Covenant through 0.6 registers its CovenantHub SignalR hub without an Authorize attribute, so any unauthenticated caller who can reach the hub endpoint can invoke CreateHttpListener and receive a valid signed JWT; that token then authenticates the attacker to the entire Covenant operator API, exposing grunts, credentials, binaries, events, and the operator roster. The vulnerability is scored CVSS 4.0 9.3 and independently assessed as CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), fully compromising confidentiality and integrity with no availability impact. Exploitation requires only network reachability to the operator server - no credentials, user interaction, or non-default configuration - and while no public exploit identified at time of analysis and no CISA KEV listing was observed, the missing authentication check makes abuse straightforward for anyone with that access.
Unauthenticated OS command injection in the edgserver management service of Advantech EKI-1242EIMS and EKI-1242IEIMS gateways running firmware V1.06.01 lets remote attackers execute arbitrary operating-system commands with root privileges via crafted requests sent to TCP port 5058. No credentials or user interaction are required (CVSS 4.0 vector PR:N/UI:N, provider score 9.3; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact), and default configurations are affected. Exploitation is gated only by network reachability to the management port - there is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the issue is a genuine high-priority risk on any deployment where port 5058 is exposed beyond a trusted management segment.
OS command injection in the WNC T-Mobile 5G Box IDU router's portal.cgi password-change function allows an attacker who already holds high-privilege portal credentials and is positioned on the adjacent network to run arbitrary operating-system commands as root, yielding full device compromise (CVSS 4.0 base 9.3). The root cause is improper neutralization of shell metacharacters in the http_passwd_hidden and http_passwdConfirm_hidden parameters, so a crafted password-change request is interpreted by the underlying shell rather than treated as inert input. Only firmware below 1.1.0.651412 is affected and the issue is fixed in 1.1.0.651412; exploitation is constrained by AV:A (LAN/Wi-Fi-side reachability, not the public internet) and PR:H (valid admin credentials required first), and no public exploit identified at time of analysis.
Authenticated OS command injection in the WNC T-Mobile 5G Box IDU router's web management portal lets an admin-level attacker on the adjacent network run arbitrary shell commands as root. The flaw (CWE-78) sits in the ping diagnostic feature of /cgi-bin/portal.cgi, where the ping_ip, ping_size, and ping_times POST parameters are concatenated into a system command without validation or sanitization; no user interaction is required once credentials are held. All firmware versions below 1.1.0.651412 are affected, and exploitation is constrained by two prerequisites - network reachability to the portal (AV:A, adjacent/local rather than internet-facing) and valid high-privilege (PR:H) portal access - so the practical risk, despite the 9.3 CVSS 4.0 base score, is bounded by the fact that the attacker must already be an authenticated admin on the local network segment. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV) at time of analysis; CVE-2026-40855 was reported by CERT-PL and a vendor patch exists.
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to read CRM approval-workflow data through GET /admin-api/crm/flow/flow-users, disclosing approval chain topology, step ordering, approver identifiers, and personal information such as login names, nicknames, departments, email addresses, mobile numbers, and last-login IP addresses. The endpoint does enforce authentication but omits any role or permission check, so a single low-privilege admin-panel account is sufficient - no elevated privileges, user interaction, or special configuration are required. Publicly available exploit code exists for this issue, although the CVE is not listed in CISA KEV; the practical barrier to exploitation is the requirement to hold or obtain a valid back-office session.
Missing authorization in the StoreProductController onSale handler of Yshop CRM through 2.1.3 allows any authenticated back-office user (regardless of assigned role) to toggle product sale status by calling GET /admin-api/product/store-product/sale with sequential product IDs, letting them withdraw entire catalogs from sale or re-enable withdrawn products. The flaw is an integrity-only issue (CVSS 3.1 base 5.3, PR:L) - it is not reachable anonymously and causes no data disclosure or service outage. Publicly available exploit code exists (a Python PoC published alongside the request), but there is no confirmed active exploitation (not in CISA KEV); this is a genuinely low-to-moderate risk issue despite the CRITICAL-sounding CWE-862 label.
