HTML injection in MISP versions ≤2.5.45 allows any authenticated user with write access to embed arbitrary HTML markup in attribute types/values, object names/relations, or tag colour and name fields, which renders as live HTML when a report referencing those elements is exported to PDF via the convert_markdown_to_pdf module. The same component shipped a hardcoded sample-value defect - literal strings 'domain-ip' and 'google.com' used as format arguments rather than placeholders - meaning every plain attribute reference in a PDF displayed sample text instead of the real indicator, constituting a separate data-integrity failure. CIRCL, the MISP maintainer, patched both issues in commit 949744a4b (released as v2.5.46) by wrapping all user-controlled interpolations with CakePHP's h() HTML-encoding function. No public exploit has been identified and the CVE is not listed in CISA KEV.
Directory traversal in WP BackItUp Community Edition (WordPress plugin) ≤2.1.0 allows authenticated administrators to read the contents of arbitrary existing files on the server via the backup_file parameter in the download handler. The handler applies basename() normalization only when the traversal target path does not exist - meaning any real file, including wp-config.php or OS credential files, is returned without sanitization. No public exploit code has been identified at time of analysis, and the PR:H requirement limits the exploitable attack surface to accounts with WordPress administrator privileges or higher.
Server-Side Request Forgery (SSRF) in IBM Langflow OSS 1.0.0-1.11.5 allows remote authenticated attackers to make the server issue outbound HTTP requests to attacker-controlled or internal endpoints, leaking sensitive information from otherwise inaccessible systems. The scope-changed CVSS vector (S:C) confirms the vulnerability's reach extends beyond the Langflow application itself to adjacent internal infrastructure. IBM has released a patch and no public exploit code has been identified at time of analysis.
IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes an insecure direct object reference (CWE-639) in its runtime cache layer that permits an authenticated remote attacker to reference and manipulate cache objects they do not own, resulting in denial of service against data integration pipelines. The CVSS S:C (scope changed) metric signals that the impact crosses security boundaries beyond DataStage itself, potentially disrupting co-tenanted Cloud Pak for Data services. A vendor-supplied patch is available via IBM support page 7286562; no public exploit code has been identified at time of analysis.
Stack-based buffer overflow in GeoVision GV-LPC2211 firmware V1.13 allows an authenticated administrator to crash the ONVIF worker process by submitting a SetUser SOAP request containing an excessive number of User XML elements, overwriting stack control state. Impact is limited to denial of service of the camera's ONVIF management interface, with no confidentiality or integrity compromise confirmed. No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in the GeoVision GV-LPC2011/LPC2211 V1.13 ONVIF CreateUsers handler allows an authenticated administrator to crash the ONVIF worker process by submitting a crafted SOAP request containing repeated User XML elements. The vulnerability overwrites stack control state, resulting in a denial-of-service condition limited to the ONVIF subsystem. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS vector (PR:H, A:H only) constrains real-world impact to availability loss by credentialed administrators.
Stack-based buffer overflow in the GeoVision GV-LPC2211 V1.13 ONVIF service allows an authenticated administrator to crash the ONVIF worker by submitting a DeleteUsers SOAP request containing an unbounded number of Username elements. The overflow exhausts the stack array allocated for the username list, terminating the ONVIF worker process. Impact is limited to availability - the CVSS vector confirms no confidentiality or integrity compromise (C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in the ONVIF SetUser password handler of GeoVision GV-LPC2211 firmware V1.13 allows an authenticated administrator to crash the ONVIF worker process by supplying an excessively long password string. The sole confirmed impact is availability loss to the ONVIF service - no confidentiality or integrity impact is present per the CVSS vector (C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis.
Authenticated administrator-triggered stack buffer overflow in the GeoVision GV-LPC2211/LPC2011 V1.13 ONVIF service causes a crash of the ONVIF worker process. When an admin-authenticated user submits an oversized username or password value through the ONVIF CreateUsers operation, the device copies the value into a fixed-size stack buffer without bounds checking, resulting in a denial-of-service condition limited to the ONVIF subsystem. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Authenticated path traversal in the file upload functionality of TP-Link Archer MR600 (v2, v3, v5) and TL-MR6400 v8 allows an admin-level remote attacker to write files outside the intended upload directory, potentially overwriting system files accessible to the affected service. The vendor explicitly states that arbitrary code execution has not been demonstrated, making this an integrity-limited vulnerability rather than a full RCE. Vendor-released firmware patches are available for both affected product lines. No public exploit has been identified at time of analysis.
Privilege escalation to root on Palo Alto Networks Cortex XDR Broker VM is achievable by an authenticated low-privileged user who simultaneously holds a man-in-the-middle position on the adjacent network segment. The underlying flaw is argument injection (CWE-88), allowing the attacker to manipulate command-line arguments processed by the Broker VM to gain root-level code execution on the appliance. No public exploit has been identified (CVSS 4.0 E:U, Urgency: Amber), and Palo Alto Networks has published an advisory at security.paloaltonetworks.com.
