A mismatched DMA unmap size in the nouveau DRM driver's device-private memory (dmem) migration path causes the kernel to unmap only PAGE_SIZE instead of the full compound-folio mapping size when device-private transparent huge pages (THP) are migrated. On affected systems running the open-source nouveau driver with dmem THP migration in use, an authenticated local attacker able to drive GPU device-memory migration workloads can repeatedly trigger the nouveau_dmem_migrate_to_ram() success path or the nouveau_dmem_migrate_copy_one() copy-error path, gradually leaking residual IOMMU/IOVA mappings for order>0 folios. No public exploit code exists and the issue is not confirmed as actively exploited (not in CISA KEV); EPSS and KEV signals are absent, and our independent assessment scores this as a low-impact, local-only mapping leak (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) rather than the 8.8 vendor vector, which overstates confidentiality, integrity, and scope impact.
Authenticated remote code execution in Arista EOS allows a malicious client with valid gRPC Network Management Interface (gNMI) access to execute arbitrary code with root privileges on the switch by sending a single specially crafted request. Only switches where gNMI has been explicitly enabled are exposed - gNMI is a non-default management API - and the attacker must already hold working gNMI credentials, which limits practical exposure to insiders or adversaries who have already compromised network-automation or management accounts, but grants them full root control of the device with low attack complexity and no user interaction. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed as actively exploited (no CISA KEV listing); no EPSS score was provided. The vendor has published security advisory SA-0166 at https://www.arista.com/en/support/advisories-notices/security-advisory/24722-security-advisory-0166.
A stored/cross-context cross-site scripting flaw (CWE-79) in GitLab CE/EE's Content Editor allows an unauthenticated attacker to run arbitrary JavaScript in a targeted user's session, because pasted HTML is not sanitized properly. All GitLab Community and Enterprise Edition versions from 19.0 up to (but not including) 19.1.8, 19.2.6, and 19.3.2 are affected. Publicly available exploit information exists via a HackerOne report, but the issue is not listed in CISA KEV and its low EPSS-relevant profile (CVSS 4.7, AC:H, UI:R) places it in the moderate rather than emergency tier.
Denial of service in the Joi npm package's isoDate() validation rule allows unauthenticated remote attackers to stall Node.js applications by supplying a valid ISO date followed by a long run of fractional-second digits, causing quadratic regex engine restarts. Affected versions are 17.2.0 through 17.13.6 and 18.0.0 through 18.2.5; no public exploit identified at time of analysis, but the availability impact is high (CVSS 8.7) and unbounded inputs can cause multi-second stalls per request. Vendor-released patches 17.13.7 and 18.2.6 resolve the issue.
Denial of service in Nodemailer before 9.1.0 allows remote, unauthenticated attackers to stall a Node.js process by supplying a crafted comma-separated address list - a single To, Cc, Bcc, From or Reply-To value, or any string fed to the exported addressparser - that triggers quadratic (O(n²)) parsing and blocks the single-threaded event loop at 100% CPU. The issue requires no special library configuration and no cooperating receiver: an approximately 1.5 MB address value freezes the process for roughly 25-30 seconds, and cost scales with the square of input size, so multi-megabyte values can stall a server for minutes. Impact is availability-only with no data exposure, and exploitation depends on the host application passing attacker-influenced data into an address field; applications that only send to fixed or internally controlled addresses are not affected. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; a vendor-released patch is available as Nodemailer 9.1.0.
Craft CMS versions 5.0.0-RC1 through 5.11.0 improperly authorize the GraphQL draftCreator and revisionCreator fields, allowing clients with only elements.drafts:read or elements.revisions:read scopes to retrieve PII (email, username, full name, postal address) of all draft/revision authors, typically editors and administrators. Unauthenticated exploitation is possible only if the operator has enabled the public GraphQL schema with those draft/revision scopes-a non-default configuration; otherwise a valid GraphQL token holding those scopes is required. The flaw is rated CVSS 4.0 8.7 (confidentiality-only) and is fixed in 5.11.0; no public exploit code has been identified at time of analysis.
