Authenticated OS command injection in D-Link DWR-M921 firmware 1.1.52 allows a remote attacker with administrative credentials to execute arbitrary system commands on the router by injecting shell metacharacters into the `folderpath` parameter of the `/boafrm/formDiskCreateShare` endpoint, which passes the value unsanitized to a `system()` call. The affected endpoint handles USB disk share creation via the BoA embedded web server. A public proof-of-concept exploit has been disclosed on GitHub by researcher H3rmesk1t, though no active exploitation has been confirmed by CISA KEV at time of analysis.
OS command injection in D-Link DWR-M920 firmware version 1.1.7 allows a network-adjacent or remote authenticated attacker to execute arbitrary operating system commands by manipulating the newPin parameter submitted to the /boafrm/formPinManageSetup endpoint. The vulnerability resides in the sub_41E60C function, which fails to sanitize user-supplied input before passing it to a system call. A publicly available proof-of-concept exploit exists. No public exploit identified at time of analysis as confirmed by CISA KEV, but exploit code is publicly available per VulDB and the GitHub reference.
Buffer overflow in TOTOLINK A3002MU router firmware version Hh-B20211125.1046 allows authenticated remote attackers to corrupt memory and potentially execute arbitrary code by supplying an oversized value to the `service_type` argument of the `formPortFw` CGI handler in the boa embedded web server. The vulnerability is reachable over the network and a proof-of-concept exploit has been publicly published on GitHub. No vendor-released patch has been confirmed at time of analysis.
Field-level security bypass in EspoCRM before 10.0.4 exposes hidden attendee email addresses to any authenticated user through the meeting and call attendees API endpoints. The root cause is ACL validation logic that checks parent event (meeting or call) permissions rather than per-attendee entity permissions, rendering field-level email restrictions ineffective for all users with event read access. Publicly available exploit code exists via the vendor's GitHub security advisory; no confirmed active exploitation (CISA KEV) has been identified.
Buffer overflow in the Totolink A3002MU router's boa web server allows network-adjacent authenticated attackers to potentially execute arbitrary code by sending a crafted request with an oversized ip6addr argument to the /boafrm/formFilter endpoint. The affected firmware version is Hh-B20211125.1046, and a public proof-of-concept exploit has been published on GitHub. No patch is available at time of analysis; the vulnerability carries a CVSS 4.0 score of 8.6 with subsequent-system impact metrics elevated due to the router's central network position.
Stack-based buffer overflow in the Totolink A3002MU router's boa HTTP server allows a network-adjacent authenticated attacker to overwrite memory via an oversized `submit-url` argument submitted to the `formNewSchedule` handler at `/boafrm/formNewSchedule`, likely yielding arbitrary code execution on the device. The affected firmware version is Hh-B20211125.1046. A public proof-of-concept exploit exists on GitHub, raising the realistic exploitation probability for devices reachable from the network with default or known credentials. No vendor patch has been identified at time of analysis.
OS command injection in D-Link DWR-M921 firmware 1.1.52 allows an authenticated remote attacker to execute arbitrary shell commands on the device by supplying a crafted `partition` argument to the `/boafrm/formDiskFormat` endpoint, which passes the value unsanitized to the `system()` call. Exploitation requires high-privilege (admin-level) credentials, but a publicly available proof-of-concept exploit hosted on GitHub lowers the barrier significantly. No vendor patch has been identified at time of analysis; the device's web management interface is the sole attack surface.
Logitech's Logi Options+ updater service on Windows mishandles service-level privileges (CWE-269), exposing an attack surface that any authenticated local user can abuse to obtain a SYSTEM shell. With a proof-of-concept publicly documented on the amberwolf security blog, the exploitation barrier is minimal for any adversary already present on a Windows endpoint running the software. Organizations with broad Logitech peripheral deployments face meaningful privilege escalation risk if this path is chained with initial access obtained via phishing or credential compromise.
A path traversal flaw (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user manipulate file paths to read, write, or delete arbitrary files on the host. The CVSS 3.1 base score is 8.1 (AV:N/AC:L/PR:L/UI:N), reflecting high confidentiality and integrity impact with no availability impact, so valid credentials are a prerequisite. Publicly available exploit code has been referenced, but CISA KEV does not list this CVE and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' - meaning it is a serious post-authentication primitive rather than a broadly observed in-the-wild campaign at time of analysis.
