Heap-based buffer overflow in the IBM MQ C client shipped with IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 lets a remote attacker who controls the queue manager's responses crash the client process or potentially execute arbitrary code in its context (CVSS 3.1 base 8.1). The flaw is triggered when the client requests AMS (Advanced Message Security) policy data and the client fails to properly validate the returned queue manager response; exploitation is unauthenticated from the client side (PR:N) but requires the attacker to operate a malicious or compromised queue manager or to man-in-the-middle the client-to-queue-manager channel, which is why the vector carries AC:H. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
Bransys ELD ships with hardcoded MQTT credentials that grant read access to real-time telemetry for active devices across a subset of carriers whose hardware was provisioned against the affected MQTT broker. An unauthenticated remote attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) who can reach that broker and recover the embedded credentials from firmware or client software can subscribe and read live operational data; impact is confidentiality-only (C:H/I:N/A:N) and is scoped to devices on that specific broker, not all Bransys customers. Reported through CISA ICS channels as ICSA-26-260-01, the exposure is rated 5.9 by both the vendor score and independent assessment; at time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit identified.
Improper validation of message header offset values in IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 allows an authenticated MQ user with network reach to an affected queue manager to trigger an out-of-bounds read, which can leak queue manager memory (high confidentiality impact) and crash the broker (high availability impact), yielding a CVSS 3.1 score of 8.1. Exploitation requires valid credentials - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - but no user interaction, and the requirement for authentication rules out anonymous abuse while the flaw is confined to the HPE NonStop platform port rather than all MQ deployments. No public exploit identified at time of analysis; a vendor patch is referenced in IBM's advisory.
Cross-site scripting in IBM Guardium Data Protection 12.2 lets a remote attacker who can reach the web management interface place script into an input that the application reflects into a generated page without output encoding, so JavaScript runs in the browser of any user who views that page. The vendor describes this as arbitrary code execution and scores it 8.1, but the weakness class is CWE-79 rather than a server-side code-execution primitive; our independent assessment rates it materially lower (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) because realistic exploitation needs a low-privileged foothold plus a victim with console access loading the crafted page, bounding impact to that user's session. No public exploit code was identified at time of analysis, and the issue is not listed in CISA KEV. Treat this as a high-CVSS-but-likely-overstated finding centered on console session abuse rather than host compromise.
Unauthenticated OS command injection in IBM Guardium Data Protection 12.2 allows a remote attacker with network reachability to a vulnerable appliance component to execute arbitrary operating system commands, yielding full confidentiality, integrity, and availability impact on the affected system. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1 High) confirms no authentication or user interaction is required, though the AC:H rating indicates exploitation depends on a precondition not fully specified by IBM rather than being reliably repeatable against any default install. No public exploit code or confirmed active exploitation was identified at time of analysis, but real-world risk is elevated because Guardium is a security-data platform that frequently holds sensitive audit and database activity records, and successful exploitation effectively equates to remote code execution on the appliance.
Authenticated users of LubeLogger prior to 1.6.8 - including non-administrative accounts - can abuse the translation file upload path to place or overwrite files outside the intended storage directory, because the RenameFile helper constructs the destination path by string replacement without verifying that the resolved absolute path remains under the web root or data directory. Exploitation requires only a valid low-privileged session and a crafted upload file name, giving the attacker the file-system rights of the application process, which is why the assessed impact is high integrity with limited availability and no confidentiality component. Vendor-released patch: 1.6.8; no public exploit identified at time of analysis.
OS command injection in IBM Guardium Data Protection 12.2 allows a remote, unauthenticated attacker to execute arbitrary operating system commands on the affected appliance, giving full compromise of confidentiality, integrity, and availability (CVSS 8.1, CWE-78). The assessed vector (AV:N/AC:H/PR:N/UI:N) means no credentials and no user interaction are needed, but exploitation is not a single deterministic request - the attacker must first satisfy a specific precondition such as a crafted payload meeting input constraints or a particular application/timing state, and the target's vulnerable network service must be reachable, which is uncommon for a security-monitoring appliance that is typically segmented. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available per the referenced IBM support advisory.