Server-side template injection in Craft CMS 5.10.0 through 5.10.12 allows an authenticated low-privilege control-panel user with edit rights on even a single element type to execute arbitrary PHP code and fully compromise the server. The bug is an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() to View::renderObjectTemplate() redirect sink stayed unsandboxed, and the same patch introduced a self-signing oracle in Cp::elementLabelHtml(); because Craft/Yii HMAC tokens are not bound to a parameter name, a token minted over attacker-controlled Twig for returnUrl can be replayed as the redirect POST parameter. Exploitation requires a valid CP account with element-edit permissions (PR:L, no user interaction); no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released patch is Craft CMS 5.10.13.
Remote code execution in Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 lets any authenticated non-administrator user - Control Panel access is not required - run arbitrary operating-system commands as the web-server user. Craft signs the attacker-controlled license-shun cookie with the same key and format it uses to validate signed redirect parameters (the signature is not bound to its purpose), so the attacker can transplant that signed envelope into the login redirect parameter; on a successful login Craft accepts the signature and renders the attacker-supplied bytes as an unsandboxed Twig template, where Twig's map filter accepts a string callback and reaches PHP system(). Exploitation requires a password-authenticated account without active 2FA, the default request configuration, and a callable PHP system(); there is no public exploit code identified at time of analysis, and the flaw is fixed in 4.18.6 and 5.10.13. The high severity score reflects full confidentiality, integrity, and availability impact at the application level once the preconditions are met.
Stored OS command injection in the CloneSite plugin of AVideo (through version 29.0) lets an attacker who can plant a malicious SSH password - including through CSRF against an authenticated administrator - execute arbitrary shell commands as the crontab owner, commonly root or www-data, once the plugin's documented cron job runs. The CVSS 4.0 vector (AV:N/PR:N/UI:P) means unauthenticated remote attackers can trigger the chain but must socially engineer an already-authenticated administrator into submitting the crafted request, and exploitation also requires the CloneSite plugin to be enabled with its crontab installed plus one of two CSRF channels: a same-host TLS-terminating reverse proxy with $global['trustedProxies'] unset, or an attacker-controlled application co-hosted on the same hostname abusing the HTTPS SameSite=None session cookie. Default single-process Apache deployments are explicitly reported as not CSRF-exploitable, and no public exploit was identified at time of analysis, though the technical impact when the chain succeeds is full command execution with the injected payload persisted in the plugin configuration.
Unauthenticated information disclosure in AVideo through 29.0 lets any anonymous caller pull owner PII - email address, phone number, physical address, birth date, and administrator status - alongside metadata for videos that are supposed to be visible only to specific user groups. The defect lives in the clean_title branch of the get_api_video API endpoint, which performs no group-membership check when a video is requested by its public slug, so an attacker who knows or enumerates a slug bypasses the access control entirely (CWE-639, tagged Authentication Bypass). No authentication, user interaction, or special client configuration is required (CVSS 4.0 vector shows PR:N/UI:N and VC:H with no integrity or availability impact; the independent assessment agrees with a confidentiality-only 3.1 score), and no public exploit code or CISA KEV entry was identified at time of analysis, leaving the practical risk concentrated in instances that actually host group-restricted videos whose owners have populated profile fields.
Incorrect authorization in cc-connect through 1.5.0 allows an authenticated, low-privileged user who can trigger Feishu interactive card actions inside an admitted chat to dispatch agent commands, because the onCardAction handler never applies the per-user allowlist that the text message handler enforces. The result is an authorization bypass (CWE-863) rated CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N, with high confidentiality, integrity and availability impact confined to the cc-connect scope), meaning a participant who should not be permitted to drive the agent can still do so remotely without user interaction. Exploitation is access-gated rather than open to the internet at large: the attacker must already belong to a Feishu chat that the deployment has admitted, and no public exploit code or confirmed active exploitation was identified at time of analysis, but the enabled agent-command path makes the impact substantive rather than theoretical.
