2026-09-16
Insufficient scope validation in GitLab Enterprise Edition lets an authenticated user holding only Developer permissions run security policy test pipelines inside projects in their own group and read protected CI/CD variables that are meant to be restricted to Maintainer or Owner roles. All EE releases from 19.0 up to 19.1.8, 19.2.6 and 19.3.2 are affected, and GitLab shipped fixes in those patch releases. Publicly available exploit code exists (a HackerOne report is referenced), but there is no confirmed active exploitation and no CISA KEV listing.
Improper sanitization of user-controlled data in GitLab CE/EE's Markdown JSON table renderer allows crafted content to make a targeted user's browser issue unintended state-changing HTTP requests when the rendered page is viewed, affecting versions from 15.3 through 19.1.7, 19.2.5 and 19.3.1. Exploit details are publicly available through a linked HackerOne report, and the vendor CVSS of 8.2 reflects network reachability, a high attack-complexity rating, required user interaction and a scope change. Vendor-released fixes are 19.1.8, 19.2.6 and 19.3.2.
Unauthenticated denial of service in GitLab CE/EE caused by flawed resource accounting in the GraphQL complexity calculation logic, allowing a crafted query to consume disproportionate server resources. Exploitation affects GitLab 18.4.6 through 19.1.7, 19.2.0 through 19.2.5, and 19.3.0 through 19.3.1 - any Internet- or network-reachable instance with the GraphQL API enabled. Public exploit code exists (a HackerOne report is cited as the source), but there is no CISA KEV listing confirming active in-the-wild exploitation at time of analysis.
Unauthenticated denial of service in GitLab CE/EE (all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2) allows a remote attacker with no credentials to exhaust server resources through the GraphQL API by submitting queries whose true cost the complexity calculation under-counts. The flaw is an improper resource-allocation limit (CWE-770), scored CVSS 7.5 with the entire impact on availability (A:H) and none on confidentiality or integrity. Publicly available exploit code exists - a HackerOne report is linked from the advisory - but there is no CISA KEV listing, so active in-the-wild exploitation is not confirmed; EPSS data was not supplied with this record.
Token generation in EspoCRM through 10.0.8 relies on PHP's non-cryptographic rand() function, producing roughly 31-bit identifiers for lead-capture opt-in links, event invitations, and campaign URLs. Remote unauthenticated attackers who can reach those public endpoints can guess or enumerate valid tokens, allowing them to confirm opt-ins, accept or decline event invitations on behalf of other contacts, and read event details. Publicly available exploit code exists (a vendor commit and a public write-up), but there is no evidence of confirmed active exploitation in the wild, and the CVSS 6.3 rating reflects high attack complexity and only low confidentiality/integrity impact.
Root-level remote code execution affects Pepperl+Fuchs ICE2/ICE3-series and Phoenix Contact IOL-MA8 IO-Link master gateways, where an unauthenticated attacker uploads a crafted IODD (IO Device Description) file that drops and executes an arbitrary shell script as root. The injected script survives reboot, granting persistent full control of the industrial device. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but the CVSS 9.8 rating reflects trivial network reachability and complete device compromise.
Authentication bypass in Pepperl+Fuchs ICE2/ICE3-series IO-Link masters (and OEM-equivalent Phoenix Contact IOL-MA8 modules) lets a remote unauthenticated attacker reach the _account_log function and authenticate as administrator, even on devices where accounts are correctly provisioned. The flaw grants full administrative control of the device management interface with no credentials. Reported by CERT@VDE; no public exploit code and no active-exploitation evidence are present in the available data, though the CVSS 9.8 rating reflects trivial exploitability.
The JetFormBuilder - Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.
The TrueBooker - Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which can be leveraged to reset the account's password and gain access to it.
Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.
Authenticated gRPC users on Arista EOS devices that have AAA-based gRPC authorization enabled for OpenConfig can have their requests evaluated at the wrong privilege level and matched against the wrong AAA method list, granting read and configuration-write access they should not hold. The flaw (CWE-266, incorrect privilege assignment) is confined to the gRPC OpenConfig path; Arista explicitly states that non-gRPC OpenConfig requests such as NETCONF are not affected, and the vulnerable configuration is not a default state. A vendor patch is available via Arista Security Advisory 0163, and no public exploit code has been identified at time of analysis; the supplied CVSS 4.0 score of 9.4 should be treated with caution, as it reflects an authorization mismatch on a management interface that requires an already-authenticated user (CVSS vector PR:H) plus a non-default AAA configuration rather than an unauthenticated, scope-changing compromise.
