2026-09-16
Command injection in SSH.NET's ScpClient (Renci.SshNet, all releases prior to 2026.0.0) lets a remote attacker who can influence the remote path supplied by a calling application execute arbitrary commands as the authenticated SSH user on a shell-based server. The default RemotePathTransformation.DoubleQuote cannot safely quote every remote command interpreter, so shell metacharacters that survive the transformation are parsed by the server's shell when the scp command line is assembled. Exploitation is conditional rather than automatic: the target must be a shell-based SSH server and the path must be crafted for that shell's parsing rules, and the assessed vector (AV:N/AC:H/PR:L/UI:N) requires an authenticated SSH session; no public exploit code or active exploitation has been identified at time of analysis, and applications using SftpClient, non-shell-based servers, or fully neutralizing transformations such as ShellQuote against POSIX shells are not affected.
Unauthenticated remote attackers can terminate the Control iD iDSecure service by sending a single HTTP request to the /api/dguardintegration/dguardVersion endpoint, knocking the system offline until the process is restarted. All iDSecure builds prior to 4.8.3.0 are affected; the crash occurs when the DGuard integration login state is unset and an unhandled null-reference exception escapes from a fire-and-forget asynchronous routine. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms a pure availability impact with no credentials or user interaction required; no public exploit code and no confirmed in-the-wild exploitation were identified at time of analysis, and the vendor has released a fix.
Unauthenticated repeated calls to the license-restart API in Control iD iDSecure versions prior to 4.8.3.0 allow any network-reachable attacker to hold the service in a continuous restart cycle, rendering the application unavailable. The exposed /api/license/restartService endpoint requires no credentials, no user interaction, and no non-default configuration to reach, and CVSS 3.1 scores the flaw 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with high availability impact while confidentiality and integrity remain unaffected. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV), though the single-request nature of the technique makes it straightforward to reproduce wherever the management interface is exposed; the practical limiting factor is network reachability of the iDSecure HTTP API.
Unauthenticated remote memory exhaustion in Keycloak's theme localization endpoints allows any network-reachable attacker to crash the server by flooding the keycloak-services component with unique locale tags, each of which is retained indefinitely in an unbounded in-memory cache. The flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments where those endpoints are exposed to untrusted networks, and requires no credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5, CWE-400). Impact is availability-only with no data disclosure or integrity compromise, and no public exploit code has been identified at time of analysis, nor is there confirmed active exploitation (CISA KEV).
Native memory exhaustion in Keycloak's SAML Redirect Binding allows an unauthenticated remote attacker to degrade or halt the service by repeatedly sending malformed SAML requests that leak zlib-allocated native memory. Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and the Red Hat JBoss EAP Expansion Pack are all affected because they embed the same SAML handling code. There is no public exploit identified at time of analysis, and the assessed impact is availability-only (CVSS 7.5, C:N/I:N/A:H), consistent with a genuine but bounded denial-of-service condition; vendor errata (RHSA-2026:68276 through RHSA-2026:68280) address the flaw.
Unbounded memory growth in the stateful Streamable HTTP transport of the rmcp Rust SDK (crates/rmcp, all versions prior to 2.0.0) lets remote, unauthenticated attackers permanently leak session state and eventually crash the server. A crafted JSON-RPC POST that is either not an initialization request, or an initialization request whose MCP-Protocol-Version header disagrees with its body, causes StreamableHttpService::handle_post to call LocalSessionManager.create_session before the message is validated; when validation then fails, the handler returns without removing the inserted LocalSessionHandle, so each request leaves a permanent entry in the shared session table. Because exploitation requires sustained repetition to exhaust memory and degrade legitimate clients through lock contention, CISA SSVC rates it PoC-exploitable but not automatable, while publicly available exploit code exists and CVSS 3.1 scores it 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with availability as the only impacted security property.