Unauthenticated information disclosure in OpenSign through 2.41.3 lets anyone who holds a document identifier taken from a guest signing link retrieve complete document details from the getDocument cloud function, including every signer's information, the sender's identity, and valid download tokens. The exposure only occurs when one-time-password verification is turned off on the server, and the attacker must already possess or guess a valid guest-link document ID; no account, credentials, or user interaction are required in that configuration. Impact is confidentiality-only (no integrity or availability effect) and no public exploit code or confirmed active exploitation was identified at time of analysis, though the affected versions and configuration are widely deployable.
Authentication bypass in OpenNHP through 1.0.2 allows remote unauthenticated attackers to defeat trusted-execution attestation verification by supplying evidence that includes a test_purpose key, which forces the FallbackVerifier to execute unconditionally. Attackers must also provide enrolled measure and serial-number pairs that already exist in the allowlist, which is the primary real-world limiter on exploitability. No public exploit code was identified at time of analysis, and the issue is not listed in CISA KEV; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates high confidentiality impact, though the raw CVSS 4.0 score of 8.7 slightly overstates unconditional trivial exploitability.
Unauthenticated path traversal in Uber Kraken through 0.1.29 allows remote attackers to read files outside the configured storage root via the /tags/{tag} endpoint when the testfs backend and build-index tagserver are exposed. Percent-encoded parent-directory segments in the tag parameter bypass path validation and disclose files readable by the testfs process account, yielding high confidentiality impact with no integrity or availability effect. No public exploit identified at time of analysis.
Improper authorization in Coze Studio through 0.5.1 lets an authenticated user (CVSS PR:L) abuse the workflow SQL customization node to reach memory-database tables belonging to other workspaces, because referenced table names are never validated against the caller's own workspace. By enumerating predictable table identifiers, the attacker can read, insert, or delete data in another tenant's memory database, yielding high confidentiality and integrity impact within the affected multi-tenant deployment (our assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Exploitation requires valid low-privilege credentials and a deployment hosting multiple workspaces on a shared memory-database backend; single-tenant installations have little to expose via this path. No public exploit code was identified at time of analysis, and there is no KEV confirmation of active exploitation.
Missing authorization checks in DiDi KnowStreaming through 3.4.1 allow any authenticated user - regardless of assigned role - to reach protected REST API functionality, including identity-management endpoints that can create administrator accounts or elevate the caller's own privileges. Exploitation requires only a valid low-privilege login (PR:L) with network reach to the REST API; no admin role, user interaction, or non-default configuration is needed, which makes the flaw most dangerous in deployments where accounts are broadly provisioned or self-registration is enabled. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation, but the complete loss of confidentiality, integrity, and availability on affected systems keeps this a genuinely high-priority privilege-escalation issue.
Authenticated users who hold only the read-only startup.read permission on a Pelican Panel server can escalate that access into remote command execution inside the managed container, because write protection for startup settings is enforced solely through disabled client-side form controls rather than a server-side authorization check. By pushing crafted Livewire state updates, the attacker triggers afterStateUpdated callbacks that rewrite startup commands, Docker images and variables, and those values are then executed when the container starts. All Pelican Panel deployments below 1.0.0-beta35 are affected; exploitation needs a low-privileged panel account scoped to the target server, no victim interaction, and reachability of the panel's Livewire endpoint. A vendor patch is available in 1.0.0-beta35, no public exploit code has been identified, and the issue is not listed in CISA KEV at time of analysis.
Read-only WebVirtCloud users can escalate to full virtual-machine control because the get_instance authorization gate in instances/views.py only verifies that a UserInstance grant exists and never inspects its permission flags; an authenticated attacker holding a view-only grant can therefore power off VMs, reset root passwords, install attacker-controlled SSH keys, and manage ISO images. The flaw is rated CVSS 8.7 (CVSS 4.0) and assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploitation requires a low-privileged authenticated account with an existing instance grant, no user interaction, and is reachable over the standard web interface. There is no CISA KEV listing and no public exploit code identified at time of analysis, but impact is high-integrity and high-availability for every deployment that delegates instance grants to non-administrative users, such as multi-tenant or team-based installations.