Authenticated back-office users can abuse yshop-crm through 2.1.3 to send SMS and email to arbitrary customers via POST /admin-api/crm/customer/send-sms and /send-mail, because CrmCustomerController does not enforce authorization on those actions. Publicly available exploit code exists, but exploitation requires a valid back-office account (PR:L), is remote with no user interaction, and yields only limited integrity impact; no confidentiality or availability impact is assessed. The practical risk is therefore concentrated on malicious insiders or attackers who have already obtained CRM credentials, not pre-auth compromise of default installations.
A correctness bug in the Linux kernel's skb_zerocopy() helper causes it to destructively call skb_tx_error() on the source skb it is only copying from, completing that skb's zerocopy uarg and clearing the SKBFL_SHARED_FRAG page-ownership marker while the skb is still in flight. The bug only manifests on the skb_orphan_frags() failure path, which is driven by kernel memory-allocation pressure rather than attacker-controlled input, and only on hosts using Open vSwitch datapath userspace upcall actions (OVS_ACTION_ATTR_USERSPACE) or nfnetlink_queue (NFQUEUE) delivery with MSG_ZEROCOPY-backed source skbs; the most severe consequence - later in-place ESP decryption over frags the skb no longer privately owns - additionally requires local ESP/IPsec delivery of the affected skb. Vendor patches exist in stable releases 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 and the 7.3-rc1 line, no confirmed actively exploited status (not in CISA KEV), and no public exploit identified at time of analysis. Note that the NVD-style score of 9.3 overstates practical risk; the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L, making this a high-CVSS-but-low-real-risk defect.
Incorrect handling of queued local TLB flushes in the Linux kernel's KVM nested-VMX (nVMX) implementation can leave stale guest translations active after a failed nested VM-Enter, causing KVM to miss a required TLB flush when L1 changes L2's VPID. Only hosts running Intel VMX with KVM nested virtualization explicitly enabled (nested=1) are affected; an attacker who already controls an L1 hypervisor guest vCPU with the ability to manipulate nested VMCS state could reassign L2's VPID, force a nested VM-Enter to fail, and then perform a successful VM-Enter so the missed flush leaves stale address translations in place. The independent assessment rates this CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H - local hypervisor context, non-default configuration, no confidentiality impact, limited integrity and availability impact - and notes it is not exploitable against default (non-nested) KVM deployments; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Address-rollover bug in the Linux kernel's KVM/arm64 TLB-by-VA invalidation path causes the hypervisor to silently skip an invalidation when the range ends at the last page or block of the TTBR1 VA space, because the exclusive end computation (base + size) wraps to zero. The faulty logic was introduced in Linux 6.16 and is fixed in 6.18.51, 7.2.5 and 7.3-rc1; hosts running unpatched kernels are exposed where a guest vCPU can drive trapped TLB-by-VA invalidations, while the IPA-invalidation path never suffered the rollover. The assessed vector is local (AV:L) with low privileges (PR:L) and high attack complexity (AC:H) because of the narrow address-layout precondition, with scope change and high availability impact; no public exploit code and no confirmed active exploitation (no CISA KEV entry) have been identified, and the provided reference CVSS of 9.3 overstates the practical risk relative to that assessment.
Race conditions in the arm64 KVM path that invalidates VNCR translations can leave a stale stage-1 TLB entry installed for a page-table mapping that another vCPU has just invalidated, so a guest can keep using a translation the host believes is gone, corrupting host state and potentially crashing the host. The flaw only affects arm64 hosts running KVM with nested virtualization (FEAT_NV2 / VNCR fixmap) enabled where an attacker already controls a guest with at least two concurrently executing vCPUs, and exploitation hinges on winning a narrow race window between invalidate_vncr_va() on one vCPU and a VNCR translation fault-in on another (one vCPU rewriting S1 page tables and issuing TLBI S1E2 while the other is mid-walk). Because the path is local-only and nested virtualization on arm64 is rarely deployed, the independent assessment rates the issue well below the vendor's CVSS 9.3 (assessed AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H - high availability impact, low integrity impact, no confidentiality impact); no public exploit identified at time of analysis, and vendor patches are available in Linux 7.2.5, 6.18.51 and 7.3-rc1.