Remote, unauthenticated denial of service affects react/http versions 0.6.0 through 1.11.0, where a malformed Transfer-Encoding: chunked body can trap React\Http\Io\ChunkedDecoder in a non-terminating loop; because ReactPHP is single-threaded and event-loop driven, one looping body halts the entire process rather than a single request. The decoder is used for inbound request bodies in React\Http\HttpServer and outbound response bodies in React\Http\Browser, so a malicious client can freeze a server and a malicious or compromised upstream server can freeze a client. No public exploit identified at time of analysis; a vendor-released patch exists in version 1.11.1.
Denial of service in ISC BIND 9 recursive resolvers affects versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the subscription builds 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1. A validating resolver can be crashed when an authoritative server it queries returns a valid wildcard answer with a signed NSEC3 proof immediately followed by an unsigned NSEC record at the same owner name, causing an unexpected program exit via a reachable assertion (CWE-617). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this 7.5, availability-only, and exploitation requires the attacker to control or be on-path to the authoritative server answering the resolver's query, so an arbitrary external client cannot trigger the crash by sending queries alone; no public exploit code or CISA KEV entry was identified at time of analysis.
Denial of service in ISC BIND 9 allows a remote, unauthenticated attacker to terminate the named daemon by sending a single DNS query of QTYPE TKEY, causing an assertion failure and unexpected process exit, but only on servers loaded with a named.conf file that contains no global 'options' block. Affected builds are 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1; the CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting availability-only impact with no confidentiality or integrity loss. The prerequisite configuration (missing global options block) is uncommon in production deployments, which meaningfully limits real-world exposure; no public exploit code and no confirmed active exploitation were identified at the time of analysis, though the trigger is trivial to send for anyone who can reach the resolver or authoritative port.
Denial of service in ISC BIND 9 allows remote, unauthenticated attackers to terminate the named resolver process when it processes a specifically malformed answer that interacts with the DNS64 synthesis feature. Only resolvers explicitly configured with the dns64 option are affected - a non-default, opt-in capability - but for those systems any client of the resolver loses name resolution when named exits. The bug is a use-after-free (CWE-416) reachable from the network with low complexity (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), affecting BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the corresponding -S1 subscription builds. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation; vendor patches are available as BIND 9.20.29 and 9.21.26.
Resource exhaustion in ISC BIND 9 recursive resolvers allows unauthenticated remote attackers to cause a denial of service by repeatedly triggering a memory leak through crafted SVCB/HTTPS AliasMode records that reference 14 or more ServiceMode records. Affected versions include 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and corresponding -S1 subscription builds; patched versions are 9.20.29 and 9.21.26. No public exploit code has been identified at time of analysis, but the vulnerability is remotely exploitable without authentication and can gradually exhaust resolver resources, disrupting recursive lookups.
Unauthenticated remote attackers can abort the `named` process in BIND 9 by sending a crafted DNS-over-HTTPS request that carries a cryptographically invalid SIG(0) record and then prematurely closing the transport connection, producing a null pointer dereference (CWE-476) that terminates the server. Affected versions are 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the 9.20.9-S1 through 9.20.27-S1 subscription branch; the assessed CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), meaning no authentication or user interaction and availability-only impact. Exploitation requires the targeted named instance to have the DoH transport enabled and to process SIG(0)-signed messages, so server deployments without DoH exposed to the attacker have no reachable attack surface; impact is limited to a process abort with no data disclosure or modification. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available (9.20.29 and 9.21.26).
Remote denial of service in ISC BIND 9 lets an attacker-controlled (or spoofing-capable) authoritative DNS server crash a recursive resolver by returning a negative answer of exactly 65536 bytes, which `named` caches as a zero-length entry and later aborts on when the entry is read. The flaw affects 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the corresponding -S1 subscription releases, requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and is present in default configurations, though reachability is limited to resolvers that actually recurse against attacker-influenced or spoofable zones and then read the poisoned cache entry. Vendor patches are available (9.20.29 and 9.21.26); no public exploit identified at time of analysis, and the impact is availability-only with no confidentiality or integrity loss.