Authenticated attackers holding any valid low-privilege role in metasfresh can read, replace, and delete attachments and comments belonging to records their role is not permitted to access. The DocumentAttachmentsRestController and CommentsRestController endpoints enforce only login state and never apply metasfresh's record-level (role/organization) permissions, so an attacker who enumerates sequential document identifiers can traverse records across access boundaries - an insecure direct object reference (CWE-639) rated 8.7 under CVSS 4.0 (CVSS 3.1 assessment: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L). Exploitation requires a valid account and sequentially enumerable identifiers; no public exploit code exists, and there is no confirmed actively exploited (CISA KEV) status at time of analysis.
BC Security Empire before 6.7.1 is affected by an authenticated path traversal vulnerability in its multipart file upload flow; an operator with a valid Empire session can place a traversal sequence in the uploaded filename and write files outside the intended downloads directory on the C2 server, potentially achieving code execution. The issue is fixed in 6.7.1, which validates filenames and resolves upload paths safely; no public exploit identified at time of analysis, and CVSS 4.0 rates it 8.7 (assessed CVSS 3.1 8.8) with high confidentiality, integrity, and availability impact. Exploitation requires network access to the C2 REST API and valid credentials or a hijacked operator session, so patched or access-restricted deployments are not exposed.
Namespace isolation bypass in AWS Network Policy Agent (aws-network-policy-agent) before v1.4.0 lets an authenticated, highly privileged cluster user defeat NetworkPolicy enforcement against co-located pods that live in other namespaces. The attacker must be able to create pods and control their pod and namespace names so that they generate a pod identifier that collides with the identifier of a victim pod already running on the same node, which then causes the agent to misattribute enforcement state and skip the intended isolation. Only clusters that have Network Policy enabled and run the affected agent are exposed; the vendor has released Network Policy Agent v1.4.0 and Amazon VPC CNI Managed Add-on v1.22.4 to correct the identifier scheme, and no public exploit code or confirmed active exploitation was identified at the time of analysis.
Memory exhaustion in the RabbitMQ Java client (all versions prior to 5.34.0) lets a rogue AMQP broker or an in-path attacker crash the JVM host application: when both the client's default ConnectionFactory.DEFAULT_FRAME_MAX and the server's Connection.Tune frame_max negotiate to 0, the library's maxInboundMessageBodySize cap is silently discarded and an oversized inbound frame is allocated without limit. Attackers cannot force this against a passive, correctly connected client - the victim must connect outbound to attacker-influenced infrastructure, or the attacker must hold a man-in-the-middle position able to rewrite the Connection.Tune frame and inject frames, which the vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) and our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) both treat as an unauthenticated, availability-only denial of service with no code execution or data exposure. Impact is limited to terminating the client process via heap exhaustion, and there is no public exploit identified at time of analysis and no CISA KEV listing; vendor-released patch: 5.34.0.
Server-side request forgery in Quickwit through 0.9.0 allows remote attackers to coerce a Quickwit node into issuing HTTP requests to arbitrary internal addresses by supplying a crafted queue_url when creating an SQS file source. Because Quickwit ships without built-in authentication, any deployment whose management/create-source REST API is network-reachable is effectively unauthenticated against this attack; the only real prerequisite is that the SQS file source feature be usable and that a source definition containing an attacker-chosen queue_url can be POSTed. Exploitation is blind - the attacker learns only whether a connection succeeded, timed out, or errored - so impact is confined to internal network scanning and service fingerprinting from the node's network position, and no public exploit was identified at time of analysis.
Improper output encoding in the RabbitMQ amqp091-go Go client before 1.13.0 lets an attacker who can influence a TLS asset path value (CertFile, KeyFile, CACertFile, or ServerName) inject or overwrite AMQPS connection options whenever an application serializes a URI with URI.String() and later reparses it with ParseURI(). Because the values are concatenated into the query string without url.Values encoding, embedded '&' and '=' delimiters split into extra parameters that can redirect the client to different - but still pre-existing - local certificate, key, or CA files, corrupting connection configuration. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the vendor fix is version 1.13.0, and the practical risk is well below the headline 8.7 CVSS 4.0 score because exploitation needs a specific serialize-then-reparse code path plus attacker-influenceable path data.
