2026-09-16
Improper validation of parameters in GitLab CE/EE's Terraform state upload functionality allows an authenticated user holding project-level permissions to read restricted file contents on the server or cause denial of service. Affected releases are all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, with fixes published in the 19.3.2 patch release. Public exploit details exist via a HackerOne report, but the CVSS base score is only 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N); there is no CISA KEV listing and no EPSS data was provided.
Authenticated attackers with admin-level access to Synaptik CMS (synaptik-cms) through version 1.3.4.4 can abuse the rename function in admin/file-manager.php to place executable files on the server, bypassing the intended file-type restrictions. Exploitation is remote and requires only administrative privileges (PR:H, UI:N), with limited confidentiality, integrity, and availability impact per the CVSS 4.0 vector scoring 5.1; publicly available exploit code has been published in a GitHub security-research repository, so weaponized use against unpatched instances is plausible. The vendor has released version 1.3.5, which remediates the issue, and no CISA KEV listing or EPSS score was supplied in the source data.
SQL injection in the gedelumbung HospitalManagement application (PHP/CodeIgniter-style MVC codebase) allows an attacker who can reach the patient-index search function to inject arbitrary SQL through the 'cari' argument passed to generate_index_pasien in application/models/app_global_admin_model.php. The flaw is CWE-89, reachable over the network (AV:N, AC:L), but the CVSS 4.0 vector assigns PR:H, indicating exploitation in the intended path requires high-level (administrative) privileges; impact is limited to low confidentiality, integrity and availability (VC:L/VI:L/VA:L). Publicly available exploit code exists, but there is no CISA KEV listing and no confirmed active exploitation; the project uses rolling releases, so no fixed version is identified and the maintainer has not responded to the issue report.
NLnet Labs Unbound 1.20.0 through 1.26.0 can be made to accumulate an unbounded number of pending recursive queries from a single source IP because a double decrement on the per-client 'wait-limit' counter occurs on the 'serve-expired' code path. A remote, unauthenticated attacker who controls an authoritative zone with short TTLs alternates a deliberately unanswered 'slow' query with a 'pump' query for an expired cached name, keeping the counter at or below the configured limit and eventually filling a thread's global mesh quota (num-queries-per-thread), thereby bypassing one of the countermeasures introduced for DNSBomb (CVE-2024-33655). Impact is availability-only and limited (CVSS 3.7, AC:H, A:L) and depends on the non-default 'serve-expired' feature; no public exploit has been identified at time of analysis.
Arista EOS devices configured with SNMPv3 users store the one-way hashed, localized SNMPv3 authentication key inside the running configuration and, notably, inside sanitized configuration exports, so any authenticated user who can read either artifact obtains reusable credential material for that device's SNMP engine. With that material an attacker can issue unauthorized SNMP read operations against MIB tables or inject fraudulent trap notifications into the Network Management System, though there is no configuration-write or availability impact. The vendor discovered the flaw internally, states it is unaware of malicious exploitation in customer networks, and no public exploit code has been identified at time of analysis; the CVSS 3.1 base score is 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), with exploitation gated on SNMPv3 being in use and on the attacker already holding authenticated device access or a leaked sanitized configuration.
Incorrect authorization results in Arista EOS gNMI (gRPC Network Management Interface) can allow an already-authenticated management user to reach resources and operations slightly beyond the permissions assigned to their role. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, score 4.2), exploitation requires the gNMI interface to be enabled and reachable plus a valid account with at least some gNMI access, and success depends on specific role/permission configurations - a high-complexity, low-impact condition rather than a remote unauthenticated bypass. There is no public exploit identified at time of analysis, no CISA KEV listing, and Arista states the issue was found internally with no known malicious use in customer networks.