CPU-exhaustion denial of service in ISC BIND 9 recursive resolvers (9.18.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25, plus the 9.18.11-S1-9.18.50-S1 and 9.20.9-S1-9.20.27-S1 preview builds) can be triggered by a single remote, unauthenticated query for the root of an already-cached tree of SVCB/HTTPS AliasMode records. Once such an AliasMode chain is resident in the resolver cache, the triggering query causes the resolver to spend disproportionate CPU time constructing the response, degrading or stalling name resolution for all clients of that resolver; impact is availability-only with no confidentiality or integrity effect. The assessed CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is well calibrated, but exploitation is conditional on the attacker first causing the SVCB/HTTPS AliasMode tree to be resolved and cached (for example from an attacker-controlled zone) before issuing the trigger query; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Double free in the Linux kernel's NVMe-over-Fabrics Fibre Channel (nvme-fc) transport lets a privileged local user corrupt kernel memory when an nvme-fc controller creation attempt fails. The bug lives on an error path: nvme_fc_init_ctrl() jumps to out_put_ctrl: when nvme_add_ctrl() fails (reached when dev_set_name() cannot allocate memory), bypassing the pointer clear that nvme_fc_ctrl_free() relies on, so the transport frees the fabrics options and nvmf_create_ctrl() frees them a second time - KASAN reports a slab-use-after-free in nvmf_free_options(). Introduced by commit 1a9e218195a5 and present in kernels from 6.11 through the fixed stable releases, exploitation requires root/CAP_SYS_ADMIN, the non-default nvme-fc transport, and a narrow allocation-failure window (memory pressure or kernel fault injection); no public exploit identified at time of analysis, and the assessment rates availability impact high with confidentiality and integrity impact none.
Linux kernel NVMe zoned-block setup can be forced into an inconsistent state in which a zoned queue is committed with a zero zone size, causing a shift-out-of-bounds (ilog2(0)) and a kernel-side denial of service on the storage I/O path. The flaw affects Linux 6.9 and later kernels with NVMe ZNS support when a zoned namespace's device, firmware, or an attacker-controlled NVMe-oF target answers the Identify Namespace (I/O Command Set specific) or nvme_set_max_append() Identify Controller command with a POSITIVE NVMe status code rather than a negative errno; this requires a host administrator to have attached that device or target, giving an assessed vector of AV:N/AC:H/PR:H/UI:N with high availability impact only. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis; the issue was discovered by the FuzzNvme fuzzer, and the impact is availability/integrity of the block layer rather than memory corruption or remote code execution.
Remote, unauthenticated denial of service in the Linux kernel's NVMe-over-TCP target (nvmet-tcp) lets a permitted host wedge the target workqueue by racing an unsolicited H2CData PDU ahead of the target's Ready-to-Transfer message. A write command that takes the R2T path is completed twice, causing a response-list entry to point to itself and, depending on CONFIG_DEBUG_LIST, triggering a kernel BUG or an infinite loop/soft-lockup in the nvmet_tcp workqueue. Only hosts configured as NVMe/TCP targets (particularly subsystems using allow_any_host) are affected; no public exploit code has been identified at time of analysis, and the assessed CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
A race condition in the Linux kernel's HDMI-CEC subsystem (media: cec) lets a local user who can open a CEC adapter character device (/dev/cecN) and register as an exclusive follower race message delivery against follower mode changes or adapter release, reading the follower pointer without the adapter lock and creating a window that can corrupt kernel state or leak data. The assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H) confirms this is a local, low-privilege issue requiring an actual CEC-capable adapter and precise timing, not the remote/unauthenticated scenario implied by the vendor's AV:A/PR:N score. No public exploit code and no confirmed active exploitation were identified at time of analysis; vendor patches are available across the maintained stable branches.
Kernel crash (NULL pointer dereference) in the Linux kernel's qla2xxx QLogic Fibre Channel HBA driver, in the EDIF (encrypted FC / FC security) RX security-association delete check, allowing a host using that driver and feature to be taken down by a kernel oops in interrupt context. Only systems with a QLogic FC adapter, the qla2xxx driver loaded, and EDIF/FC-SP encryption in use are exposed; the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (integrity and confidentiality unaffected, availability high), which is considerably narrower than the vendor's published AV:N/AC:L/PR:N rating and reflects that triggering the fault depends on a driver-internal abort/return timing race rather than remotely supplied network input. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); vendor patches are already released for the affected stable branches.