Missing authorization on the `/sys/user/list` admin endpoint in novel-plus ≤5.3.3 allows any authenticated user to retrieve password hashes and sensitive PII - including email addresses and phone numbers - for users within their data scope. The root cause is the absence of proper Spring Security permission annotations on the endpoint, meaning authorization checks are never enforced at the API layer. A publicly available POC exploit script confirms exploitability; successful hash retrieval enables offline cracking and downstream account takeover.
Remote code execution affects IBM MQ across the 9.1 LTS, 9.2 LTS, 9.3 LTS/CD, 9.4 LTS/CD and 10.0.0.0 release lines because the queue manager deserializes untrusted data (CWE-502), letting an attacker who can already authenticate to the messaging service run arbitrary code under the broker's privileges. The flaw carries a CVSS 3.1 base of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact) and rates as a credentials-gated but fully compromising issue for any exposed MQ listener. No CISA KEV listing, EPSS score, or public proof-of-concept was present in the supplied intelligence, so active exploitation is unconfirmed at time of analysis; patch availability is signalled by the IBM PSIRT advisory but no fixed build number is stated in the source data.
A remote input-validation weakness in Apple macOS allows crafted data to terminate an application unexpectedly or, more seriously, achieve arbitrary code execution on the host. Apple has fixed the flaw in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27, and only those or later builds are protected. Exploitation requires the victim to interact with the malicious content (CVSS UI:R, PR:N), there is no public exploit code identified at time of analysis, and neither CISA KEV nor the SSVC decision framework indicates observed exploitation, so this is best treated as a patch-now hygiene issue rather than an emergency.
Memory corruption in Apple macOS WebDAV client handling allows code execution when a user connects to an attacker-controlled WebDAV server, affecting macOS versions prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27. The flaw is an out-of-bounds write (CWE-787) reachable over the network but gated by user interaction, rated 8.8 by Apple/NVD with an unauthenticated network attack vector. Apple has released fixes in three OS updates, and exploitation is not confirmed — no public exploit code and no CISA KEV listing — while EPSS sits at 0.18% (8th percentile), indicating low predicted mass-exploitation activity; this reads as a credible but targeted risk rather than a wormable event.
Kernel-level use-after-free in Apple's built-in NFS client allows memory corruption when a device connects to an attacker-operated NFS server, affecting iOS/iPadOS, macOS, tvOS, visionOS and watchOS. Exploitation requires the victim to mount or connect to a malicious NFS share (UI:R) but no credentials or privileges on the target device, making this a remote, unauthenticated-against-the-client attack that terminates in kernel memory corruption with high confidentiality, integrity and availability impact. No public exploit code and no CISA KEV listing were identified at time of analysis; EPSS is low at 0.18% (8th percentile), and CISA SSVC rates exploitation as none and automatable as no, though technical impact is total. Apple has released fixes in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.
An out-of-bounds write in Apple's WebKit engine — reachable by processing maliciously crafted web content — can corrupt memory and potentially lead to arbitrary code execution on affected Apple platforms. The flaw stems from an integer-overflow class defect (CWE-190) where a size calculation overflows and the subsequent bounds check fails, allowing an OOB write. It is fixed in Safari 26.6.1, iOS/iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27 and watchOS 27; exploitation requires the victim to load attacker-controlled web content (UI:R), and no public exploit or active exploitation has been identified at time of analysis, with EPSS at just 0.17% (6th percentile).