Missed TLB invalidations in the arm64 KVM nested-virtualization path of the Linux kernel can leave stale translations for an L1-supplied VNCR page in L0, allowing a guest with control of an L1 vCPU on an arm64 host to cross the guest-to-host boundary in a timing-sensitive way. Affected systems are those running kernel 6.16 or later with arm64 nested virtualization (FEAT_NV2 / VNCR page support) enabled and exposed to a guest; the flaw is a guest-to-host (L1-to-L0) issue, so exploitation requires guest-vCPU privileges and is local to the host, which contradicts the vendor's PR:N vector. Vendor-released patches exist in Linux 6.18.52, 7.2.5, and 7.3-rc1, and no public exploit code has been identified at time of analysis; the vendor's CVSS of 9.3 substantially overstates real-world risk given that nested virtualization is off by default and deployed on only a small subset of arm64 KVM hosts, and the missed-invalidation window is opportunistic and mapping-state dependent rather than deterministic.
Range-based TLB invalidation in the arm64 KVM hypervisor of the Linux kernel is computed against the wrong address range because the decode_range_tlbi() helper omitted the required virtual-address sign-extension when it was reused for stage-1 TLBI handling, and the same helper can overflow physical-address bits when invoked for stage-2 invalidation. Only arm64 hosts running KVM are affected, and the attacker must already control a guest VM/vCPU able to issue range-based TLBI operations (low-privilege guest context, no user interaction, no network reachability); kernels from the 6.16 introduction through the fixes in 6.18.51, 7.2.5 and 7.3-rc1 are in scope. Exploitation results in stale or incorrectly scoped TLB entries on the host, with the assessed impact being availability loss (A:H) plus limited integrity impact (I:L) and no confidentiality impact; no public exploit identified at time of analysis.
Command injection in Pepperl+Fuchs ICE2/ICE3 and Phoenix Contact IOL MA8 series IO-Link Master devices allows a low-privileged remote attacker to execute arbitrary OS commands with root privileges by sending a crafted GET request to the /api/status/data REST endpoint. Three separate CERTVDE coordinated advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same vulnerable firmware stack is shared across multiple industrial automation vendors, broadening the effective attack surface beyond any single manufacturer. No public exploit code or active exploitation has been identified at time of analysis.
Command injection via a PHP web management endpoint on Pepperl+Fuchs ICE2/ICE3 series IO-Link Masters and Phoenix Contact IOL_MA8_PN_DI8 allows an authenticated operator-level attacker to execute arbitrary OS commands with root privileges on the device. The vulnerable endpoint, `/index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files`, passes user-supplied filenames to an underlying OS command without sanitization, enabling full device compromise. No public exploit code or KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this a serious risk in OT/ICS environments.
Command injection via the PHP-based IODD parameter save endpoint on Pepperl+Fuchs ICE2/ICE3 series IO-Link masters and OEM-equivalent devices allows an authenticated operator-level attacker to execute arbitrary OS commands with root privileges on the device. Affected hardware includes multiple ICE2 and ICE3 form-factor variants from Pepperl+Fuchs and the Phoenix Contact IOL MA8 PN DI8, with additional OEM-labeled variants covered under three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices (and OEM variants from Phoenix Contact and others) allows a low-privileged authenticated remote attacker to execute arbitrary OS commands with root privileges via the PHP-based /index.php/ajax/parameterManage endpoint. The flaw is tracked across three CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating the vulnerable firmware is shared across multiple vendor rebrand families. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Command injection via the Field_Shadow_Password class in Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and Phoenix Contact IOL_MA8_PN_DI8 allows a network-authenticated attacker holding only operator-level credentials to inject OS commands that execute with root privileges on the device. The vulnerability (CWE-78) is exploitable without user interaction against a low-privileged account, resulting in full confidentiality, integrity, and availability compromise of the affected industrial device. No public exploit code or CISA KEV listing has been identified at time of analysis; three coordinated CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) cover multiple vendor families sharing the same underlying platform.