Signature forgery in Sequoia OpenPGP (sequoia-openpgp) stems from incorrect key-flag inference for legacy OpenPGP certificates that lack a key-flags subpacket, letting an unauthenticated remote attacker bypass the back-signature check and bind an arbitrary subkey to their own certificate. This compromises cryptographic integrity for any application that uses the library to verify untrusted certificates, although exploitation requires the victim to process a crafted certificate (UI:R). No public exploit code or CISA KEV entry was identified in the provided data.
Unauthenticated remote attackers can read live Django view and session state and invoke server-side handlers through djust's observability endpoints when a deployment leaves DEBUG enabled and omits the optional localhost-restriction middleware. The exposure requires that specific documented-but-misconfigured combination, which is why the assessed base score of 7.4 carries AC:H despite being network-reachable with PR:N - the endpoints themselves enforced only DEBUG prior to version 1.0.7. No public exploit code has been identified at time of analysis, and the flaw (CWE-306, missing authentication for critical function) is fully neutralized by upgrading to 1.0.7, by setting DEBUG=False, or by installing the localhost-gating middleware.
Stored cross-site scripting in Concrete CMS before 9.5.4 allows an attacker to upload a plain XML document through a publicly reachable Form Block file-upload question; because uploads were validated by extension only and stored as inline-served, same-origin files, the XML can carry an xml-stylesheet processing instruction pointing at an attacker-controlled XSLT stylesheet. When a victim opens the stored file's URL directly in a browser, the stylesheet transforms the document into HTML and runs attacker JavaScript in the Concrete CMS origin - and if that victim is an authenticated administrator, the script acts with the admin session (the reporter demonstrated creating a new user in the Administrators group). Exploitation is conditional rather than opportunistic: the site must expose a file-upload Form Block question and the victim must be lured into opening the hostile file, and no public exploit code was identified at time of analysis; the flaw is fixed in 9.5.4.
Local privilege escalation in the Dell Update Package (DUP) Framework (versions prior to 26.07.03) allows an attacker who already holds low-privileged access on a host to inject operating system commands that execute in the elevated context of the update framework, resulting in high impact to confidentiality, integrity and availability. Exploitation also requires user interaction - a trusted user or an automated process must actually run a Dell Update Package - as reflected in the assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (7.3 High), which is local-only and carries no network vector. There is no public exploit identified at time of analysis, and Dell has published a fixed release (26.07.03) in advisory DSA-2026-417.
Uninitialized stack memory in the Linux kernel's LoongArch KVM DMSINTC interrupt-injection path can let a local user who is able to create or control a KVM virtual machine - or code running inside a guest - have non-deterministic stack contents consumed while injecting a dynamic message-signaled interrupt. The vendor rates this 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), while our independent assessment keeps the local, low-privilege, scope-changing profile but lowers the impact components to C:L/I:L/A:L because the leaked data is not reliably attacker-controlled; the affected surface is limited to LoongArch hosts with KVM enabled and DMSINTC in use. Vendor fixes are available as upstream stable commits, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated stored cross-site scripting in the WP-Lister Lite for eBay WordPress plugin affects every release up to and including 3.8.9, allowing an attacker to inject arbitrary JavaScript through the plugin's AJAX cron handler request parameter because input is not sanitized and output is not escaped. The injected payload is persisted and executes in the browser of any user — including administrators — who later views the affected page, enabling session theft, credential harvesting, or full site takeover via an admin session. No public exploit code has been identified and the flaw is not listed in CISA KEV, but the unauthenticated network-reachable attack path makes it a realistic target for automated scanning; an upstream fix was committed in WordPress.org plugin changeset 3638342.
