exploit identified at time of analysis; EPSS estimates a modest 0.35% (28th percentile) exploitation probability and CISA's SSVC framework lists exploitation status as none.