HTML injection in the Royal Elementor Addons WordPress plugin before version 1.7.1067 lets unauthenticated visitors inject arbitrary HTML into the administrator notification emails generated by the plugin's form widget. Because form submissions are not sanitized before being embedded in the email body, an attacker can place crafted markup, malicious links, or spoofed content in mail that lands in the site administrator's inbox. Publicly available exploit code exists, and exploitation hinges on the administrator opening the notification email (CVSS UI:R), giving a base score of 6.1; no CISA KEV listing or EPSS score was supplied with the source data.
Command injection in Arista EOS-based products lets an authenticated user of the gRPC Network Security Interface (gNSI) Certz service escalate privileges and run arbitrary OS commands as root by sending a crafted Certz Rotate request, resulting in full device compromise; the Bootz service is affected by the same flaw. The issue is a CWE-78 OS command injection reported by Arista and carries a CVSS 4.0 base score of 9.4. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated attackers can book time slots in the Appointment Hour Booking WordPress plugin (before 1.5.95) that have already reached their configured capacity, because each appointment in a multi-appointment booking submission is not validated against the capacity limit of its own slot. The plugin assigns a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only impact), meaning any anonymous visitor can submit a crafted booking form and overwrite or occupy fully booked slots, denying legitimate customers their reservations. Publicly available exploit code exists per WPScan, but the issue is not listed in CISA KEV and EPSS-style mass exploitation signals are absent, so this is best treated as a business-logic abuse and booking-integrity risk rather than a code-execution emergency.
Unauthenticated visitors can mark unpaid Eventin orders of any value as paid by replaying a single genuine low-value payment transaction, because the plugin only checks that the gateway reports success and never validates the amount, currency, or which order the transaction belongs to. The flaw affects WordPress sites running the Eventin event-management plugin before version 4.1.24, and exploit detail is publicly available via the WPScan advisory. There is no indication in the supplied data that this is being actively exploited (no CISA KEV listing), and EPSS data was not provided.
An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker.
A crafted DNSKEY whose owner name is a compression pointer into its own RDATA overflows the digest buffer in the DNSSEC validator of NLnet Labs Unbound 1.26.0 and earlier, letting an attacker who controls an authoritative zone crash a validating recursive resolver and, depending on heap layout, potentially execute code with attacker-influenced data. Exploitation is unauthenticated over the network per the CVSS vectors but is gated on DNSSEC validation being active and on inducing the resolver to query a name in the attacker's zone; the independently assessed impact is primarily denial of service (availability High, confidentiality and integrity Low), with remote code execution only possible rather than demonstrated. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, although the vendor rates the issue 9.1 under CVSS 4.0 and an advisory has been published.
An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.
Command injection in Pepperl+Fuchs ICE2/ICE3 and Phoenix Contact IOL MA8 series IO-Link Master devices allows a low-privileged remote attacker to execute arbitrary OS commands with root privileges by sending a crafted GET request to the /api/status/data REST endpoint. Three separate CERTVDE coordinated advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same vulnerable firmware stack is shared across multiple industrial automation vendors, broadening the effective attack surface beyond any single manufacturer. No public exploit code or active exploitation has been identified at time of analysis.
Command injection via a PHP web management endpoint on Pepperl+Fuchs ICE2/ICE3 series IO-Link Masters and Phoenix Contact IOL_MA8_PN_DI8 allows an authenticated operator-level attacker to execute arbitrary OS commands with root privileges on the device. The vulnerable endpoint, `/index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files`, passes user-supplied filenames to an underlying OS command without sanitization, enabling full device compromise. No public exploit code or KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this a serious risk in OT/ICS environments.