An external control of file name or path flaw in the Synology DiskStation Manager (DSM) Upload API allows remote authenticated users to write files to arbitrary locations on the appliance, which can be leveraged for data integrity tampering and denial-of-service against the NAS. The defect is reachable over the network with low attack complexity and no user interaction, but it requires a valid DSM account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1 High), so practical exposure is concentrated on low-privilege or compromised accounts and on DSM instances whose login interface faces untrusted networks. Affected builds are DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation. The dual integrity-and-availability impact, with no confidentiality effect, is what drives the High severity rating.
An authorization bypass in the Master Addons for Elementor WordPress plugin (all versions up to and including 3.2.2) lets any authenticated user with Contributor-level access or above rename, alter metadata on, or permanently delete arbitrary posts on the site. The flaw is a missing authorization check (CWE-862) in the plugin's popup-builder admin code: because the jltma_popup custom post type is registered with capability_type='post', Contributors can reach the edit-jltma_popup screen, harvest the nonce emitted there, and supply an attacker-controlled popup_id to reach posts they do not own. Exploitation requires an authenticated low-privilege account and no user interaction (CVSS 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H); no public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is a genuine priority for affected sites rather than a mass-exploitation emergency - exposure concentrates on sites with open registration or multiple untrusted authors.
Authorization bypass in IBM Guardium Data Protection 12.2 lets remote, unauthenticated network attackers (CVSS vector AV:N/PR:N/UI:N) reach the product's management/web interface and sidestep intended authorization checks, granting access to data-protection functions they should not be able to invoke. IBM scores the flaw 8.1 (HIGH) with full unscoped impact (C:H/I:H/A:H) and AC:H, while our independent assessment keeps the same unauthenticated network vector but lowers the assessed impact to C:L/I:L/A:L - meaning the practical effect is more likely unauthorized read/modification of limited functionality than complete compromise, with the high complexity reflecting a non-trivial precondition (a specific request state, timing, or authorization configuration) that the vendor does not disclose. No public exploit identified at time of analysis, and a vendor fix is available through IBM support node 7288035.
Missing role enforcement in WACRM 0.7.0 and earlier allows any authenticated user holding the low-privilege 'viewer' role to perform write operations that should be restricted to 'agent' or higher - creating, editing, activating, and deleting WhatsApp flows, creating and modifying automations, and triggering outbound WhatsApp sends through the automation engine. The affected route handlers (src/app/api/flows/[id]/route.ts, src/app/api/flows/[id]/activate/route.ts, src/app/api/flows/route.ts, src/app/api/automations/route.ts, and src/app/api/automations/engine/route.ts) check only account membership before writing through a service-role database client that bypasses row-level security, so the server-side RLS policies that would otherwise require the agent role never apply. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); exploitation requires only a valid viewer-level account on the target instance, making this a straightforward post-authentication privilege escalation with high integrity impact but no direct confidentiality loss.
Broken access control in HCL BigFix Service Management lets a low-privileged authenticated user reach administrative screens and functions reserved for higher-privileged roles, effectively escalating their privileges within the ITSM instance. Per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1 High), the attacker must already hold a valid standard-role account and can reach the application over the network without user interaction, obtaining full read and write capability over the exposed administrative functionality with no direct availability impact. No public exploit code has been identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV).
IBM Guardium Data Protection 12.2 accepts TLS peer certificates it should reject, letting an attacker positioned on the network path impersonate a trusted endpoint and bypass the security restrictions the encrypted channel is meant to enforce. The vector is PR:N and UI:N, so no credentials or user action are needed, but the practical barrier is the MITM foothold itself - ARP or DNS spoofing, a rogue access point, or a compromised intermediate segment - which is exactly why the score carries AC:H and why properly segmented deployments are largely shielded. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV; IBM has published a vendor fix.
Cross-site request forgery in IBM Guardium Data Protection 12.2 allows a remote, unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L, base 8.1) to bypass security restrictions by riding an already-authenticated administrator's browser session, producing high integrity impact on protected configuration. The attacker supplies no credentials of their own, but exploitation requires a victim who is currently logged in to Guardium to be tricked into loading attacker-controlled web content while that session is live, so no public exploit code has been identified at time of analysis. IBM has published a vendor patch via support page node 7288035, and deployments enforcing anti-CSRF tokens, SameSite cookies, or re-authentication for sensitive actions are materially less exposed.