We need to produce JSON with the fields. Let me carefully craft. CVE-2026-65390: Apple WebKit integer overflow, memory corruption, fixed in Safari 26.6.1, iOS 26.6.1 etc. CVSS 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. CWE-190. EPSS 0.17% percentile 6%. Patch available. No KEV. No POC mentioned. Product name: "Safari" or "WebKit"? The primary affected product... Safari is the browser; also iOS, macOS etc. 1-3 words. "Apple Safari" perhaps. Product name should be specific product/service. I'll use "Apple Safari" — but WebKit is the underlying engine. Given description mentions Safari first, and CPEs include safari, ios, macos... I'll go with "Apple Safari". Hmm, "1-3 words ONLY". "Apple Safari" is fine. Or "Safari". I'll use "Apple Safari". Summary: 2-3 sentences, original synthesis, no "A vulnerability". Start with impact verb and product. E.g., "Memory corruption in Apple Safari's web rendering engine lets remote attackers execute arbitrary code or crash the browser when a victim loads a maliciously crafted web page." Since it's iOS/macOS shared WebKit, all Apple platforms affected. Mention no public exploit identified, EPSS low (0.17%, 6th percentile), patch available. Note: PR:N UI:R — unauthenticated but requires user interaction (victim visits page). technical_context: integer overflow (CWE-190) in WebKit/JavaScriptCore? Description says "Processing maliciously crafted web content may lead to memory corruption." CWE-190 integer overflow addressed with improved input validation. Explain: WebKit parses web content; integer overflow in a size/length calculation leads to out-of-bounds write/read → memory corruption → potential RCE within the sandboxed WebContent process; on iOS/macOS the WebContent process is sandboxed, so exploitation typically chained with sandbox escape to achieve full compromise. Note CPEs across safari, ios_and_ipados, macos, tvos, visionos, watchos — indicates shared WebKit codebase. risk_assessment: CVSS 8.8 high, AV:N/AC:L/PR:N/UI:R —
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.61068_1546_841_CN_TDC allows authenticated remote attackers to corrupt stack memory by supplying an oversized value to the webAuthWhiteUserIndex argument in the formDelWebAuthWhiteUser function, potentially enabling arbitrary code execution in the web server process. The vulnerability is network-exploitable with low-privilege credentials (PR:L per CVSS 4.0), and the CVSS 4.0 score of 8.7 reflects high impact across confidentiality, integrity, and availability. No public exploit has been confirmed and the vulnerability is not in CISA KEV, but a researcher-published GitHub advisory documents the attack surface.
IBM DataStage on Cloud Pak for Data 5.4.0.0 can be made to execute arbitrary code by an authenticated remote user because the XSLT transformation engine is misconfigured in a way that lets attacker-supplied transformations reach code-execution paths. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, C/I/A all High), meaning any holder of valid low-privilege DataStage credentials can potentially obtain full control of the affected service. IBM has published a patch, and there is no public exploit code or CISA KEV listing associated with this CVE at time of analysis.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user execute arbitrary operating-system commands with the privileges of the DataStage service account (CVSS 8.8, CWE-78). The flaw requires valid credentials (PR:L) but no user interaction, and successful exploitation yields complete loss of confidentiality, integrity and availability on the affected host or container. IBM has published a vendor patch; there is no CISA KEV entry, no confirmed public exploit code, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', which lowers but does not eliminate real-world urgency for exposed deployments.
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special characters in the PxPeek name property, allowing an authenticated remote user to inject and execute arbitrary operating-system commands on the DataStage engine. The flaw carries a CVSS base score of 8.8 (AV:N/AC:L/PR:L/UI:N), reflecting full loss of confidentiality, integrity, and availability for a low-privileged authenticated attacker. A vendor patch is available from IBM, no public exploit code or CISA KEV entry was identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation, making it a patch-promptly rather than drop-everything priority.
Missing authorization controls in the ThemeAtelier Domain For Sale WordPress plugin before 3.5.2 expose unauthenticated REST API endpoints that disclose sensitive business data and permit destructive operations. Remote unauthenticated attackers can enumerate all stored offer records, harvest bidder contact information, verification tokens, and messages, and delete arbitrary offers by iterating numeric identifiers. No public exploit is identified at time of analysis, but SSVC marks this as automatable, meaning scripted mass scanning and exploitation across WordPress installations is technically feasible.
Missing authentication on Krayin CRM's admin mail ingest route lets any remote, unauthenticated attacker POST crafted RFC 2822 messages to /admin/mail/inbound-parse and plant arbitrary emails — including forged replies stitched into existing conversation threads — in victim CRM inboxes on every release through 2.2.6. VulnCheck reports proof-of-concept exploit code (SSVC Exploitation: PoC) and the attack is fully automatable, but the issue is not listed in CISA KEV, so active in-the-wild abuse is not confirmed; the CVSS v4.0 base score is 8.8, driven by high integrity impact with no confidentiality impact and only limited availability impact.
Insecure deserialization in the Laravel MagicLink package (cesargb/laravel-magiclink) versions 2.0.0 through 2.25.0 lets an attacker who can already write to the magic_links.action database column — for example via a separate SQL injection or a compromised administrator account — plant a malicious serialized object graph containing an executable closure inside a magic link record. When that link is visited, the package deserializes the record without HMAC integrity checks or class allowlisting and executes the payload as arbitrary PHP code in the application process, yielding full remote code execution at the application's privilege level. The issue is fixed in 2.25.1; there is no public exploit code and no confirmed active exploitation, and CISA's SSVC decision framework records exploitation as 'none' and automatable as 'no'.