Authenticated attackers holding a default 'User' role account on Scirius 3.8.0 and earlier can write attacker-controlled JSON files to arbitrary filesystem paths through the PCAP filestore upload endpoint, which derives the destination filename from a user-supplied document _id field. Scored 7.2 both under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N) and CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), the flaw delivers high integrity and availability impact with no confidentiality loss, and because files are written with a forced .json extension the damage comes from poisoning JSON configuration data or consuming disk rather than planting executable code; if the Scirius service runs as root, writes can land in privileged locations. Exploitation requires network reachability to the upload endpoint plus a low-privileged authenticated account (no user interaction), and no public exploit code was identified at time of analysis, with no CISA KEV listing and no EPSS signal provided in the available data.
Privilege escalation in Red Hat Build of Keycloak allows an account already holding the realm 'impersonation' role to impersonate a realm administrator and thereby seize full administrative control over that realm, including management of users, clients, and roles. Affected builds are 26.4 before 26.4.16 and 26.6 before 26.6.7. This is an access-gated issue rather than a pre-authentication takeover: the CVSS vector (PR:H) confirms the attacker must be an authenticated, privileged sub-administrator or holder of a compromised delegated-admin credential before exploitation is possible, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
QDomDocument, Qt's DOM-based XML parser, crashes when processing maliciously crafted XML with extreme element nesting depth, exploiting uncontrolled recursion (CWE-674) to exhaust the call stack and terminate the host application. Any Qt-based application that passes attacker-influenced content to QDomDocument is affected across the Qt version range identified by cpe:2.3:a:qt:qt:*. No public exploit or active exploitation has been identified at time of analysis; the Qt Project has issued a patch via its code review platform.
The @jitsi/electron-sdk package before 10.0.5 bridges the getDesktopSources() API into the meeting page and lets any script running there invoke the jitsi-screen-sharing-get-sources IPC route to pull desktop thumbnails of every screen and window, without a getDisplayMedia() picker being open and without any OS-level screen-recording permission prompt or user consent. The flaw (CWE-862, missing authorization) affects the Jitsi Meet Electron desktop client and any application embedding the SDK, and it is reachable unauthenticated from inside a meeting by a malicious participant or injected script. The vendor fix is a merged upstream PR (PR #516) shipping in 10.0.5; no public exploit code or CISA KEV listing was identified at time of analysis.
Improper validation of parameters in GitLab CE/EE's Terraform state upload functionality allows an authenticated user holding project-level permissions to read restricted file contents on the server or cause denial of service. Affected releases are all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, with fixes published in the 19.3.2 patch release. Public exploit details exist via a HackerOne report, but the CVSS base score is only 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N); there is no CISA KEV listing and no EPSS data was provided.
Premature expiry of multicast forwarding state in Arista EOS can be triggered by a specially crafted packet sent by an unauthenticated attacker who is positioned on the same Layer 2 or otherwise adjacent network segment, causing temporary loss of multicast traffic on the affected interfaces. This is an availability-only denial of service (CVSS 4.0 reports VA:H with VC:N/VI:N; the CVSS 3.1 assessment is AV:A/AC:L/PR:N/UI:N with impact limited to A:H), so the 'Information Disclosure' tag attached to the record does not reflect the actual impact. Exploitation additionally requires that multicast forwarding (PIM/IGMP) is actively configured on the targeted interface - a default, non-multicast deployment is not exposed - and the disruption is transient, since traffic resumes once forwarding state is rebuilt. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Out-of-bounds reads in the Linux kernel's ksmbd in-kernel SMB3 server can leak kernel memory or crash the system when a local low-privileged attacker can influence the netlink IPC share-configuration response produced by the userspace ksmbd.mountd daemon. The flaw lies in unvalidated variable-length share-config fields - an over-long veto list and a path length that fails to account for the separator byte - and affects kernel series where the fix boundaries listed by EUVD are 5.16, 6.2, 6.7, and 6.9, plus the 7.2.6/7.3-rc2 lines. It is not confirmed actively exploited, no public exploit code has been identified at time of analysis, and EPSS is low at 0.19% (9th percentile); a vendor patch is available. Impact is bounded by the fact that ksmbd is non-default on most distributions (which ship userspace Samba) and the vector is local (AV:L) with low privileges (PR:L) and no user interaction.