Password reset token disclosure in SysReptor prior to 2026.58 allows an unauthenticated attacker who knows a victim's email address to request a reset email with a forged Host header, causing the generated reset link to point at an attacker-controlled system; when the victim follows the link, the reset token is disclosed and the attacker can reset the victim's password and fully take over the account. Exploitation is narrowly gated: the installation must enable email-based password reset (FORGOT_PASSWORD_ENABLED and LOCAL_USER_AUTH_ENABLED) with a configured email gateway (EMAIL_HOST), must run a professional license, and must have configured the Django ALLOWED_HOSTS setting with the wildcard '*'; installs with ALLOWED_HOSTS pinned to real domain names are not affected. Fixed in 2026.58, with no public exploit identified at time of analysis; the CVSS 3.1 base is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) driving a HIGH rating on unauthenticated network reach plus high confidentiality and integrity impact, although an independent assessment rates attack complexity as High because the wildcard host configuration is a non-default production-hardening miss rather than a shipped default.
Out-of-bounds reads in FluidSynth 2.5.0 through 2.5.5 can be triggered when the process loads and renders an attacker-controlled DLS soundfont, allowing memory disclosure and denial of service. Only builds compiled with the CMake option enable-native-dls enabled expose the vulnerable loader in src/sfloader/fluid_dls.cpp; builds with that option set to OFF are unaffected. The vendor rates this 8.0 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H), while independent assessment narrows the impact to confidentiality and availability (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) because the crafted file must reach the process locally and no public exploit code has been identified at time of analysis. A vendor-released fix is available in version 2.5.6.
CRLF injection in the Synology DiskStation Manager (DSM) User API lets a remote, low-privileged authenticated user (PR:L) who can also induce limited user interaction (UI:R) read or write arbitrary files on the appliance and trigger a denial-of-service condition that surfaces only after the next reboot. Deployments running DSM before 7.2.1-69057-10, before 7.2.2-72806-7, or before 7.3.2-86009-2 are affected; there is no public exploit identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). Because the flaw is a file read/write primitive, integrity and confidentiality impact is high, but it is gated behind a valid low-privileged DSM account rather than being unauthenticated mass-exploitable, and vendor-released fixed builds eliminate exposure.
Local privilege escalation in Microsoft Edge (Chromium-based) versions below 153.0.4234.46 stems from a use-after-free (CWE-416) memory corruption flaw that an attacker with an existing low-privileged foothold on a Windows host can trigger to elevate privileges. Exploitation requires local access and low privileges (AV:L, PR:L, UI:N) and is constrained by high attack complexity (AC:H) because the bug is timing/race-dependent, so it is not reliably or automatically triggerable (SSVC Automatable=no); the changed-scope rating (S:C) reflects impact that can cross a security boundary such as the browser sandbox. No public exploit code has been identified and EPSS is low at 0.22% (13th percentile), with no evidence of active exploitation in CISA KEV or SSVC (Exploitation=none), making this a genuine but moderate-priority patching item rather than a remotely wormable emergency.
Heap out-of-bounds write in OpenImageIO's Maya IFF decoder (src/iff.imageio/iffinput.cpp) lets a crafted .iff file corrupt heap memory in any application built against affected releases prior to 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1. The trigger is a zbuffer-only tiled IFF whose Z-depth data is exposed through a 16-bit public ImageSpec while the decoder keeps a 32-bit internal pixel size, combined with a failure path that leaves m_buf partially populated so a later read_native_tile() copies half-initialized data into an undersized caller buffer sized by m_header.pixel_bytes() instead of ImageSpec::tile_bytes(true). The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) confirms no privileges are required but the attack is local and depends on a victim or pipeline opening the malicious image; no public exploit code or active exploitation has been identified at time of analysis, and risk is highest in automated render/asset pipelines that batch-process untrusted IFF files without human review.