LangBot's debug WebSocket server binds to all interfaces on port 5401 and ships with an empty authentication key by default - and the official Docker image together with its docker-compose configuration publish that port to the host, placing every default deployment within reach of any network attacker. A remote unauthenticated attacker who reaches the /plugin/ws endpoint can register an arbitrary debug plugin, after which LangBot broadcasts the full plaintext context of every inbound IM message event to that plugin, enabling mass interception of private chats, forged bot replies, LLM pipeline poisoning via malicious tool registration, knowledge-base enumeration, and persistent denial of service by blocking legitimate plugin installations with the prod_mode flag. No patched version was available at time of publication; SSVC classifies exploitation as proof-of-concept-available and fully automatable.
Apache Doris contains an incorrect authorization flaw (CWE-863) that lets an authenticated user bypass privilege checks and reach data or operations they should not be permitted to touch. Affected branches are 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3; the CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity, and availability impact places this in the critical severity band. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the vendor describes the technical impact as total and CVSS 8.8 reflects broad read/write exposure within the cluster.
Remote authenticated users of the Plesk 'Ruby' (before 1.6.6) and 'Node.js Toolkit' (before 2.5.0) extensions can inject arbitrary shell directives into statically generated application startup code via custom environment variables, resulting in code execution with root privileges on the Plesk server. The flaw is a classic static code injection (CWE-96): user-supplied values are written verbatim into persisted configuration/startup files rather than being escaped. No public exploit code or CISA KEV listing is present in the provided intelligence, and no EPSS score was supplied, so exploitation appears limited to actors who already hold a valid low-privileged Plesk account; vendor patches are available.
Eval injection in CONPROSYS HMI System (CHS) by Contec allows authenticated network attackers to execute arbitrary code on the server hosting the HMI application. The flaw (CWE-95) occurs when user-supplied input reaches a dynamic code evaluation function without proper neutralization, enabling full server-side code execution. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the low-complexity, network-accessible nature of the vulnerability makes it a priority for ICS/OT environments running this product.
Path traversal during in-pod file synchronization in DevSpace through 6.3.21 allows an attacker who controls a container to write arbitrary files on the developer's workstation, enabling code execution. The sync client extracts tar entries streamed from a running pod without sanitizing parent-directory (..) sequences in entry names, so a malicious container can escape the intended sync target directory and overwrite shell RC files, SSH authorized_keys, IDE configuration, or other user-writable paths. No CISA KEV listing exists and no confirmed public exploit code has been identified at time of analysis, though the VulnCheck disclosure and GitHub issue #3290 provide full technical detail.
Path traversal via share link in ZFile through 5.0.5 enables any holder of a valid share link to download arbitrary files within the configured shared base directory by supplying unvalidated file path parameters to the download endpoint. The root failure - confirmed in ShareLinkFileService.java - is that the download endpoint never cross-checks the caller-supplied path against the share link's permitted entries, so a share granting access to one file silently grants read access to every readable file under the base directory. No public exploit code has been confirmed at time of analysis, though the vulnerability is publicly documented in GitHub issue #826 and no patched version number has been independently verified.
Authenticated SQL injection in the timescale-reader and postgres-reader HTTP APIs of Magistrala before 1.0.0 lets any user who can self-register inject arbitrary SQL through the unparameterized `format` query parameter, which is interpolated straight into the FROM clause of backend queries. Because the injected statements run as a PostgreSQL superuser under the default role configuration, an attacker can pivot from cross-tenant data theft to reading pg_shadow password hashes, reading and writing arbitrary files, and executing OS-level code as the postgres user via shared-object loading. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, though the vendor has released a fix in v1.0.0.
Memory exhaustion in adnanh/webhook through 2.8.3 allows unauthenticated remote attackers to crash the service by streaming multi-gigabyte HTTP request bodies at any configured hook endpoint. The daemon reads the entire request body into memory before it evaluates trigger rules or validates the payload signature, so invalid or unsigned requests are just as effective as valid ones at forcing an out-of-memory kill. SSVC rates the issue as automatable and already exploited by proof-of-concept code, though there is no CISA KEV listing and no vendor-issued fix version identified in the available references.