Passive interception of the cleartext edgserver management protocol on Advantech EKI-1242EIMS and EKI-1242IEIMS devices running firmware V1.06.01 allows any observer positioned on the same network segment to recover sensitive device identity and network metadata as it traverses the wire. The vulnerability is unauthenticated and requires no user interaction (CVSS 4.0 vector AV:A/AC:L/AT:N/PR:N/UI:N), but our independent assessment scopes the real-world impact to confidentiality only (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) because a purely passive observer cannot alter or disrupt device behavior - the CVSS 4.0 base score of 8.7 reflects the vector's asserted high integrity and availability impact, which is not supported by the exploitation conditions. No public exploit code and no CISA KEV listing were identified at time of analysis, and the primary limiting factor is the requirement for network adjacency (the protocol is not remotely routable).
Authenticated non-guest users of Curiosity Workspace can escalate their privileges to administrator within an existing access group without an invitation or approval, as reported in CVE-2026-88817. The vendor rates this as high severity (CVSS 4.0 score 8.7), and our independent assessment confirms the impact is limited to the targeted access group-it does not grant application-wide administrator rights or root access to the host. No public exploit has been identified at the time of analysis, and a vendor advisory is available with potential remediation guidance.
Authentication bypass in the WNC T-Mobile 5G Box IDU router lets an attacker on the adjacent network reach the portal.cgi administration interface and log in without credentials by setting the sessionid cookie to a directory entry such as '.' or '..' that always exists under /tmp/login_user. The flaw affects firmware versions before 1.1.0.651412 and requires no authentication, no user interaction, and no non-default configuration - only network adjacency to the device (LAN or Wi-Fi side), since the assessed vector is AV:A. Impact is total: full read/write/execute control of the administrative panel, which is why the score is high (CVSS 4.0 8.7; assessed CVSS 3.1 8.7, C:H/I:H/A:H); no public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor firmware 1.1.0.651412 resolves the issue.
Unauthenticated elevated command execution is possible on Arista VeloCloud Edge appliances whenever High Availability is enabled, because the HA peer functions perform no caller verification (CWE-306). An attacker positioned on the private HA interconnect can invoke sensitive peer operations and obtain full confidentiality, integrity and availability impact on the Edge unit, reflected by a CVSS 4.0 base score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H). No public exploit code has been identified at time of analysis, and the exploitable surface is adjacent-only - it is the HA interconnect segment rather than the routed internet, and units without HA configured are not affected.
Command injection in the gRPC Network Security Interface (gNSI) Credentialz service of Arista EOS allows an authenticated, low-privileged attacker with access to the gRPC management endpoint to send a crafted request that modifies a target account's properties, potentially granting that account elevated privileges or broader access than an administrator intended (CVSS 4.0 base 8.6; assessed CVSS 3.1 8.6, AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N). Exposure is conditional: the device must be running an affected EOS maintenance train (4.30.0F through 4.36.0.1F) with gNSI Credentialz configured, a non-default management feature, and the attacker must already hold authenticated access to that endpoint, making this a privilege-escalation-from-foothold rather than an anonymous remote compromise. A vendor patch is available per the Arista advisory; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is narrower in practice than the raw score suggests because of the configuration prerequisite.
Authorization bypass in GoAdmin through 1.2.26 allows any authenticated user with a valid session (CVSS PR:L - an account on the target instance is required) to reach administrative endpoints by appending a crafted query string containing the configured admin prefix followed by /logout to a request URL; the permission-checking middleware mistakes the request for the exempt logout route and skips authorization entirely. Successful exploitation permits unauthorized reads of sensitive data and modification of application state (C:H/I:H), with no user interaction needed in a default deployment. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis - the issue is tracked as EUVD-2026-81056 and reported by VulnCheck, and no vendor-released patch version is identified in the available data.