Out-of-bounds heap read and write in FluidSynth's MIDI player channel-tracking logic corrupts memory whenever the synth.midi-channels setting is configured above its default of 16, letting a local user who can influence that configuration crash the synthesizer and potentially achieve memory corruption with confidentiality, integrity and availability impact in the playing process. All releases from 2.2.4 up to but not including 2.5.6 are affected; the unsafe state is created by configuration alone plus ordinary playback, so no specially crafted MIDI file is required. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, and although the assessed CVSS 3.1 score is 7.8 High (AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H), the real-world risk is materially lower because default installations that leave synth.midi-channels at 16 never reach the vulnerable path.
Decoding a crafted tiled OpenEXR image with OpenImageIO releases prior to 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1 can corrupt the heap, because the tiled reader copies decoded rows into the caller's buffer using a padded whole-tile stride instead of the width of the requested rectangle; affected files are those whose width is not an exact multiple of the tile width and are read as a partial edge-tile rectangle. The flaw is reachable without any privileges (PR:N) but requires the victim to open or process the malicious file (UI:R) and is scored as a local-vector bug (AV:L), yielding CVSS 7.8 with high confidentiality, integrity, and availability impact; both the classic and OpenEXR-Core readers (src/openexr.imageio/exrinput.cpp and exrinput_c.cpp) are affected. No public exploit identified at time of analysis, and vendor fixes are available in the three named release lines.
Local privilege escalation in the virtio-win Viosock (vsock) paravirtualized driver, builds mm210 through mm319, lets an attacker who already has low-privilege code execution inside a Windows guest corrupt kernel memory and escalate to SYSTEM. The driver's IOCTL_SELECT handler adds three attacker-controlled descriptor counts with 32-bit arithmetic, so an integer-wrapped total passes the FD_SETSIZE bounds check while an individual fd_count remains far above the expected limit; the subsequent copy routine then walks the unchecked count and writes past the NonPagedPool-allocated pPkt->Fds array. Exploitation is local only (AV:L) and requires a low-privileged foothold (PR:L) with no user interaction; no public exploit code was identified at time of analysis, and the vendor fixed the issue in build mm320 via commit c6bef93d7909584bbda4e5c87603ea175825f342.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows a low-privileged local attacker to execute arbitrary commands as root by exploiting insufficient argument validation in the SUID-root nmap_wrapper binary on the Collector appliance, resulting in full compromise of the Collector. The vulnerability requires existing low-privileged local shell access to the Collector and is not remotely exploitable. No public exploit code or confirmed active exploitation has been identified at the time of analysis; a vendor patch is available.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows an authenticated, low-privileged user with existing access to the appliance host to raise their privileges to a higher level, affecting confidentiality, integrity and availability of the platform. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires a pre-existing local account and low complexity but no user interaction; it is an escalation step rather than a remote entry vector, so risk is concentrated on collector/aggregator hosts where untrusted or lower-tier accounts or shells already exist. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; this is a genuine but moderate-priority local privilege escalation rather than an actively exploited campaign.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows an attacker who already holds a low-privileged local account on the appliance - such as a constrained operator role, a compromised low-privileged process, or a malicious insider - to gain elevated privileges, with full compromise of confidentiality, integrity, and availability of the affected system. The flaw (CWE-269, improper privilege management) is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring no user interaction and no network-facing path; the local-access prerequisite makes it a post-compromise escalation step rather than a remote entry point. No public exploit code or confirmed active exploitation has been identified at time of analysis, and IBM has published a vendor patch advisory.
Stack-based buffer overflow in the web management server of PLANET IGS-5225-8P2T4S industrial managed switches lets an authenticated remote attacker (PR:L) crash the device for a denial of service or, with greater effort, execute arbitrary code on the underlying operating system. Affected are V1 firmware before 1.2412b260707 and V2 firmware before 2.2412b260519; exploitation requires network reachability to the switch web interface, valid credentials, and high attack complexity (AC:H) to achieve reliable code execution, so a straightforward crash/DoS is the more accessible outcome. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis; vendor firmware fixes are available.