Malformed IGMP packets sent by a network-adjacent, unauthenticated attacker can terminate the IGMP snooping agent on Arista EOS switches, causing multicast traffic to flood to all ports of the affected VLAN until the agent recovers. Because IGMP snooping is enabled by default on all VLANs in EOS, most deployments are exposed out of the box, but the attacker needs Layer 2 adjacency to a target VLAN (a compromised host, rogue device, or insider on the switched segment) rather than arbitrary internet reachability, and the impact is a bounded, self-recovering availability disruption that must be repeatedly triggered to be prolonged. No public exploit code and no confirmed active exploitation were identified at time of analysis; the realistic risk is a genuine but non-critical availability concern rather than a priority-one emergency.
Denial of service in Open5GS up to and including 2.8.0: a crafted PFCP message that declares a Volume Measurement information element shorter than the fields the parser actually reads causes a null pointer dereference in ogs_pfcp_parse_volume_measurement in lib/pfcp/types.c, aborting the affected SMF/UPF process and disrupting the 5G core user-plane control path. The attack is launched remotely by sending malformed PFCP signaling to the N4 interface, which in a correctly segmented deployment is an internal control-plane segment rather than an internet-facing service; the vendor's CVSS 4.0 vector scores it 7.1 with PR:L, while our independent assessment scores 7.5 (CVSS 3.1, AV:N/AC:L/PR:N/UI:N, availability-only impact) because Open5GS's PFCP implementation does not enforce authentication. An upstream fix commit (8f07b507b78ff94776f2cd49276eb116ed93d7f2) is published, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Broken object-level authorization in DFIR-IRIS (iris-web) through 2.4.29 lets an authenticated user who has legitimate access to just one case read comment threads belonging to cases they are not authorized to see, by enumerating sequential object identifiers against the comment-listing endpoints for notes, tasks, IOCs, assets, and evidence items. The flaw is a classic IDOR (CWE-639) with confidentiality-only impact: the attacker can read but not modify or delete data, and exploitation requires a valid session with PR:L privileges - it cannot be triggered by an unauthenticated outsider. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, though the sequential IDs make the attack trivial to automate for anyone holding a low-privileged account in a multi-case deployment.
Authorization bypass in ContiNew Admin through 4.1.0 allows any authenticated user to delete other users' personal messages and announcements by submitting arbitrary identifiers in the IdsReq parameter to the personal message delete endpoint in UserMessageController. Because the pre-patch MessageServiceImpl.delete() called baseMapper.deleteByIds(ids) without verifying ownership, the attacker can remove any message row and also purge all recipients' read receipts for those messages. Impact is integrity-only (CVSS 3.1 assessed: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N; vendor-published CVSS 4.0 score 7.1, VI:H), requiring only a valid low-privileged account with no admin role and no user interaction; no public exploit code was identified at time of analysis.
Authenticated users of TDuck Survey Form through version 5.3 can hijack forms they do not own and redirect their submissions to arbitrary destinations, because WebhookConfigController enforces neither a form-ownership check nor any validation of the webhook URL. The result is a chained broken-access-control/IDOR plus server-side request forgery issue: a low-privilege account can point a victim's webhook at an external collector to exfiltrate form data, or at internal-only addresses to make the TDuck server issue requests on the attacker's behalf, producing high confidentiality impact with only limited integrity impact. Exploitation needs only a valid authenticated session (remote, no victim interaction beyond normal form submissions, no non-default configuration), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Improper access control in stylefeng Guns through 8.3.5 lets any authenticated user, even one with no assigned roles, create, edit, delete, publish, and retract system-wide notices via SysNoticeController actions that never require a permission. The issue is remotely exploitable with low privileges and high integrity impact but no confidentiality or availability impact; no public exploit code has been identified at time of analysis, and authentication is required (PR:L) because the attacker must already have a valid Guns session.