Command injection in Pepperl+Fuchs ICE2/ICE3 series and Phoenix Contact IOL_MA8 IO-Link master devices enables an authenticated low-privileged attacker to execute arbitrary OS commands as root via the /index.php/attached_devices_tab/do_upload web management endpoint. The vulnerability (CWE-78) is exploitable remotely without user interaction using only operator-level credentials, yielding full device compromise including confidentiality, integrity, and availability of the industrial gateway. No public exploit code or CISA KEV listing has been identified at time of analysis, though three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate coordinated multi-vendor disclosure.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices and OEM equivalents allows a low-privileged authenticated attacker to execute arbitrary OS commands as root via the /index.php/ajax/get_iodd_port_info PHP endpoint. Affected hardware spans multiple ICE2 and ICE3 form factors (G65L, K45P, K45S housings) as well as Phoenix Contact IOL MA8 and additional OEM-branded variants sharing the same firmware. No public exploit code has been identified at time of analysis, but the low attack complexity and high impact make this a credible priority in any industrial network where these devices are reachable.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices (and OEM equivalents from Phoenix Contact and others) allows a low-privileged authenticated attacker to execute arbitrary OS commands as root via the PHP endpoint /index.php/ajax/get_iodd_menu_info. Any valid user or operator account - the lowest access tiers on the device - is sufficient to achieve full device compromise. No public exploit has been identified at time of analysis, but the vulnerability is straightforward (CWE-78) and reported across three separate CERTVDE advisories covering multiple vendor SKUs, indicating a shared firmware base.
A crafted DNSKEY whose owner name is a compression pointer into its own RDATA overflows the digest buffer in the DNSSEC validator of NLnet Labs Unbound 1.26.0 and earlier, letting an attacker who controls an authoritative zone crash a validating recursive resolver and, depending on heap layout, potentially execute code with attacker-influenced data. Exploitation is unauthenticated over the network per the CVSS vectors but is gated on DNSSEC validation being active and on inducing the resolver to query a name in the attacker's zone; the independently assessed impact is primarily denial of service (availability High, confidentiality and integrity Low), with remote code execution only possible rather than demonstrated. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, although the vendor rates the issue 9.1 under CVSS 4.0 and an advisory has been published.
Authentication bypass in WWBN AVideo through 29.0 allows remote, unauthenticated attackers to log in as any user by submitting the victim's stored password hash directly to the login endpoints, completely circumventing password verification. The flaw exists in two independent code paths (loginFromRequest() and encryptPasswordVerify()) and requires prior possession of the users.password hash value-obtained through a separate compromise such as SQL injection, a leaked database backup, or insider access-making it a post-compromise pass-the-hash primitive rather than an initial-access vulnerability. No public exploit code has been identified at time of analysis, but the CVSS 4.0 base score is 9.2; however, the real-world risk is materially lower due to the hash-exfiltration prerequisite.
Server-side request forgery in HKUDS nanobot before 0.3.0 allows remote attackers to force the WebFetchTool component to request arbitrary URLs, including cloud metadata endpoints, localhost services, and RFC 1918 addresses, potentially exfiltrating IAM credentials and internal service data. The flaw resides in the _validate_url() function, which fails to block internal IP ranges. No public exploit identified at time of analysis; exploitation requires the WebFetchTool to be enabled and the bot to process attacker-supplied messages, with the CVSS vector indicating PR:N (unauthenticated) if the message interface is exposed without authentication.
Unauthenticated Kryo deserialization in the Angel-ML Angel distributed machine-learning coordinator (all versions through 3.3.0) lets any remote attacker who can reach the master RPC endpoint submit crafted setAlgoMetrics payloads that instantiate arbitrary classes or exhaust coordinator memory, producing denial of service and - when exploitable gadget classes are present on the coordinator classpath - remote code execution. No authentication or user interaction is required, but exploitation depends on network reachability to the master RPC service and, for the RCE outcome specifically, on the composition of the target's classpath; the memory-exhaustion outcome carries no such precondition and is reliably achievable. No public exploit identified at time of analysis, and the vulnerability is not confirmed actively exploited (no CISA KEV listing); the referenced GitHub issue and source-file links document the flaw but no patched release has been published.
Unauthenticated remote attackers can forge valid administrator session cookies for the Chaitin SafeLine management console (all versions through 9.4.1) because the session-signing secret is derived from a time-seeded math/rand generator (CWE-338) and can be reconstructed offline once the install timestamp is bounded. Successful exploitation yields full administrative control of the protected sites managed by that console, matching the 9.2 CVSS 4.0 rating and the independently assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H profile. Two prerequisites limit practical reach: the management console must be network-reachable from the attacker, and the attacker must be able to narrow the installation time enough to make the seed search feasible. No public exploit code and no confirmed in-the-wild exploitation were identified at the time of analysis, and consoles placed behind network segmentation, VPN, or IP allow-listing are not exposed to remote cookie forgery.