Unauthenticated arbitrary file read in DeepWiki-Open (AsyncFuncAI) through commit d92819a lets anyone who can reach the /ws/chat WebSocket endpoint pass an arbitrary directory path as the repo_url parameter and have the server walk that path with no containment check, exfiltrating every readable Python, JavaScript, YAML and JSON file it finds. Because the read is aimed at source and configuration files, the practical payoff is hardcoded secrets, API keys and credentials rather than code execution. A public proof of concept is indicated by SSVC exploitation status and the flaw is fully automatable, though it is not listed in CISA KEV as actively exploited.
Unauthenticated SQL injection in EFence (Thinking Software Technology) exposes full database read access to remote attackers without credentials. The flaw resides in the web-facing component of the EFence product, where attacker-controlled input is passed unsanitized into SQL queries, enabling arbitrary SELECT operations against the underlying database. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the trivial exploitation conditions (no authentication, no user interaction, network-accessible) make it a high-priority remediation target for any deployment.
OS command injection in Contec SolarView Compact (models SV-CPT-MC310 and SV-CPT-MC310F) allows any authenticated low-privilege user to execute arbitrary operating system commands through the Schedule Settings feature. Successful exploitation grants full control over the underlying device with high impact to confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity makes this a straightforward target for any attacker holding valid credentials.
OS command injection in Contec's CAN-2-WF (Wireless LAN) and CAN-2-USB (USB) industrial communication converter units allows any authenticated user to execute arbitrary operating system commands on the device. The vulnerability, CWE-78, is reachable over the network with low privilege and no user interaction required, yielding full confidentiality, integrity, and availability impact on the affected unit. Reported by JPCERT/CC with a vendor advisory published; no public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis.
Missing authentication on a critical function in the Contec CPSL-08P1EN allows a network-reachable attacker to operate the device without supplying credentials. The flaw (CWE-306) means a protected management or control function is reachable directly over the network with no authentication gate, giving an adversary the same effective access as a legitimate administrator. No public exploit or CISA KEV listing exists at time of analysis, but the straightforward exploitation path (no complexity, no user interaction) lowers the bar for opportunistic targeting of Internet-exposed or weakly-segmented devices.
Arbitrary command execution via unrestricted file upload affects CONTEC's CONPROSYS TM Series industrial controllers (CPS-TM341G5MB-ADSC1-931, CPS-TM341MB-ADSC1-931, and CPS-TM341GMB-ADSC1-931). A remote attacker holding valid credentials can upload a specially crafted file through the device's management interface, causing the underlying system to execute attacker-controlled commands. The CVSS 4.0 score of 8.7 reflects full confidentiality, integrity, and availability compromise of the vulnerable system, with authentication as the sole barrier to exploitation. No public exploit or CISA KEV listing has been identified at time of analysis.
Authenticated OS command injection in Contec CONPROSYS TM Series industrial devices allows any logged-in user to execute arbitrary operating system commands on the underlying host. Specifically, three CPS-TM341 model variants are confirmed affected per JVN advisory JVNVU96551518. Exploitation is straightforward once credentials are obtained, making credential theft or default-credential abuse a natural precursor attack chain.
OS command injection in Contec's CONPROSYS PAC Series industrial automation controllers allows any authenticated user to execute arbitrary OS-level commands on the device. Affected hardware includes the Integrated Type CPS-PC341 and Configurable Type CPS-PCS341 series programmable automation controllers, reported by JPCERT/CC. No public exploit code has been identified at time of analysis, but successful exploitation grants full control over the controller's underlying operating system.
OS command injection in CONPROSYS M2M Gateway and M2M Controller Series (CONTEC Co., Ltd.) allows an authenticated attacker to execute arbitrary operating system commands on affected industrial gateway devices. The vulnerability affects both the integrated and configurable variants of the CPS-MG341, CPS-MGS341, CPS-MC341, and CPS-MCS341 product lines, which are OT/IoT bridging devices commonly deployed in industrial automation environments. Exploitation requires only valid login credentials, and the CVSS 4.0 base score of 8.7 reflects high impact across confidentiality, integrity, and availability with no special attack conditions beyond authentication.