Remote code execution is achievable on Pepperl+Fuchs ICE2/ICE3-series IO-Link Master devices and the Phoenix Contact IOL MA8 via a local file inclusion flaw in the `/index.php/ajax/save_iodd_parameters` AJAX endpoint. An authenticated attacker holding a valid operator-level session cookie can supply a crafted filename parameter that causes the PHP runtime to include and execute an attacker-controlled file, yielding full device compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation requires prior acquisition of operator credentials.
Remote code execution via PHP local file inclusion on Pepperl+Fuchs ICE2/ICE3 series IO-Link Master devices and OEM equivalents (Phoenix Contact, Indu-Sol variants) allows a low-privileged authenticated attacker to execute arbitrary PHP code by supplying a crafted parameter to the /index.php/ajax/get_iodd_port_info endpoint. The vulnerability requires only a valid user session cookie, making it accessible to any account holder on these industrial automation gateways. Three separate CERT VDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same vulnerable firmware is shipped under at least three different vendor brands, broadening the affected fleet across OT environments. No public exploit code or active exploitation has been identified at time of analysis.
Command injection via the PHP-based IODD parameter save endpoint on Pepperl+Fuchs ICE2/ICE3 series IO-Link masters and OEM-equivalent devices allows an authenticated operator-level attacker to execute arbitrary OS commands with root privileges on the device. Affected hardware includes multiple ICE2 and ICE3 form-factor variants from Pepperl+Fuchs and the Phoenix Contact IOL MA8 PN DI8, with additional OEM-labeled variants covered under three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices (and OEM variants from Phoenix Contact and others) allows a low-privileged authenticated remote attacker to execute arbitrary OS commands with root privileges via the PHP-based /index.php/ajax/parameterManage endpoint. The flaw is tracked across three CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating the vulnerable firmware is shared across multiple vendor rebrand families. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Command injection via the Field_Shadow_Password class in Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and Phoenix Contact IOL_MA8_PN_DI8 allows a network-authenticated attacker holding only operator-level credentials to inject OS commands that execute with root privileges on the device. The vulnerability (CWE-78) is exploitable without user interaction against a low-privileged account, resulting in full confidentiality, integrity, and availability compromise of the affected industrial device. No public exploit code or CISA KEV listing has been identified at time of analysis; three coordinated CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) cover multiple vendor families sharing the same underlying platform.
Command injection in Pepperl+Fuchs ICE2/ICE3 series and Phoenix Contact IOL_MA8 IO-Link master devices enables an authenticated low-privileged attacker to execute arbitrary OS commands as root via the /index.php/attached_devices_tab/do_upload web management endpoint. The vulnerability (CWE-78) is exploitable remotely without user interaction using only operator-level credentials, yielding full device compromise including confidentiality, integrity, and availability of the industrial gateway. No public exploit code or CISA KEV listing has been identified at time of analysis, though three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate coordinated multi-vendor disclosure.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices and OEM equivalents allows a low-privileged authenticated attacker to execute arbitrary OS commands as root via the /index.php/ajax/get_iodd_port_info PHP endpoint. Affected hardware spans multiple ICE2 and ICE3 form factors (G65L, K45P, K45S housings) as well as Phoenix Contact IOL MA8 and additional OEM-branded variants sharing the same firmware. No public exploit code has been identified at time of analysis, but the low attack complexity and high impact make this a credible priority in any industrial network where these devices are reachable.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices (and OEM equivalents from Phoenix Contact and others) allows a low-privileged authenticated attacker to execute arbitrary OS commands as root via the PHP endpoint /index.php/ajax/get_iodd_menu_info. Any valid user or operator account - the lowest access tiers on the device - is sufficient to achieve full device compromise. No public exploit has been identified at time of analysis, but the vulnerability is straightforward (CWE-78) and reported across three separate CERTVDE advisories covering multiple vendor SKUs, indicating a shared firmware base.
Unauthenticated visitors can inject arbitrary WordPress shortcodes, including attacker-chosen attributes, into Formidable Forms versions before 6.35 because a request-derived value is substituted into a form's custom HTML and then passed through the shortcode parser server-side. Any page rendering an affected form will execute the injected shortcode, which can expose data or alter site behaviour depending on which shortcodes are installed on the target. Publicly available exploit code exists per WPScan, but CISA KEV does not list this issue and the CVSS score is moderate (4.8, AV:N/AC:H/PR:N/UI:N/C:L/I:L/A:N), reflecting configuration-dependent preconditions and limited impact.