Out-of-bounds heap reads in the Linux kernel's ext4 inline-directory code (ext4_read_inline_dir()) let a local actor who can present a crafted inline-data ext4 directory - by creating one on a writable ext4 volume with the inline_data feature enabled, or by mounting a malicious ext4 image (e.g. via removable-media automount) - leak kernel heap memory and crash the kernel through an ordinary getdents64()/iterate_dir() call. The kernel emits a KASAN slab-out-of-bounds report in __ext4_check_dir_entry when the size-2 rec_len probe is dereferenced past the end of the kmalloc(inline_size) buffer. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is 0.21% (11th percentile), indicating low predicted exploitation activity; the supplied CVSS of 9.1 (AV:N/PR:N) is inconsistent with the flaw's local-only reachability and should be treated as mis-scored, with the assessed vector being AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H (High).
Heap memory disclosure in the Linux kernel's ntfs3 filesystem driver lets an attacker who can get a crafted NTFS image mounted read past the kmalloc-backed extended-attribute buffer and leak kernel heap contents to userspace via getxattr(), with an out-of-bounds read of up to 65535 bytes that can also crash the kernel. The defect is a missing size check in ntfs_read_ea(): a record declaring ef->size = 24 while elength = 0xffff passes validation because only the remaining buffer size is verified, after which ntfs_get_ea() trusts elength and copies the oversize value out of the undersized record. Exploitation is not remotely reachable in default configurations - it requires local access or a system that automounts untrusted removable media (the vendor's CVSS 9.1 AV:N rating overstates exposure), EPSS is 0.21% (11th percentile), and no public exploit code has been identified at time of analysis, though the vendor has released fixes.
A padding oracle in on-premises Delinea Secret Server (versions 10.5.1 through 12.1.3) allows unauthenticated remote attackers to decrypt or forge data protected with one of the server's own cryptographic keys, although the key material itself is never exposed. Exploitation is not trivial: it is an adaptive chosen-ciphertext attack that requires many crafted requests and a distinguishable padding-validation response from an exposed cryptographic operation, which is why the vendor scores it 9.1 Critical (CVSS 4.0) while the assessed vector (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) reflects high complexity and only partial integrity loss on the vulnerable component. EPSS is low at 0.20% (10th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; the elevated overall severity comes from the key's role protecting data across subsequent systems (SC:H/SI:H/SA:H), not from a single-request or trivially reproducible attack.
An authentication/authorization bypass in the djust Python live-view framework (versions prior to 1.0.7) lets unauthenticated remote attackers mount any view over the WebSocket/SSE transport even when that view is protected by standard Django guards such as LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @method_decorator(login_required, name="dispatch"), a custom dispatch() override, or the djust admin extension's staff gate. Because djust authorizes WebSocket mounts through its own check_view_auth helper instead of Django's View.dispatch() chain, those HTTP-only guards are enforced on the initial GET but silently skipped where all events and application state actually flow, so an anonymous or under-privileged client can invoke handlers - including admin list, create, change, and delete operations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N, 9.1) confirms the attack is remote and requires no authentication or user interaction, making this a high-priority flaw; no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV. Exploitation is limited to deployments that gate live views with HTTP-only Django authorization patterns - applications using djust's own transport-agnostic login_required, permission_required, or check_permissions attributes are unaffected.
SQL injection (CWE-89) in Marten, the .NET transactional document DB and event store for PostgreSQL, affects versions 7.0.0 through 9.12.x and lets an authenticated attacker who can influence strings reaching Marten's LINQ or tenant-management paths break out of single-quoted SQL/JSON-path literals and inject an always-true predicate, causing filter or multi-tenant authorization bypass and blind data exfiltration; on deployments that permit semicolon-batched Npgsql statements, data modification is also possible. The primary confirmed vector is a dictionary indexer key used in Where filters (src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs); Dictionary.ContainsKey is exploitable only under the Newtonsoft serializer, tenant identifiers reaching DeleteAllForTenant.cs via IEventStore.DeleteProjectionProgressAsync are likewise affected, and EventLoader.cs contains a related defense-in-depth sink. The vendor confirmed the issue in GHSA-rfx3-98h7-v3xp and fixed it in version 9.13.0 via PR #4911; no public exploit code was identified at time of analysis, and exploitation requires the host application to route attacker-controlled strings into one of these Marten paths.