Set-Cookie attribute injection in the `cookies` Node.js library (versions before 0.9.2) enables an attacker to override cookie security attributes - SameSite, Secure, HttpOnly, or Domain - by embedding semicolons in the `domain` or `path` option when those options are populated from untrusted or request-derived data. Applications built on Koa (which delegates cookie handling to this library via `ctx.cookies`) represent the primary at-risk population. No public exploit or active exploitation has been identified; real-world impact is gated on an application-level antipattern of passing user-controlled data to these options.
Reverse tabnapping in WSO2 API Manager and WSO2 API Control Plane exposes authenticated users to window-context hijacking when the portal opens external links without nullifying the JavaScript `window.opener` reference. An attacker who can surface a malicious external link within the portal - via API documentation fields, link-accepting content areas, or other user-controlled inputs - can redirect the user's original authenticated portal tab to an attacker-controlled phishing page once the external link is clicked. The vendor has published advisory WSO2-2026-5164; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Arbitrary file overwrite in Suricata IDS/IPS/NSM engine prior to versions 7.0.16 and 8.0.5 allows an attacker who controls rule content to write to any path on the host filesystem during rule load or reload. The flaw (CWE-22 path traversal) is triggered by a crafted rule using an absolute path in the save directive, bypassing expected sandbox boundaries of the rule engine. No public exploit code exists and this is not listed in CISA KEV at time of analysis.
Arbitrary code execution in Dell ThinOS 10 (all builds prior to 2605_10.2616) is enabled by a missing integrity check (CWE-353) that allows a local high-privileged attacker to substitute unverified code or data in a load path the OS processes without cryptographic validation. Dell advisory DSA-2026-389 confirms both the vulnerability and a corrective update. No public exploit code or CISA KEV listing exists at time of analysis, limiting real-world risk to targeted insider-threat or physical-access scenarios.
Authenticated path traversal in IBM Db2 11.5.x and 12.1.x allows a low-privileged database user to write arbitrary files to the underlying host filesystem via a specially crafted network request. The flaw (CWE-22) exploits insufficient pathname restriction in a Db2 request handler, enabling an attacker to place files outside intended directories - potentially overwriting configuration files, scripts, or other OS-level assets writable by the Db2 service account. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7286985.
Authorization bypass in the Advanced Contact Form 7 DB WordPress plugin (all versions through 2.1.3) allows authenticated attackers holding custom-level or higher roles to inject forged CSV submission records into any Contact Form 7 form managed by the plugin. The flaw is rooted in missing authorization checks within the plugin's import functionality - source code references confirm the vulnerable logic at specific lines in import_cf7_entry.class.php and import_cf7_csv.php. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the CVSS rating of 4.3 (Medium) reflects the authenticated prerequisite and limited integrity-only impact.
Unauthorized post-layout tampering in the Builderall Cheetah For WP WordPress plugin (≤3.0.2) allows any authenticated Subscriber-level user to disable the page builder layout on arbitrary posts site-wide. The wp_ajax_ba_cheetah_disable AJAX handler registers the disable() function without any capability check or nonce verification, and accepts an attacker-controlled post_id directly from $_POST input. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present.
Out-of-bounds stack read in Bosch BME690 SensorAPI v1.0.3 enables a physically adjacent attacker - or a compromised peripheral mimicking the sensor - to leak up to 6 bytes of adjacent stack memory and corrupt gas sensor measurement outputs. The flaw is in gas_index parsing within read_all_field_data (bme69x.c): a 4-bit mask permits values 0-15 while the heater configuration stack buffer only covers indices 0-9, and the leaked OOB byte is written directly into the public gas_wait field where it may be telemetered or logged. No public exploit is identified at time of analysis, and exploitation requires physical or hardware bus access.
Information disclosure in the Palo Alto Networks Prisma® Access Agent on Linux allows local low-privileged users to read sensitive configuration data and credentials stored by the agent process. Only the Linux platform is affected; Palo Alto Networks has explicitly confirmed that macOS, Windows, iOS, Android, and Chrome OS deployments are not impacted. No public exploit code and no active exploitation have been identified; the CVSS 4.0 vector carries an E:U (unexploited) modifier.
Insufficient permission validation on management interfaces in Hikvision Wi-Fi series cameras allows authenticated low-privileged users to retrieve the device's Wi-Fi configuration via unauthorized API calls. The flaw stems from missing authorization checks on specific endpoints that expose network configuration data, potentially including SSID and pre-shared key material. Hikvision confirmed and addressed the issue in firmware V5.7.26; no public exploit or active exploitation is identified.
Command injection in Palo Alto Networks PAN-OS allows an authenticated administrator to escape CLI restrictions and execute arbitrary OS commands as root via CWE-78 weaknesses in the Luna Hardware Security Module integration pathway. Exploitation is doubly gated: the attacker must hold administrative credentials with CLI access, and the target device must be configured with a Luna HSM - a niche cryptographic hardware module rarely deployed outside regulated or high-assurance environments. Panorama, Cloud NGFW, and Prisma Access are explicitly confirmed unaffected; vendor-released patches exist across all supported PAN-OS branches, and no public exploit or active exploitation has been identified.