Information disclosure in Microsoft 365 Copilot allows an authenticated, low-privileged user within an affected tenant to retrieve content that should fall outside their authorization boundary, with the disclosed data potentially belonging to a different security authority than the attacker (scope change). Exploitation is network-reachable, low complexity, and requires no user interaction, but it is not unauthenticated - the attacker must already hold a valid low-privileged identity in a tenant where Copilot is enabled, per the assessed vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7). This is a Microsoft-hosted cloud service issue with no CISA KEV listing, no vendor-acknowledged exploitation, and no public exploit code identified at time of analysis; because remediation occurs server-side, the practical customer exposure window is the period preceding Microsoft's fix.
PHP object injection in Cotonti 1.0.0 allows authenticated users with comment-write permissions to pass attacker-controlled base64-encoded data through the cb (comeback) parameter of the comments plugin EditAction, which is then unserialized without an allowed_classes restriction. This can lead to arbitrary PHP object instantiation and, only if a viable POP gadget chain exists among loaded classes, escalation to file write or remote code execution. No public exploit code or active exploitation has been identified at time of analysis; the vendor has published a fix in PR #1897, and the vendor CVSS 4.0 score is 7.7, while the independent CVSS 3.1 assessment is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
SQL injection in IBM Guardium Data Protection 12.2 allows a remote, authenticated attacker holding only a low-privilege session to read sensitive information out of the product's backend database by supplying crafted input to a request parameter that is concatenated into a SQL command without neutralization. No user interaction is required and no public exploit code has been identified at time of analysis, so the practical risk depends on who can already reach the management interface - which is normally deployed on segmented internal networks, keeping broad internet-facing exposure low. Impact is confined to confidentiality (information disclosure); there is no integrity or availability effect, and only version 12.2 is named as affected.
Authenticated SQL injection in ManageEngine DataSecurity Plus builds before 6310 allows a technician-level user to execute arbitrary SQL queries through the Reports module, enabling read access to sensitive data stored in the application's backend database. The vendor assigns a CVSS 3.1 base score of 7.7 with a scope change (S:C), while our independent assessment rates it as scope-unchanged with high confidentiality impact only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires valid technician credentials and network access to the web console; no public exploit identified at time of analysis.
Authenticated SQL injection in IBM Guardium Data Protection 12.2 allows a high-privilege administrator to extract sensitive information from the appliance's underlying database by supplying malformed input to a specific application parameter that fails to neutralize SQL special elements. The attacker must already hold an authenticated management-console session with elevated privileges (CVSS PR:H), so exploitation is limited to trusted administrators or attackers who have already compromised admin credentials; no user interaction is required and the interface is network-reachable. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, making this a moderate-risk, targeted issue rather than a mass-exploitation candidate; a vendor patch is available.
Path traversal in IBM Guardium Data Protection 12.2 lets a remote authenticated attacker with a low-privilege account manipulate file paths to reach locations outside the intended directory, producing a high integrity impact alongside limited confidentiality and availability effects. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, base 7.6) confirms the flaw is network-reachable and low-complexity but gated behind a valid account, so exposure is bounded by the authentication requirement and the typically segmented management network these appliances sit on. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; IBM has published a vendor patch, so remediation is available.
IBM Guardium Data Protection 12.2 permits a remote authenticated attacker to bypass security restrictions through an improper authorization check, compromising integrity with limited confidentiality and availability impact. The flaw is network reachable at low complexity and requires a valid low-privilege session but no user interaction; no public exploit identified at time of analysis. Affected deployments should apply the vendor patch referenced in IBM support node 7288035.
Heap-based out-of-bounds write in OpenImageIO before 3.1.16.0 lets remote attackers corrupt memory whenever an application linked against the library reads a crafted 1-bit contiguous CMYK TIFF, a condition that maps to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H (7.6). The flaw is reachable unauthenticated from the network perspective of the file, but exploitation is limited by the requirement that a victim open or process the malicious image (UI:R), and only that narrow PhotometricInterpretation 5 / BitsPerSample 1 / planarconfig contig code path is affected. Vendor-released patch: 3.1.16.0; no public exploit identified at time of analysis, though the upstream fix commit ships a regression test using a crafted sample (crash-cmyk-1bit.tif) that documents the exact triggering structure.