Incorrect authorization in Chroma through 1.5.9 allows any authenticated user to read, modify, and update records inside collections belonging to other tenants, simply by issuing requests under their own tenant path while naming a collection identifier that belongs to a foreign tenant. The flaw exists because the collection-resolution path never validates the tenant and database segments, so the co-tenant boundary is effectively absent - this is a real, meaningful risk but bounded by an authentication requirement (PR:L) and by the attacker's need to know or enumerate a valid foreign collection identifier. Exploitation is realistic only in multi-tenant or hosted deployments where mutually untrusted tenants share one instance; no public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was supplied.
Authorization bypass in Rundeck through 6.2.1 lets an authenticated user who holds only the 'import' action on a target project tamper with that project's configuration - including security-relevant settings such as node executors and SSH key paths - by abusing the unauthenticated importConfig and importNodesSources parameters of the project archive import endpoint. The attacker gains no direct code execution, but the rewritten configuration is consumed by later job runs, so the realized impact depends on whether the affected project executes jobs that rely on the tampered executor or SSH settings; the independent assessment rates this as a genuine, moderately-high-priority flaw (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) rather than an inflated score. Exploitation requires valid credentials with the import capability (authenticated, low privilege) and no public exploit has been identified at time of analysis; authentication requirements are confirmed as low-privileged from the CVSS vector (PR:L).
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU utilization, degrading or interrupting traffic handling in an availability-only denial of service. The defect is in the rate-limiting path for syslog message 419002, which is generated at high volume during SYN floods and is not throttled correctly, so the logging/rate-limiting process keeps consuming CPU instead of shedding the excess events. The issue is remotely reachable and unauthenticated (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) and covers a wide installed base of ASA 9.16.x-9.23.x and FTD 7.0.x-7.7.x releases; Cisco rates it 8.6 (scope-changed) whereas our independent assessment rates it 7.5 because impact remains confined to the affected device (S:U) with no confidentiality or integrity loss, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled reload and denying service to everything the appliance protects. The flaw is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 8.6) and triggers during or after the TLS 1.3 handshake, so any TLS 1.3-enabled listening socket reachable by an attacker is a candidate target - including both data-traffic and user-management listeners. Cisco has published an advisory for this issue; no public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, but the low complexity and network reachability required make it a realistic DoS vector against internet-exposed appliances.
Denial of service in Cisco Identity Services Engine (ISE) RADIUS handling allows an unauthenticated, remote attacker to make an affected ISE node unavailable by sending a single crafted RADIUS request directly to the device (CVSS 3.1 8.6, AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H; CWE-119). Every ISE release from 3.2.0 through 3.5 is reported as affected, including numerous 3.2, 3.3 and 3.4 patch levels; no public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing). Impact is availability-only and the node recovers on its own, but in single-node deployments endpoints that have not already authenticated cannot reach the network for the duration of the outage, whereas multi-node clusters limit the blast radius.
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured for certificate-based IKEv2 authentication, causing an unexpected device reload and a denial-of-service condition. Exploitation requires no credentials and no user interaction; the only prerequisite is a specific configuration - IKEv2 VPN with certificate authentication enabled and the IKEv2 listener (typically UDP/500 and UDP/4500) reachable from the attacker's network, which is common on internet-facing VPN concentrators. At time of analysis there is no public exploit identified, no CISA KEV listing, and the issue is availability-only (CVSS 8.6, C:N/I:N/A:H with scope change because the process crash escalates to a full device reload); devices without IKEv2 certificate authentication are not affected.
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) and Cisco Secure Firewall Threat Defense (FTD) software lets an unauthenticated, remote attacker drive an affected appliance toward a denial-of-service condition by sending crafted TLS frames during connection setup. The exposure is broad, covering FMC and FTD builds across the 7.0.x, 7.2.x, 7.3.x, 7.4.x, 7.6.x, 7.7.x and 10.0.x trains, and Cisco rates it 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) while our own assessment scores the same vector with scope unchanged (S:U) as a genuine but bounded availability risk - no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing, so the practical barrier is deployment topology rather than exploit sophistication: an attacker must obtain network reachability to the sftunnel listener on TCP/8305, which normally lives on a restricted management or out-of-band segment shared only between an FMC and its managed FTD devices.