HttpTransferCache in Angular's SSR stack leaks authenticated user data to subsequent unauthenticated visitors when hierarchical HttpClient is misconfigured with withRequestsMadeViaParent and SSR HTML is shared via a CDN or reverse proxy. The child injector's TransferCache evaluates each request before delegating it to the parent interceptor chain, so it sees the request as anonymous and stores the private authenticated response in the ng-state script tag serialized in the rendered HTML. Versions 20.x through 22.x are affected; no public exploit code has been identified at time of analysis.
rclone's HTTP backend (versions 1.49.0-1.75.0) leaks user-configured secret headers - including Authorization, Cookie, and X-Api-Key values - to untrusted redirect destinations because the underlying Go HTTP client follows redirects without a CheckRedirect policy that strips sensitive headers at host boundaries. When a configured HTTP remote issues a cross-host redirect, net/http copies the original headers verbatim to the new destination; a same-host HTTPS-to-HTTP redirect similarly exposes those headers in cleartext. Listing, stat, download, mount, and serve operations can all trigger the leak during normal use. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Heap buffer overflow in Suricata's rule parser allows a local attacker with write access to rule files to crash the Suricata process during signature loading by supplying a crafted rule containing mixed-case frame keywords. Affected versions are all releases prior to 7.0.16 and 8.0.5. Exploitation is constrained to rule-load time rather than live traffic inspection, limiting impact to availability disruption of the IDS/IPS engine itself. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Arbitrary code execution in Palo Alto Networks Checkov - the Prisma Cloud IaC static-analysis scanner - triggers when the tool scans a directory containing an attacker-crafted configuration file. The vulnerability is rooted in CWE-829 (Inclusion of Functionality from Untrusted Control Sphere): Checkov loads and evaluates IaC configuration files without sufficient isolation, allowing embedded attacker-controlled logic to execute in the scanner's runtime context. The most consequential attack surface is CI/CD pipelines, where Checkov runs automated scans with access to cloud credentials and secrets, making successful exploitation a pathway to subsequent-system compromise even though the primary vulnerable-system impact is limited. No public exploit code has been identified and Palo Alto rates exploit maturity as unreported (E:U).
Kernel pool memory disclosure in Silicon Labs silabser.sys driver (v11.5.0 and earlier) allows a local attacker with physical device access to leak up to 145 bytes of uninitialized kernel pool memory by presenting a malicious USB device that sends malformed packets to the driver on Windows 10 and earlier. The CVSS 4.0 score of 2.4 reflects the narrow physical-access prerequisite (AV:P) and limited read-only confidentiality impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Reflected cross-site scripting in Rizwan17's PHP inventory-management-system allows remote unauthenticated attackers to inject arbitrary JavaScript into any user's browser via the unsanitized `msg` parameter on the login page (index.php). The project lacks versioning and the maintainer has not responded to the disclosure filed in GitHub issue #11; no fix exists. Exploit code has been published (CVSS 4.0 E:P), but real-world impact is capped by the requirement for victim interaction and the product's extremely narrow deployment footprint.
OS command injection in Palo Alto Networks Checkov by Prisma Cloud allows a local low-privileged user to execute arbitrary commands within the Checkov scanning process. Because Checkov is routinely deployed inside CI/CD pipelines holding cloud credentials and infrastructure deployment permissions, successful exploitation can propagate beyond the scanning host to affect subsequent systems at high confidentiality, integrity, and availability impact. No public exploit has been identified and Palo Alto Networks' own environmental scoring (1.1) reflects both the local-only attack vector and currently unreported exploitation activity.
Palo Alto Networks PAN-OS web interface on PA-Series and VM-Series firewalls and Panorama management platforms contains a stored cross-site scripting vulnerability that enables an authenticated administrator to inject persistent JavaScript payloads into the management UI, which execute in the browsers of other administrators who view the affected pages. Affected versions span PAN-OS 11.1.x through 12.1.x; Cloud NGFW and Prisma Access are explicitly not affected. No public exploit has been identified, and the CVSS 4.0 score of 1.1 reflects the narrow exploitation conditions: administrator-level credentials are required along with passive interaction by a second administrator.
Path traversal in proma-ai Proma's Electron File Preview Service (versions up to 0.19.37) allows a locally authenticated low-privilege user to escape intended base directories by manipulating the file_path argument passed to resolveTargetPath in file-preview-service.ts. The root cause is a basename-collision fallback that resolves relative traversal sequences outside the allowed candidate base paths, enabling unauthorized reads and potential writes to files accessible by the Electron main process. A public proof-of-concept exists, though it targets the v0.16.3 IPC API and requires adaptation for subsequent pre-fix versions; the underlying vulnerability is confirmed in source code.
An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the EGOReplanFSM::checkCollisionCallback()