Unauthenticated remote denial of service in Parseable versions prior to 3.0.0 allows any network-reachable client to crash request handling by sending a crafted x-amz-firehose-common-attributes header to the HTTP ingestion endpoint. Because the vulnerable unwrap() chain executes in src/handlers/http/middleware.rs before authentication, an attacker needs no credentials and no user interaction: supplying non-UTF-8 header bytes, malformed JSON, or a derived authorization/x-p-stream value that is not a valid HTTP header triggers a Rust panic, and repeated requests can deny service or drive the container into a restart loop. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the EPSS-style risk profile is elevated by the trivial, unauthenticated nature of the trigger; the vendor-released fix is Parseable 3.0.0.
Path traversal in IBM Cloud Pak for Data 5.1.2 lets remote, unauthenticated attackers read arbitrary files from the server filesystem by sending crafted URL requests containing ../ (dot-dot-slash) sequences. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a straightforward, low-complexity information-disclosure issue with high confidentiality impact but no integrity or availability impact; no public exploit code was identified at time of analysis. Only version 5.1.2 is named as affected, and IBM has published a vendor fix, so exposure is limited to unpatched, network-reachable deployments of that release.
A remote, unauthenticated attacker can exhaust the JVM heap and cause a denial of service by sending a small crafted image to any RESTEasy (JAX-RS) endpoint that consumes an image request body, because the framework's IIOImageProvider decodes the image through ImageIO without validating declared dimensions or pixel count. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a clean, low-complexity, availability-only flaw with no confidentiality or integrity impact, consistent with CWE-409 data amplification. Reachability is the key limiting factor: only applications that actually expose a resource method consuming image content types through the image provider are affected, and no public exploit code was identified at time of analysis.
Stack exhaustion in Apache Neethi before 3.2.4 lets an unauthenticated remote attacker crash the WS-Policy parser by supplying a policy document whose element nesting is deep enough to slip past Neethi's nesting-depth guard and drive unbounded recursion until the thread stack is exhausted. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) the impact is availability-only: no confidentiality or integrity loss, but a successful parse failure can take down the parser thread and potentially the hosting SOAP endpoint. The practical reachability condition is that the target application must actually hand attacker-controlled WS-Policy content to Neethi - typical of Apache Axis2 or CXF-based WS-* services that accept client- or peer-supplied policy - whereas deployments that only parse locally configured, trusted policy are not exposed; no public exploit code was identified at time of analysis and neither CISA KEV nor EPSS data accompanies this record.
Unbounded per-connection queue growth in Netty's WebSocketServerExtensionHandler lets unauthenticated remote attackers exhaust server memory (OutOfMemory) and cause denial of service in Red Hat products that bundle the affected Netty code, including AMQ Broker 7, AMQ Clients, Build of Keycloak, Build of Quarkus, Camel for Spring Boot 4, Camel 4 for Quarkus 3, Data Grid 8, Fuse 7, JBoss EAP 7/8, Single Sign-On 7, Apicurio Registry 3 and Debezium 3. The flaw carries CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - unauthenticated, no user interaction, availability-only) and is reachable only where a Netty-based server exposes a WebSocket endpoint that negotiates protocol extensions such as permessage-deflate to untrusted clients. No public exploit identified at time of analysis, and no CISA KEV listing; impact is confined to availability, with no confidentiality or integrity loss.
Denial of service in Apache Neethi before 3.2.4 allows unauthenticated remote attackers to exhaust server CPU and memory by submitting a small WS-Policy document that contains repeated policy references, which Neethi re-expands exponentially during normalization. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), with impact limited to availability - there is no confidentiality or integrity loss. Practical exposure is bounded: only applications that actually parse and normalize attacker-supplied WS-Policy (typically SOAP/web-service endpoints built on Apache Axis2 or CXF) are reachable, and no public exploit identified at time of analysis. This is a genuine but bounded availability risk, and upgrading to 3.2.4 removes the flaw.