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid administrative credentials on the node read or modify records in the underlying database, and on single-node deployments can render the ISE node unavailable so that endpoints that have not yet authenticated cannot reach the network until it is restored. Exploitation is not opportunistic: it requires the optional SXP (Security Group Tag Exchange Protocol) service to be enabled and at least one SXP connection to be configured, which confines realistic risk to TrustSec deployments that use SXP and whose admin accounts are exposed. Cisco rates the issue 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H); no public exploit code has been identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator to execute arbitrary OS commands and escalate to root by sending a crafted HTTP request. The provided data identifies affected Cisco ISE software via CPE and notes that in single-node deployments exploitation can also render the node unavailable, causing a DoS condition that blocks unauthenticated endpoints from reaching the network until the node is restored. No public exploit identified at time of analysis; exploitation requires valid high-privileged administrative credentials, which sharply limits the threat despite the 9.1 CVSS score.
Authenticated attackers who already hold administrative credentials on a managed Cisco FTD device can escalate to root on Cisco Secure Firewall Management Center (FMC) Software and its high-availability peer by abusing the sftunnel inter-device management channel to send crafted remote procedure calls that the FMC deserializes insecurely. Because the flaw crosses a security boundary (scope change), a single compromised managed firewall yields full control over the central management platform and its HA partner, giving the issue a disproportionately large blast radius. Exploitation is not unauthenticated: it requires prior administrative access to a managed FTD (PR:H) with no user interaction, and at time of analysis there is no public exploit identified, though the high CVSS base score of 9.1 and the sensitivity of firewall management infrastructure warrant prompt attention.
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows a remote attacker who already holds high-privilege administrative credentials to cause high confidentiality, integrity, and availability impact, with a scope change that may extend effects beyond the vulnerable component. Rated CVSS 9.1, this issue is moderated in practice by its PR:H prerequisite, which confines realistic exploitation to already-privileged insiders or post-compromise attackers; no public exploit code or active exploitation has been identified at time of analysis. Affected software is addressed by a Cisco hardening release, and the vendor advisory should be consulted for fixed releases.
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered vulnerabilities grouped under CVE-2026-20194, stemming from incorrect resource transfer between spheres (CWE-669). An authenticated attacker with high privileges can exploit these over the network to potentially achieve high confidentiality, integrity, and availability impact, as reflected by the CVSS 3.1 score of 9.1 (Critical) with scope change. No public exploit code or active exploitation has been identified at time of analysis, and the high-privilege authentication prerequisite confines realistic risk to trusted insiders or attackers who already hold administrative access.
Root-level command execution on Cisco Identity Services Engine (ISE) is achievable by an authenticated, high-privileged administrator who sends a crafted serialized Java object to an affected node, allowing arbitrary commands to run on the underlying operating system. The flaw is insecure Java deserialization (CWE-502) that yields user-level OS access escalating to root, and in single-node deployments a successful exploit can also render the ISE node unavailable, so endpoints that have not already authenticated cannot reach the network until the node is restored. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the vendor's CVSS 9.1 is driven by the scope change (S:C) and full C:H/I:H/A:H impact, but exploitation requires valid high-privileged administrative credentials (PR:H), which is the primary limiting factor.
Command injection in the REST API of Cisco ISE and ISE-PIC allows authenticated administrators to execute arbitrary commands with root privileges on the underlying operating system, potentially leading to complete node compromise and, in single-node deployments, a denial-of-service condition. This vulnerability (CVE-2026-20306) requires valid administrative credentials (PR:H) and network access to the management interface; no public exploit code has been identified at the time of analysis. The CVSS 3.1 base score is 9.1, driven by the high impact of root-level code execution and scope change from the web application to the OS.