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software on 3100 Series and 4200 Series appliances, where a crafted stream of DTLS traffic causes improper resource management and forces the device to reload. The CVSS 3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), reflecting that no credentials or user interaction are required and that the impact is purely availability, though the scope change acknowledges the disruption extends beyond the vulnerable component itself. At time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, so exploitation requires either opportunistic scanning of exposed DTLS listeners or targeted traffic against internet-facing firewalls.
HPLIP (HP Linux Imaging and Printing Software) is affected by multiple heap-based buffer overflow vulnerabilities (CWE-122) that can lead to remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. Exploitation requires user interaction, such as a victim performing a print or scan operation or processing attacker-supplied imaging data, but no authentication is needed, and the attack is network-reachable. HP has remediated the issues; no public exploit code has been identified at the time of analysis.
Heap-based buffer overflows and related memory-safety flaws in HPLIP (HP Linux Imaging and Printing Software) let remote attackers corrupt memory in the print, scan, and device-discovery stack, potentially yielding remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. Only Linux hosts with HPLIP installed and actively processing attacker-influenced input - a crafted print job, a rogue printer/scanner response, or a file handled by the HPLIP stack - are affected, and exploitation is gated on active user interaction (initiating or accepting the malicious print/scan operation) rather than being a fully autonomous remote exploit. The flaws are unauthenticated per the vendor CVSS vector (PR:N), impact varies depending on which bundled sub-vulnerability is triggered, and no public exploit identified at time of analysis.
Cross-tenant privilege escalation in Shuffle (self-hosted SOAR platform) through version 2.2.1 lets an administrator who holds org-admin rights in any single organization mint and read valid API keys for arbitrary users in other organizations, resulting in full account takeover across tenant boundaries. The flaw is an IDOR/authz bypass (CWE-639) in the HandleApiGeneration endpoint, which accepts a caller-supplied user ID and returns or resets that user's API key without verifying ownership; it is remotely reachable over the network and requires only an authenticated admin account (CVSS:4.0 8.6, PR:L, UI:N, high confidentiality and integrity impact). There is no CISA KEV listing and no public exploit code identified at time of analysis, but exploitation is trivial once any tenant admin account is obtained, and source-verified fix code exists in the upstream shuffle-shared repository.
Authenticated administrators with network reachability to the web management interface of Advantech EKI-1242EIMS and EKI-1242IEIMS devices running firmware V1.06.01 can upload firmware images that the device accepts without any cryptographic signature or certificate verification, resulting in full, persistent compromise of the platform (CWE-345; CVSS 4.0 base 8.6). The risk is genuine but access-gated: the attacker must already hold administrator-level credentials for the management interface (PR:H), so this CVE does not by itself provide a pre-authentication or privilege-escalation path, but the resulting ability to replace device firmware gives durable control over an industrial edge device that may sit on an OT/IT boundary. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways (reported in firmware V1.06.01) allows an attacker holding high-privilege management credentials to run arbitrary operating-system commands as root through crafted request parameters. Exploitation requires network reachability to the device's management plane plus valid privileged authentication (CVSS PR:H), after which a single low-complexity, no-interaction request yields full confidentiality, integrity, and availability impact on the appliance (assessed CVSS 3.1 base 8.8; vendor-published CVSS 4.0 score 8.6). Intelligence sources show no CISA KEV listing and no public exploit identified at time of analysis; the practical gate is that these OT edge devices are normally deployed on segmented industrial networks rather than internet-exposed, making management-plane reachability the limiting factor.