Arbitrary file overwrite in the Contest Gallery WordPress plugin (Upload & Vote Photos, Media, Sell with PayPal & Stripe) affects all versions up to and including 32.0.1, where the 'baseUrlForFacebook' parameter is passed to a file-writing routine without adequate path validation. Exploitation requires at least a subscriber-level account on the target WordPress site, but then allows overwriting known files on the server, which can escalate to remote code execution when the overwritten path is a PHP file that the web server later executes. No public exploit code or CISA KEV listing was provided in the source data for this CVE, so active exploitation is unconfirmed at time of analysis.
Authenticated remote code execution in Arista EOS allows a malicious client with valid gRPC Network Management Interface (gNMI) access to execute arbitrary code with root privileges on the switch by sending a single specially crafted request. Only switches where gNMI has been explicitly enabled are exposed - gNMI is a non-default management API - and the attacker must already hold working gNMI credentials, which limits practical exposure to insiders or adversaries who have already compromised network-automation or management accounts, but grants them full root control of the device with low attack complexity and no user interaction. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed as actively exploited (no CISA KEV listing); no EPSS score was provided. The vendor has published security advisory SA-0166 at https://www.arista.com/en/support/advisories-notices/security-advisory/24722-security-advisory-0166.
Local privilege escalation in Qualitysoft Corporation's QND endpoint management client for Windows (Advance ≤Ver.11.0.9i, Premium and Standard ≤Ver.11.1i) allows any logged-in user to execute arbitrary commands with SYSTEM privileges by abusing an improperly access-controlled named pipe exposed by the client component. The named pipe lacks a restrictive DACL, permitting user-mode processes running under low-privileged accounts to communicate with the SYSTEM-level pipe server and direct it to execute attacker-controlled commands. No public exploit code and no CISA KEV listing have been identified at time of analysis; JPCERT/CC and Qualitysoft Corporation have both published advisories.
Path traversal in Octopus Server allows an authenticated low-privilege user to overwrite arbitrary files on the server filesystem, which in certain configurations escalates to remote code execution. Affected are three distinct release trains of Octopus Server (CPE: cpe:2.3:a:octopus_deploy:octopus_server). No public exploit or CISA KEV listing exists at time of analysis, and a vendor patch is available across all three affected version ranges.
Unauthenticated remote access to the configuration download function on XikeStor Layer3 switches (SKS8300-8T, SKS8300-12E2T2X, SKS8310-8X) running firmware below V1.04.B09 exposes full device configuration files to any network-reachable attacker. Recovered configurations contain network topology details and credentials, enabling attackers to authenticate to the switch itself or leverage it as a pivot point into the protected network segment it manages. Disclosed by JPCERT/CC (JVN#45281119); no public exploit code or active exploitation (CISA KEV) identified at time of analysis.
A stored/cross-context cross-site scripting flaw (CWE-79) in GitLab CE/EE's Content Editor allows an unauthenticated attacker to run arbitrary JavaScript in a targeted user's session, because pasted HTML is not sanitized properly. All GitLab Community and Enterprise Edition versions from 19.0 up to (but not including) 19.1.8, 19.2.6, and 19.3.2 are affected. Publicly available exploit information exists via a HackerOne report, but the issue is not listed in CISA KEV and its low EPSS-relevant profile (CVSS 4.7, AC:H, UI:R) places it in the moderate rather than emergency tier.
Command injection in the gRPC Network Security Interface (gNSI) Credentialz service of Arista EOS allows an authenticated, low-privileged attacker with access to the gRPC management endpoint to send a crafted request that modifies a target account's properties, potentially granting that account elevated privileges or broader access than an administrator intended (CVSS 4.0 base 8.6; assessed CVSS 3.1 8.6, AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N). Exposure is conditional: the device must be running an affected EOS maintenance train (4.30.0F through 4.36.0.1F) with gNSI Credentialz configured, a non-default management feature, and the attacker must already hold authenticated access to that endpoint, making this a privilege-escalation-from-foothold rather than an anonymous remote compromise. A vendor patch is available per the Arista advisory; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is narrower in practice than the raw score suggests because of the configuration prerequisite.