Cisco ISE and ISE-PIC contain an OS command injection flaw (CWE-78) in their web-based diagnostic tools that lets an authenticated remote attacker with valid administrative credentials execute arbitrary commands and gain root on the underlying operating system. Because the attacker must already hold admin rights (PR:H), this is primarily a privilege-escalation and integrity-risk issue rather than an anonymous entry point, though the CVSS 3.1 score is 9.1 Critical (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) due to the scope change and full loss of confidentiality, integrity, and availability. On single-node deployments, successful exploitation can render the ISE node unavailable and block endpoints that have not yet authenticated from reaching the network, producing a denial-of-service condition; no public exploit code and no confirmed active exploitation were identified at time of analysis.
IP spoofing in @fastify/proxy-addr 3.0.0 through 5.1.0 allows any unauthenticated remote client to control the client address an application believes it received, defeating IP-based access control, rate limiting, geolocation, and audit logging. The flaw is triggered only under a specific operator misconfiguration: a trusted-proxy subnet expressed in IPv4-mapped IPv6 notation with an IPv4-sized prefix (for example ::ffff:10.0.0.0/8) is silently accepted but expands to trust every IPv4 address, making the socket peer trusted at hop 0 so an attacker-supplied X-Forwarded-For header is honored. Vendor CVSS is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; severity in practice is bounded by the misconfiguration precondition, and the issue is fixed in 5.1.1.
Silent AMQP 0.9.1 metadata corruption in the RabbitMQ amqp091-go Go client library prior to 1.13.0 lets an application that assigns an oversized value to any shortstr message property (CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type) serialize a wrapped uint8 length prefix alongside only a truncated value while reporting no error. The result is broken request/reply correlation, routing, tracing, and downstream message processing rather than code execution or disclosure; the flaw requires attacker-influenced data to reach a shortstr property, so applications that only set short, trusted, fixed-length values are not practically exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, and version 1.13.0 contains the vendor fix (CVSS 4.0 base 9.1; our independent assessment scores this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L, reflecting no privileges required but a high attack-complexity precondition).
An out-of-bounds read in the Linux kernel's iSCSI target (LIO) login handling lets a remote, unauthenticated initiator read past the end of a heap buffer when the target portal is configured to require CHAP authentication. Because login->req_buf is kzalloc'd with exactly MAX_KEY_VALUE_PAIRS (8192) bytes and iscsit_get_login_rx() accepts payload_length plus padding, a login PDU with DataSegmentLength between 8189 and 8192 fills the buffer completely, leaving no NUL terminator; the buffer is then consumed by length-unaware C string routines such as kstrdup(), strstr() and strlen_semi(), and convert_null_to_semi() rewrites embedded NULs to ';', so adjacent slab memory is walked and disclosed. The flaw is reachable pre-authentication only on portals that explicitly require CHAP (portals that do not require authentication rewrite AuthMethod to None in iscsi_login_zero_tsih_s2() and never enter the CHAP path), requires no user interaction, and at the time of analysis there is no public exploit identified, though a vendor patch is available and the affected kernel versions are broad.
An out-of-bounds read in the Linux kernel's qla2xxx Fibre Channel host bus adapter driver (qla2x00_status_entry()) allows a hostile, compromised, or malfunctioning FC storage target to leak adjacent response-ring or heap memory into the local SCSI sense buffer of a host using a QLogic 24xx/29xx-class HBA. The bug is an unsigned integer underflow: the target-supplied 32-bit sf.rsp_data_len (rsp_info_len) is subtracted from the IOCB data-area size (par_sense_len, 28 bytes on 24xx and 60 bytes on 29xx) without a clamp, so oversized values wrap par_sense_len to a huge number and advance sense_data past its bounds before the capped memcpy in qla2x00_handle_sense(). Vendor-released patches are available in stable branches 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 and 7.3-rc1, and no public exploit has been identified at time of analysis; the vendor CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:H) substantially overstates real-world risk, since the attacker must already occupy a trusted target role on the Fibre Channel fabric and the disclosed memory is bounded to at most SCSI_SENSE_BUFFERSIZE of local ring/heap data.