Remote code execution affects the Contec EC1000 series (ECE1000, ECE1020, ECS1020) industrial devices, where a classic buffer overflow in the embedded web service allows a network-authenticated attacker to send a specially crafted HTTP request and execute arbitrary programs on the device. Reported by JPCERT/CC via JVN advisory JVNVU99009004, this is an embedded industrial controller flaw with full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution is possible in Contec RP-WAH-SR Series wireless access point devices via a classic buffer overflow in the product's web service. A low-privileged remote attacker can send a specially crafted HTTP request to trigger the overflow and execute arbitrary code on the device. All four model variants (SR1, SR2, SR12, SR22) are confirmed affected per CPE data; the vulnerability was disclosed via JPCERT and a Contec security advisory with no KEV listing or public POC at time of analysis.
OS command injection in Contec's SGA1000 device allows an authenticated network attacker to execute arbitrary commands on the underlying operating system. The flaw (CWE-78) arises from insufficient sanitization of user-supplied input before it is passed to system shell calls, affecting all known versions per the wildcard CPE specifier. Reported via JPCERT/CC and confirmed by the vendor's own security advisory; no public exploit code has been identified at time of analysis.
OS command injection in Contec FX5000, FX4000, and FX3000 series industrial data loggers and remote I/O units allows authenticated network attackers to execute arbitrary operating system commands on affected devices. Exploitation requires valid credentials to the device management interface but no additional configuration or user interaction, giving a successful attacker full command execution capability at OS level. Reported by JPCERT and coordinated via JVN; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Remote buffer overflow in the Totolink A3002MU router's boa web server allows authenticated network attackers to overflow a fixed-size buffer in the formIpv6Setup handler by supplying an oversized `static_ipv6` argument, potentially enabling arbitrary code execution with root privileges on the device. The vulnerability affects firmware version Hh-B20211125.1046 and a proof-of-concept exploit has been publicly disclosed to GitHub. No vendor-released patch has been identified in available references at time of analysis.
Incorrect privilege assignment in the AWS Temporary Elevated Access Management (TEAM) solution for IAM Identity Center (all versions before 1.5.1) permits any authenticated application user to read, approve, modify, or revoke arbitrary access requests - effectively enabling self-approval of elevated permissions to AWS accounts managed by the TEAM deployment. The root cause is an improperly scoped Cognito Identity Pool that fails to enforce authorization boundaries between regular requesters and privileged approvers or administrators, compounded by client-side derivation of account names and roles. No public exploit has been identified at time of analysis, and SSVC rates exploitation status as none.
Path traversal in Contec SGA1000 allows a network attacker with FTP credentials to read and overwrite arbitrary files on the device filesystem. Reported by JPCERT and documented in JVN advisory JVNVU99009004, the flaw affects all known SGA1000 versions and exposes sensitive server-side files - including configuration, credentials, and system data - to unauthorized disclosure and modification via crafted FTP path arguments. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Path traversal via FTP in Contec FX5000, FX4000, and FX3000 series industrial programmable controllers allows an authenticated FTP user to read or modify arbitrary files on the device filesystem. The affected products span a broad range of industrial OT endpoints including Ethernet, serial, and wireless variants. With no public exploit identified and a CVSS 4.0 score of 8.6, the primary risk is to environments where FTP access is exposed to untrusted users or network segments without adequate segmentation.
PraisonAI's WhatsApp and Linear bot webhook handlers fail open when their shared-secret environment variables are unset: HMAC signature verification is skipped entirely and the raw JSON body is parsed and dispatched as a trusted platform event. Any remote client that can reach the bot's webhook route (default /webhook) can forge WhatsApp messages or Linear AgentSession/Comment events without authentication, impersonating platform users and injecting attacker-controlled content into agent prompts and actions. The flaw affects releases before 4.6.59, is trivially automatable with a single unsigned HTTP POST, and no public exploit code or active exploitation has been identified at time of analysis.
SQL injection in the Alior Bank 'raty' PrestaShop module's toggleCategoryPromotionAction method allows an authenticated backoffice user with product or category edit privileges to inject arbitrary SQL via the unsanitized POST parameter 'status', which is passed directly into SQL UPDATE queries. Affected versions span two release branches: raty 9.0.5-9.0.7 and 8.1.9-8.1.11, with fixes available in 9.0.8 and 8.1.12 respectively. No public exploit code has been identified at time of analysis, and SSVC rates exploitation as none with the attack not automatable.