Heap-based memory corruption in NLnet Labs Unbound up to and including 1.26.0 lets a remote, unauthenticated attacker who controls or spoofs the upstream DNS response (PR:N/UI:N) gradually overwrite heap memory, with the reliable outcome being a crash and remote code execution possible only on certain systems and compilation options that lack hardening. The flaw is scored CVSS 8.4 (CVSS:4.0) and by the independent assessment as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, with the high attack complexity reflecting heavy dependence on heap layout and non-deterministic results. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no KEV listing or EPSS signal is present, so this is a genuine but not-yet-urgent priority for internet-facing recursive resolvers.
Improper authorization checks in GitLab CE/EE's Generic Package Registry (CWE-862) allow an authenticated user holding developer-role permissions to substitute the content of an existing package file and to hide packages from their legitimate owners. The flaw affects all GitLab Community and Enterprise Editions from 13.9 up to the fixed releases 19.1.8, 19.2.6 and 19.3.2, meaning the exposure window spans multiple major release lines and any long-lived install not patched in this cycle. Impact is integrity-only (CVSS 4.3, AV:N/PR:L/UI:N) - an attacker cannot read or delete data or crash the instance, but they can silently corrupt or conceal artifacts that downstream users and CI pipelines trust; publicly available exploit detail has been published via a HackerOne report.
GitLab CE/EE 13.0 and later (before 19.1.8, 19.2.6 and 19.3.2) fails to properly validate group URL slugs during namespace transfers, allowing any authenticated user to induce a slug collision that leaves the legitimate owners of another group unable to modify that group's settings. The flaw is an availability-only issue (CVSS 4.3, C:N/I:N/A:L) rather than a data-disclosure or code-execution bug, but publicly available exploit detail exists via the linked HackerOne report, and the CWE-862 classification indicates the transfer workflow bypasses the authorization checks that should protect the target namespace. No CISA KEV listing or EPSS score was supplied, so active exploitation is not confirmed.
Improper authorization controls in GitLab Enterprise Edition's compliance framework management allow an authenticated user holding the Security Manager role to execute arbitrary CI/CD jobs and reach protected CI/CD variables inside group projects. Affected are GitLab EE 18.11 through 19.1.7, 19.2.x before 19.2.6, and 19.3.x before 19.3.2, with fixes published in 19.1.8, 19.2.6, and 19.3.2. Exploit details are publicly available via a HackerOne report, and GitLab is credited as the reporter, though the issue is not listed in CISA KEV and no EPSS estimate was supplied.
Improper authorization on the IODD file upload endpoint of multiple Pepperl+Fuchs ICE2 and ICE3 IO-Link master devices, as well as Phoenix Contact IOL MA8 PN DI8 units, permits any low-privileged authenticated remote user to upload IO-Link Device Description (IODD) files without the privilege level required for that operation. Successful exploitation can silently alter how connected IO-Link sensors and actuators are configured or interpreted by the master, or crash the device entirely by supplying malformed IODD content. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Mis-enforced authorization in Arista EOS allows an authenticated gNMI user to read or write management paths that an active gNSI Pathz policy is meant to deny, specifically when a single Pathz policy contains both a group rule and a user rule referencing the same path. Exposure is limited to EOS deployments that combine OpenConfig, a running gNMI server, and gNSI Pathz authorization - a non-default, advanced management-plane configuration - and the attacker must already hold valid gNMI credentials, consistent with the assessed vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (confidentiality and integrity High, no availability impact). No public exploit code exists and there is no confirmed active exploitation (not in CISA KEV); the supplied CVSS 4.0 score of 7.7 overstates day-to-day risk given the narrow prerequisite stack.