Unauthenticated remote attackers who can reach the Apache JServ Protocol (AJP) connector on Cisco Secure FMC Software can impersonate a peer device and, on success, execute commands as root and take full control of the FMC REST APIs. The decisive prerequisite is that the valid sftunnel connection between Cisco Secure FMC and Cisco Secure FTD must be down, which is why the flaw carries AC:H despite a 9.0 base score (AV:N/PR:N/UI:N/S:C, C/I/A:H); a healthy, normally connected deployment is not exploitable. Per the assessed vector, no authentication or user interaction is required, and no public exploit code or CISA KEV entry was identified at time of analysis. Root cause is a CWE-285 improper authorization condition created by incorrect initialization of the AJP connector's encryption parameters at boot time.
Crafted OSPFv3 packets can force an unexpected restart of the OSPFv3 routing agent on Arista EOS devices that have OSPFv3 configured, causing a transient loss of routing adjacencies and traffic disruption. The flaw is an availability-only denial of service (CWE-130 improper handling of length parameters) with no code execution, data disclosure, or persistence; no authentication is required (PR:N) and no user interaction is needed (UI:N), but exploitation depends on a preconditioned packet and, per our assessment, an attacker positioned on the same OSPFv3-participating link or adjacency domain rather than arbitrarily across the internet. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has published Security Advisory 0173.
Remote code execution is achievable on Pepperl+Fuchs ICE2/ICE3-series IO-Link Master devices and the Phoenix Contact IOL MA8 via a local file inclusion flaw in the `/index.php/ajax/save_iodd_parameters` AJAX endpoint. An authenticated attacker holding a valid operator-level session cookie can supply a crafted filename parameter that causes the PHP runtime to include and execute an attacker-controlled file, yielding full device compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation requires prior acquisition of operator credentials.
Remote code execution via PHP local file inclusion on Pepperl+Fuchs ICE2/ICE3 series IO-Link Master devices and OEM equivalents (Phoenix Contact, Indu-Sol variants) allows a low-privileged authenticated attacker to execute arbitrary PHP code by supplying a crafted parameter to the /index.php/ajax/get_iodd_port_info endpoint. The vulnerability requires only a valid user session cookie, making it accessible to any account holder on these industrial automation gateways. Three separate CERT VDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same vulnerable firmware is shipped under at least three different vendor brands, broadening the affected fleet across OT environments. No public exploit code or active exploitation has been identified at time of analysis.
Arbitrary file overwrite in the Contest Gallery WordPress plugin (Upload & Vote Photos, Media, Sell with PayPal & Stripe) affects all versions up to and including 32.0.1, where the 'baseUrlForFacebook' parameter is passed to a file-writing routine without adequate path validation. Exploitation requires at least a subscriber-level account on the target WordPress site, but then allows overwriting known files on the server, which can escalate to remote code execution when the overwritten path is a PHP file that the web server later executes. No public exploit code or CISA KEV listing was provided in the source data for this CVE, so active exploitation is unconfirmed at time of analysis.
Local privilege escalation in Qualitysoft Corporation's QND endpoint management client for Windows (Advance ≤Ver.11.0.9i, Premium and Standard ≤Ver.11.1i) allows any logged-in user to execute arbitrary commands with SYSTEM privileges by abusing an improperly access-controlled named pipe exposed by the client component. The named pipe lacks a restrictive DACL, permitting user-mode processes running under low-privileged accounts to communicate with the SYSTEM-level pipe server and direct it to execute attacker-controlled commands. No public exploit code and no CISA KEV listing have been identified at time of analysis; JPCERT/CC and Qualitysoft Corporation have both published advisories.
Denial of service in the official RabbitMQ Go client library amqp091-go (versions prior to 1.13.0): a malicious, compromised, or impersonated AMQP 0.9.1 broker can crash any application that connects to it. By encoding a byte-array field length as 0xFFFFFFFF (decoded into a signed int32 as -1) inside the connection.start server-properties table or a message header field table, the broker drives readField() to call make() with a negative size, producing a 'len out of range' runtime panic that escapes the reader goroutine and terminates the client process. Attackers must sit on the broker side of the connection - a trusted-broker deployment is largely unaffected - and the outcome is availability loss only, with no code execution or data disclosure. No public exploit code or confirmed active exploitation has been identified at time of analysis; vendor-released patch 1.13.0 is available.