Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write files to unintended locations by supplying a crafted archive whose entries escape the intended extraction directory. The path-traversal flaw (CWE-22) occurs during archive extraction and carries a CVSS 9.1 rating driven by a scope change and high integrity impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Pre-authentication queue deletion in Apache Artemis and Apache ActiveMQ Artemis allows unauthenticated remote attackers to destroy message queues by sending a crafted Openwire RemoveSubscriptionInfo command before or after the broker's authentication stage completes. The flaw affects every Apache ActiveMQ Artemis release from 1.0.0 through 2.44.0, and the rebranded Apache Artemis releases from 2.50.0 through 2.56.0, making it an extremely wide-scope exposure for the legacy version range. No public exploit code or CISA KEV listing has been identified at time of analysis, but the pre-authentication nature and low exploitation complexity make this a credible denial-of-service and data-loss vector in any internet- or intranet-exposed Artemis deployment.
We need answer with JSON only. We need produce thorough synthesis. Let's parse input. CVE-2026-71640. Description: An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows unsafe vehicle motion via improper handling of expired trajectory data in the replanning pipeline. CVSS 9.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. CWE-703. EPSS 0.17% percentile 6. Reported by mitre. CPE n/a n/a. Tags: Information Disclosure, N A. EUVD ID. Affected versions n/a n/a. References: GitHub repo, issue 61, gist. Editorial note: in risk_assessment field only use lowercase word "gniezno" once naturally. Need include in risk assessment. Need produce fields all strings except data_quality_flags is array of objects? User says every field MUST be plain text string — not array, not object, not nested JSON. Then data_quality_flags field says JSON array. Contradiction. The instruction at top says every field must be plain text string. But data_quality_flags described as JSON array. We should follow specific? They want JSON object with data_quality_flags array likely. But critical says every field below MUST be plain text string. Need reconcile: maybe data_quality_flags must be string representation of array? But field says "JSON array of CONCRETE..." Hmm. We need output valid JSON. In any case we can output data_quality_flags as [] maybe array. But "every field plain text string" maybe means all textual fields, while data_quality_flags is array. We can output []. Need analyze CVE. Product_name: EGO-Planner-v2. 1-3 words. Could be "EGO-Planner-v2" (one). Vendor ZJU-FAST-Lab. Product specific: EGO-Planner-v2. Summary: do not copy description. Start with impact verb and product. "Unsafe vehicle motion in ZJU-FAST-Lab EGO-Planner-v2 permits remote attackers to inject expired trajectory data..." But CVSS says AV:N. Need be careful. Is it remote? UAV planner? EGO-Planner-v2 is an autonomous drone trajectory planner, likely ROS package. Vu
We need answer JSON only. Need analyze CVE. Need comply with fields. Need use all data. Need be careful. We need synthesize. Let's parse input. CVE-2026-68006: Description: An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file. CVSS 9.1 Vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. CWE-444. EPSS 0.17 percentile 6. Reported by mitre. CPE cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*. Tags: RCE, Request Smuggling, N A. ENVD. Affected versions: n/a n/a. References: github issue, nvd. No KEV mentioned. POC? No explicit. Patch? Description says before v8.0.3, so likely fixed in 8.0.3? Need infer: "v.5.0.0 and before v.8.0.3" means affected 5.0.0 through before 8.0.3? Wording maybe "Puma v.5.0.0 and before v.8.0.3" maybe affected versions 5.0.0 to <8.0.3? Actually says v.5.0.0 and before v.8.0.3. Likely fixed in 8.0.3. Need state patch exact fix 8.0.3. Need check references. We have GitHub issue maybe patch? We can say vendor-released patch 8.0.3? The description says before v.8.0.3 allows, so 8.0.3 is fixed. But no official vendor advisory in references except NVD. Need not invent. But can say "Vendor-released patch: 8.0.3 (per version range in description)". Need maybe product_name "Puma". Summary original not copy description. Need include no active exploitation confirmed, POC not identified? Public exploit? Description mention GitHub issue maybe issue, could be a public report. We must use all. Need respect "inowroclaw" in risk_assessment only lowercase, once. Need weave naturally. Example: "... even a mid-sized municipal IT team in inowroclaw should treat this as urgent ...". Must not factual. Need maybe include. Need provide JSON object. Ensure all fields strings. data_quality_flags array. Could include flags maybe tags include "N A" which is meaningless? Also CPE vendor n/a product n/a. Maybe data quality flags? Need consider. CPE is generic cpe:2.3:a:n/a:n/a. Tags include "N A" maybe wrong? Coul
Cluster credential exposure in Apache ActiveMQ Artemis and Apache Artemis allows a network-adjacent unauthenticated attacker to passively capture cluster administrative credentials during the initial peer-discovery handshake. Both the legacy Apache ActiveMQ Artemis lineage (versions 1.0.0 through 2.44.0) and the newer Apache Artemis distribution (versions 2.50.0 through 2.56.0) are affected, covering effectively the entire supported history of the project. An attacker positioned on the same network segment as a clustering deployment can intercept these credentials without any prior authentication, then use them to authenticate as a cluster administrator and gain full control over the message broker cluster. No public exploit code has been identified at the time of analysis.
Signature verification bypass in the OCaml jose library (ulrikstrid/ocaml-jose) before 0.11.0 lets attackers forge valid RSA-signed JWS/JWT tokens. The RSA verify path in Jws.ml only confirmed that PKCS #1 decoding succeeded and then returned success, never performing the RSA public-key operation that actually authenticates the signature. Any attacker can craft a token with an arbitrary payload and a syntactically well-formed but cryptographically meaningless signature and have it accepted as valid; no public exploit identified at time of analysis, but the flaw is trivially exploitable once understood.
Authentication bypass in the passport-saml-encrypted Node.js/Passport SAML strategy (versions through 0.1.13) lets a remote attacker impersonate arbitrary users via classic XML Signature Wrapping (XSW). Because signature verification and assertion extraction perform independent, uncorrelated XPath lookups, an attacker who possesses any single validly signed SAML message can prepend a forged, unsigned assertion that the application accepts as the authenticated identity while the genuine signature still validates against the untouched original assertion. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; reported by VulnCheck.
Authentication/authorization bypass in rclone's dynamic serve interface (versions 1.70.0 through 1.75.0) lets remote attackers reach a fixed filesystem instead of the per-request backend the operator intended. When an FTP or S3 server is spun up via the serve/start RC (remote control) API with a per-server proxyOpt.AuthProxy, the FTP and S3 constructors mistakenly consult the empty process-global proxy.Opt.AuthProxy, so the request-local auth proxy is silently ignored: FTP accepts anonymous logins with any password against the fixed VFS, and S3 with AuthKey serves the fixed RC fs rather than the proxy-selected backend. There is no public exploit identified at time of analysis, and this is not in CISA KEV. Fixed in 1.75.1.
OS command injection in Dell ThinOS 10 (all builds prior to 2605_10.2616) lets a high-privileged remote attacker execute arbitrary operating-system commands on the thin-client endpoint. The flaw (CWE-78) carries a CVSS 9.1 with a scope change, reflecting that injected commands can break out of the intended context and impact the broader system. Dell has released a fixed build; no public exploit code or active exploitation has been identified at time of analysis.