Heap buffer overflow in NLnet Labs Unbound 1.26.0 and earlier can be triggered when a resolver processing a large TCP-framed DNS response encounters an RRSet whose owner name reaches the 255-byte maximum, crashing the resolver process and yielding a denial of service (availability-only impact, C:N/I:N/A:H). An attacker must either operate an authoritative name server that the victim resolver queries or hold an on-path position to tamper with an incoming DNS response, and the malicious answer must be delivered over TCP, be large, and carry the maximal-length owner name; crafting and delivering that payload raises practical complexity above the vendor's AC:L rating, which is why our assessment uses AC:H. No public exploit code or confirmed active exploitation has been identified at time of analysis, and because canonicalisation runs before DNSSEC validation, signature validation does not mitigate the issue. NLnet Labs has published an advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt.
Path traversal in the PHP web management interface of Pepperl+Fuchs ICE2/ICE3 series and Phoenix Contact IOL MA8 IO-Link master devices allows unauthenticated remote attackers to read arbitrary files via the /index.php/view_uploaded_iodd_file endpoint. The most critical disclosed impact is exfiltration of the SSH server's private key, which could enable decryption of captured SSH sessions or device impersonation. Three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the vulnerability affects a shared firmware/software base across multiple vendor OEM implementations. No public exploit or KEV listing identified at time of analysis.
Unauthenticated attackers can read the complete AI booking conversation transcript of any Bookly customer — including names, email addresses, phone numbers and appointment details — because the plugin's 'conversation_id' parameter is never checked against an owner, and conversation IDs are sequential integers that can simply be incremented. The same endpoint also allows arbitrary messages to be injected into a victim's conversation, which are then replayed to the Cloud AI worker together with the full private history, enabling data poisoning and prompt-injection against the assistant. The flaw affects all versions of the Online Scheduling and Appointment Booking System – Bookly plugin through 28.1; no public exploit code or CISA KEV listing was identified at time of analysis.
Improper cryptographic signature verification in the VeloCloud Edge (Arista, formerly VMware/Broadcom SD-WAN) software update workflow allows an attacker who can either upload packages to VeloCloud Orchestrator or authenticate directly to an Edge to install unauthorized software on the appliance. Because the update workflow does not constrain which digest algorithm is used to verify artifacts, a bundle signed with an unexpected or weak digest can be accepted as legitimate, resulting in arbitrary code execution with the privileges of the update process on the SD-WAN edge node. No public exploit code and no CISA KEV listing were present in the provided intelligence, although the required access level (CVSS 4.0 PR:H) means the flaw is most dangerous to insiders or anyone who has already compromised an operator account.
OS command injection in Arista VeloCloud Edge management and configuration workflows allows input supplied through those workflows to be interpreted as an operating-system command, resulting in command execution with elevated privileges on the appliance. Exploitation requires a high-privileged management request or the ability to write a configuration value, so this is primarily a privileged-insider, compromised-admin-account, or post-compromise escalation risk rather than an unauthenticated internet-facing flaw. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS score was supplied with the record.
Command injection via the `/api/datastorage/data` REST API endpoint in Pepperl+Fuchs ICE2/ICE3 and Phoenix Contact IOL-MA8 IO-Link master devices allows an authenticated administrator to execute arbitrary OS commands with root privileges by sending a crafted HTTP PUT request. The flaw spans multiple hardware variants from both vendors and is disclosed across three CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating broad impact across related product families. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Command injection on Pepperl+Fuchs ICE2/ICE3 series IO-Link Master devices and OEM-equivalent variants (Phoenix Contact IOL-MA8, and others) allows an authenticated remote admin to execute arbitrary OS commands as root via a crafted GET request to the /api/datastorage/data endpoint. The vulnerability is reported across at least three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating coordinated multi-vendor OEM disclosure spanning Pepperl+Fuchs, Phoenix Contact, and additional industrial automation suppliers. No public exploit code or active exploitation has been identified at time of analysis, but the industrial OT context raises availability and safety concern disproportionate to a purely IT risk framing.
Command injection in the web management API of Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and Phoenix Contact IOL MA8 enables an authenticated admin-level attacker to execute arbitrary OS commands as root via a crafted PUT request to the /api/iodd/config endpoint. All firmware versions of at least nine Pepperl+Fuchs ICE2/ICE3 hardware variants and the Phoenix Contact IOL MA8 PN DI8 are confirmed affected across three CERT@VDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028). No public exploit code or active exploitation is identified at time of analysis, but full root compromise of an industrial field device represents a significant ICS/OT risk.