rclone's HTTP backend (versions 1.49.0-1.75.0) leaks user-configured secret headers - including Authorization, Cookie, and X-Api-Key values - to untrusted redirect destinations because the underlying Go HTTP client follows redirects without a CheckRedirect policy that strips sensitive headers at host boundaries. When a configured HTTP remote issues a cross-host redirect, net/http copies the original headers verbatim to the new destination; a same-host HTTPS-to-HTTP redirect similarly exposes those headers in cleartext. Listing, stat, download, mount, and serve operations can all trigger the leak during normal use. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Heap buffer overflow in Suricata's rule parser allows a local attacker with write access to rule files to crash the Suricata process during signature loading by supplying a crafted rule containing mixed-case frame keywords. Affected versions are all releases prior to 7.0.16 and 8.0.5. Exploitation is constrained to rule-load time rather than live traffic inspection, limiting impact to availability disruption of the IDS/IPS engine itself. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Arbitrary code execution in Palo Alto Networks Checkov - the Prisma Cloud IaC static-analysis scanner - triggers when the tool scans a directory containing an attacker-crafted configuration file. The vulnerability is rooted in CWE-829 (Inclusion of Functionality from Untrusted Control Sphere): Checkov loads and evaluates IaC configuration files without sufficient isolation, allowing embedded attacker-controlled logic to execute in the scanner's runtime context. The most consequential attack surface is CI/CD pipelines, where Checkov runs automated scans with access to cloud credentials and secrets, making successful exploitation a pathway to subsequent-system compromise even though the primary vulnerable-system impact is limited. No public exploit code has been identified and Palo Alto rates exploit maturity as unreported (E:U).
Kernel pool memory disclosure in Silicon Labs silabser.sys driver (v11.5.0 and earlier) allows a local attacker with physical device access to leak up to 145 bytes of uninitialized kernel pool memory by presenting a malicious USB device that sends malformed packets to the driver on Windows 10 and earlier. The CVSS 4.0 score of 2.4 reflects the narrow physical-access prerequisite (AV:P) and limited read-only confidentiality impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Reflected cross-site scripting in Rizwan17's PHP inventory-management-system allows remote unauthenticated attackers to inject arbitrary JavaScript into any user's browser via the unsanitized `msg` parameter on the login page (index.php). The project lacks versioning and the maintainer has not responded to the disclosure filed in GitHub issue #11; no fix exists. Exploit code has been published (CVSS 4.0 E:P), but real-world impact is capped by the requirement for victim interaction and the product's extremely narrow deployment footprint.
OS command injection in Palo Alto Networks Checkov by Prisma Cloud allows a local low-privileged user to execute arbitrary commands within the Checkov scanning process. Because Checkov is routinely deployed inside CI/CD pipelines holding cloud credentials and infrastructure deployment permissions, successful exploitation can propagate beyond the scanning host to affect subsequent systems at high confidentiality, integrity, and availability impact. No public exploit has been identified and Palo Alto Networks' own environmental scoring (1.1) reflects both the local-only attack vector and currently unreported exploitation activity.
Palo Alto Networks PAN-OS web interface on PA-Series and VM-Series firewalls and Panorama management platforms contains a stored cross-site scripting vulnerability that enables an authenticated administrator to inject persistent JavaScript payloads into the management UI, which execute in the browsers of other administrators who view the affected pages. Affected versions span PAN-OS 11.1.x through 12.1.x; Cloud NGFW and Prisma Access are explicitly not affected. No public exploit has been identified, and the CVSS 4.0 score of 1.1 reflects the narrow exploitation conditions: administrator-level credentials are required along with passive interaction by a second administrator.
Path traversal in proma-ai Proma's Electron File Preview Service (versions up to 0.19.37) allows a locally authenticated low-privilege user to escape intended base directories by manipulating the file_path argument passed to resolveTargetPath in file-preview-service.ts. The root cause is a basename-collision fallback that resolves relative traversal sequences outside the allowed candidate base paths, enabling unauthorized reads and potential writes to files accessible by the Electron main process. A public proof-of-concept exists, though it targets the v0.16.3 IPC API and requires adaptation for subsequent pre-fix versions; the underlying vulnerability is confirmed in source code.