Missing authorization in the Guns Java rapid-development framework (through 8.3.5) allows any authenticated user to harvest the full user directory, including account names, real names, email addresses, phone numbers, last-login IPs and role assignments. The /sysUser/detail and /sysUser/page handlers in SysUserController omit the requiredPermission annotation, so the TokenAndPermissionInterceptor performs no RBAC check on them and returns data for every user in the system to anyone holding a valid login token. The attack is network-reachable and needs only a low-privileged authenticated session (PR:L), with no user interaction and no administrative rights; no public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was supplied in the source data.
reNgine through 2.2.0 allows any authenticated user, including low-privilege Auditor accounts, to read bundled recon-tool configuration files through the GetFileContents API endpoint without role-based permission checks. Those files can contain third-party API keys for SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge, and Hunter, making this an information-disclosure issue rather than remote code execution. No public exploit identified at time of analysis, and successful exploitation requires an authenticated account plus configured integrations to expose meaningful secrets.
This is a genuine but bounded-priority integrity flaw: in TDuck Survey Form through version 5.0, any authenticated low-privilege user can overwrite other respondents stored form submissions by calling POST /user/form/data/update with a submission identifier that does not belong to them, because the endpoint performs no ownership validation (CWE-639). Confidentiality and availability are unaffected, so the realistic impact is corruption or falsification of collected survey data, including responses containing personal information, rather than data theft or denial of service. Exploitation requires only a valid account (authenticated, PR:L) with no admin role, user interaction, or non-default configuration, and it is aided by submission identifiers being allocated in narrow, guessable ranges; no public exploit code has been identified at time of analysis and the issue is not reported as actively exploited.
Session pool exhaustion in the OPC UA gateway of Advantech EKI-1242EIMS and EKI-1242IEIMS industrial switches running firmware V1.06.01 lets an unauthenticated attacker on an adjacent network segment open multiple anonymous OPC UA sessions and consume the entire server session pool, causing a complete denial of service for all legitimate OPC UA clients. The impact is availability-only (no data read or modified, other device functions unaffected) and is bounded by the adjacency requirement plus the need for the OPC UA gateway to be enabled and to accept anonymous sessions, matching the reported CVSS 7.1 (CVSS 4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) and the independently assessed CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. There is no CISA KEV listing and no public exploit identified at time of analysis; the finding is credited to Nozomi Networks Labs.
WNC's T-Mobile 5G Box IDU router (firmware versions below 1.1.0.651412) exposes the wnc_maccheck.cgi endpoint without any authentication, letting a device on the same network segment read sensitive configuration data - including the administrator web password and the WiFi passphrase. Exploitation requires network adjacency (CVSS AV:A) such as a rogue or legitimate WiFi client or a wired LAN host; it is not reachable over the internet by default, but no credentials or user interaction are needed once that position is obtained. The result is a direct path to full administrative takeover of the router, which is why the assessed confidentiality impact is high despite the bounded attack surface. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available.
A 1-2 byte out-of-bounds read in the Linux kernel's rtl8723bs staging Wi-Fi driver (rtw_action_frame_parse) lets a local attacker who can inject 802.11 management action frames cause a kernel fault, with practical impact typically limited to a crash when the read crosses a page boundary. The vendor assigned CVSS 7.1 (AV:A/AC:L/PR:N), but our independent assessment rates it CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L because exploitation requires the rtl8723bs driver to be loaded and bound to Realtek RTL8723BS hardware plus local interface access (typically CAP_NET_ADMIN) to reach the cfg80211 mgmt_tx path or a monitor-mode interface. No public exploit code identified at time of analysis, and this is not confirmed actively exploited (CISA KEV); vendor-released patches exist for the affected stable branches.
A one-byte out-of-bounds read in the rtl8723bs staging WiFi driver lets an unauthenticated attacker within radio range (adjacent network) trigger a kernel memory overread while the driver parses scan or association Information Element data, with realistic worst-case impact of a kernel crash or denial of service rather than leaked data. The flaw affects Linux kernels that carry the rtl8723bs staging driver from v4.12 onward through the fixed releases 6.18.52, 7.2.5 and 7.3-rc2 (plus mainline commit 4420cc71841b50e31a7868ef7acb011c0e08d294), and the vendor scores it 7.1 while our independent assessment places it lower (AV:A, PR:N, UI:N, availability-only, low). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and vendor-released patches are available.