An authenticated file-overwrite vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS (and EKI-1242IEIMS) firmware V1.06.01 allows an attacker who already holds administrative credentials on the device's web management interface to upload a crafted backup archive whose internal file names/paths are not validated, causing arbitrary files on the device filesystem to be overwritten. The result is complete loss of confidentiality, integrity and availability for the device itself (CVSS 4.0 base 8.6; independent assessment CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), making it a genuine but authentication-gated risk in a niche OT/industrial networking device rather than a pre-auth compromise path. Because exploitation requires both network reachability to the management plane and high-privilege authentication (PR:H), realistic exposure is driven by default, weak or reused admin credentials, internet- or flat-network-exposed management interfaces, and any credential compromise on the management VLAN; no public exploit code has been identified and there is no CISA KEV entry for this CVE at time of analysis.
Arbitrary Lua code execution is possible on Advantech EKI-1242EIMS and EKI-1242IEIMS industrial Modbus gateways running firmware V1.06.01, because the Modbus CSV import workflow fails to neutralize code embedded in an uploaded configuration file (CWE-94). Exploitation requires an attacker to already hold a high-privilege authenticated session on the device web management interface and to be able to reach that interface over the network, which materially limits exposure in properly segmented OT environments; no user interaction on the part of a legitimate operator is needed, only the attacker's own crafted upload. Successful exploitation yields full loss of confidentiality, integrity, and availability of the device, but no public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (not listed in CISA KEV); the vulnerability was identified by Nozomi Networks Labs and a vendor security advisory has been published.
OS command injection in the web management interface of the Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways (firmware V1.06.01) lets an attacker who already holds high-privilege administrative credentials send a crafted HTTP request whose unsanitized parameters are passed into an OS command executed as root, yielding full compromise of confidentiality, integrity, and availability of the device. The attack is remote and low-complexity with no user interaction required, but it is access-gated: the CVSS 4.0 vector carries PR:H, so exploitation presupposes valid admin access to the management UI - no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). Risk is materially amplified when the web interface is reachable from untrusted networks and protected only by default or weak credentials, a common condition for field-deployed industrial gateways.
Code injection in the web management interface of Advantech EKI-1242IEIMS (and the closely related EKI-1242EIMS) industrial gateways on firmware V1.06.01 lets a remote attacker who already holds high-privilege web UI credentials execute arbitrary code on the device, including OS commands running as root. Exploitation is low-complexity once the attacker is authenticated, but the admin credential requirement (CVSS PR:H) is a hard gate that limits exposure to devices whose management interfaces are reachable and whose admin accounts have been compromised, reused, or left at weak/default values. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Advantech has published a security advisory for the issue, with Nozomi Networks Labs credited for the discovery. Risk framing: this is a genuine but access-gated risk concentrated on internet- or flat-network-exposed management interfaces rather than on segmented OT deployments.
OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial devices running firmware V1.06.01 lets a remote attacker who already holds a valid authenticated session on the management UI execute arbitrary operating system commands with root privileges through crafted request parameters. The vulnerability (CWE-78), reported by Nozomi Networks Labs, is rated 8.6 under CVSS 4.0 (our independent assessment maps it to 8.8 under CVSS 3.1, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the high PR:H value means the attacker must first authenticate - typically at administrator level - before the injection is reachable. There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is driven less by exploit popularity than by how broadly the device's management plane is exposed to untrusted networks.
Authenticated high-privileged users of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways running firmware V1.06.01 can execute arbitrary operating system commands as root through the device's web management interface, because crafted request parameters reach an OS command without proper neutralization (CWE-78, OS Command Injection). The vendor-assigned CVSS 4.0 score is 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H), reflecting network reachability and complete compromise of the device's confidentiality, integrity and availability with no user interaction, but exploitation deliberately depends on the attacker first holding valid administrative credentials on the management UI. Reported by Nozomi Networks Labs; no public exploit code and no confirmed active exploitation were identified at time of analysis, so the realistic risk is driven by whether the web interface is exposed and how tightly administrative access is controlled.
OS command injection in the web management interface of Advantech EKI-1242IEIMS industrial gateways (firmware V1.06.01) lets a remote authenticated attacker with high privileges execute arbitrary OS commands as root. Exploitation requires a valid high-privilege session (CVSS 4.0 PR:H) and network reachability to the management interface, but then yields full device compromise (VC:H/VI:H/VA:H). No public exploit or active exploitation has been identified at time of analysis.