An integer overflow in KVM's x86 Hyper-V synthetic timer emulation (stimer_start(), which computes a 100ns-tick deadline using ktime_add_ns(ktime_now, 100 * (stimer->exp_time - time_now))) allows a guest or userspace VMM to program a STIMERi deadline that wraps into the past, causing the vCPU to spin through an immediate hrtimer re-arm / KVM_REQ_HV_STIMER request cycle without ever disabling the timer. The result is a host CPU livelock that starves RCU grace-period kthreads and produces the RCU stall and eventual OOM condition reported by syzkaller. Exploitation requires a KVM x86 host running a guest with Hyper-V enlightenments and SynIC synthetic timers exposed, and control over the guest's WRMSR (HV_X64_MSR_STIMERi_CONFIG/COUNT) or KVM_SET_MSRS writes; the assessed vector is local, PR:L, availability-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, 7.1), with no public exploit identified at time of analysis and no CISA KEV listing.
Linux kernel KVM/arm64 hosts that emulate a vGIC ITS can be crashed with a host kernel NULL-pointer dereference when a guest issues the crafted ITS command sequence MAPD, MAPTI, then MAPC with V=0 and the VMM subsequently performs an ITS table save (KVM_DEV_ARM_ITS_SAVE_TABLES, as used for live migration or snapshotting). Exploitation requires arm64 KVM virtualization with the in-kernel GICv3 ITS, an attacker able to run a guest at guest/tenant privilege (authenticated, PR:L in the assessed vector), and - critically - a host-initiated migration or save operation, since the fault is latent in guest state until the VMM touches the tables. The result is a host-wide denial of service affecting all guests on the machine; no public exploit code has been identified at time of analysis, and the review confirms this is a bounded availability issue rather than a broadly exploitable priority bug.
Local low-privilege users on systems running the F2FS filesystem can trigger an integer overflow in the F2FS_IOC_MOVE_RANGE ioctl, extending a destination file's size without proper bounds checking and potentially corrupting filesystem integrity. The flaw affects Linux kernel versions from 4.8 up to the fix commits, including distributions using F2FS on Android and embedded flash storage; exploitation requires a crafted source file with a hole and the ability to issue the ioctl, and no public exploit has been identified. This is a local integrity and availability issue, not remotely exploitable.
F2FS recovery logging in the Linux kernel can read past the fixed-size, non-NUL-terminated i_name buffer and expose adjacent raw inode fields into kernel logs when a crafted or corrupted f2fs filesystem is mounted. The flaw has been present since Linux 3.11 and is reachable only via the roll-forward recovery path that processes fsync'd dentries left pending after an unclean shutdown, requiring a filename that fills the full F2FS_NAME_LEN (255 bytes); our independent assessment rates this LOW real-world risk (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) because it needs local mount capability (CAP_SYS_ADMIN or equivalent) and the leaked bytes are confined to raw inode fields in the same block buffer. This is not remote and no public exploit code has been identified at time of analysis; vendor fixes are available upstream (present in Linux 7.2.5 and 7.3-rc1 per the EUVD version mapping).
The Linux kernel's Panthor DRM driver for ARM Mali CSF-based GPUs (Mali-G310/G510/G610/G710/G720 class hardware) fails to safely validate the build-info metadata block it parses out of the loaded firmware image: panthor_fw_read_build_info() adds the u32 header fields hdr.meta_start and hdr.meta_size without overflow protection, reads the "git_sha: " prefix without first confirming the metadata is long enough, and can underflow the trailing NULL terminator index when meta_size is zero. An attacker who can supply or influence the firmware blob can therefore make malformed metadata pass validation and drive out-of-bounds reads, yielding information disclosure and potential availability impact on the GPU/driver. Exploitation is local and privileged (CVSS PR:H, i.e. authenticated with high privileges) and requires a system with Panthor active and Mali CSF hardware; default vendor-signed firmware is unaffected, and the independent assessment rates the realistic severity far below the vendor's 7.1 as CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV; vendor fixes are shipped in Linux 6.18.51, 7.2.5 and 7.3-rc1.