Heap exhaustion in Apache Neethi versions before 3.2.4 lets unauthenticated remote attackers exhaust server memory by submitting a crafted WS-Policy document whose oversized policy assertion is copied into memory without being counted against Neethi's size limits, resulting in denial of service. The issue is availability-only (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and reachable only where an application actually parses attacker-supplied WS-Policy input, most commonly SOAP endpoints built on Apache Axis2 or CXF. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), so the practical risk is bounded by whether untrusted WS-Policy documents reach the parser.
Remote code execution in IBM MQ Java and JMS client libraries allows an authenticated attacker with access to a message queue or topic to bypass the deserialization allow-list filter in exception handling and execute arbitrary code on client applications. The flaw is network-reachable but requires low-privileged authentication (PR:L) and is limited to a specific exception-handling path (AC:H), with impact confined to the client process rather than the MQ server. No public exploit code was identified at time of analysis.
Unauthenticated SQL injection in the WCFM Marketplace (Multivendor Marketplace for WooCommerce) WordPress plugin affects all versions up to and including 3.8.2, allowing remote attackers to inject arbitrary SQL through the 'wcfmmp_user_location_lng' parameter and read sensitive data from the underlying WordPress database. Rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), the flaw requires no authentication, privileges, or user interaction, although practical reachability depends on the store actually exercising the plugin's location/distance-based shipping code path alongside an active WooCommerce install. No confirmed active exploitation (the issue is not in CISA KEV) and no public exploit code identified at time of analysis; an upstream fix commit is visible in the plugin repository, but a released patched version has not been independently confirmed.
Improper handling of HTTP/2 and HTTP/3 Extended CONNECT requests in Netty-based services can downgrade them to ordinary CONNECT requests, enabling request-smuggling or desynchronization in deployments where a fronting proxy and backend interpret the downgraded request differently. The issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning unauthenticated remote attackers can affect integrity, though the independent assessment raises attack complexity to High and scope to Changed and limits practical impact to proxy/gateway mismatches on endpoints that accept HTTP/2 or HTTP/3 Extended CONNECT. No CISA KEV entry or public exploit code was identified at time of analysis, so priority is moderate and conditional rather than urgent.
Denial of service in libheif versions prior to 1.23.2 allows unauthenticated remote attackers to hang or exhaust a decoding process by supplying a small but crafted HEIF/AVIF sequence file whose stts timing and edit-list metadata drive Track::init_sample_timing_table() to compute an output-sample count larger than the uint32_t counters used by Track_Visual::decode_next_image_sample() and Track::get_next_sample_raw_data(). The oversized count can never be reached, so decode and raw-sample loops fail to terminate and bypass the max_sequence_frames safeguard, while repeated Box_stts::get_sample_duration() calls and unbounded allocations of Chunk::m_sample_ranges and Track::m_presentation_timeline occur outside MemoryHandle accounting, producing severe CPU and memory exhaustion. Impact is availability-only (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; CWE-835), with no confidentiality or integrity effect; there is no public exploit code identified at time of analysis, and exploitation requires that the application actually exercises the multi-sample sequence decode path on untrusted input. Vendor-released patch: 1.23.2.
Unbounded remote-initiated stream creation in Netty's SpdySessionHandler allows an unauthenticated, network-positioned attacker to exhaust JVM heap and direct memory on any application that exposes a SPDY endpoint, producing OutOfMemoryError and a denial of service. The handler initializes localConcurrentStreams to Integer.MAX_VALUE and provides no API to change it, so no supported configuration knob reduces the exposure once SPDY is reachable; Netty 4.1.x before 4.1.138.Final and 4.2.x before 4.2.18.Final are affected, along with the Red Hat products that bundle those versions (AMQ Broker and AMQ Clients, Camel for Quarkus 3 and for Spring Boot 4, Keycloak, Quarkus, Debezium, Apicurio Registry, Data Grid, Fuse, JBoss EAP 7/8, and RH-SSO 7). Exploitation requires the target application to have explicitly wired the SPDY handler into its Netty pipeline, since SPDY is a deprecated protocol that is not enabled by default; there is no public exploit identified at time of analysis, and the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) reflects a low-complexity, availability-only denial of service with no confidentiality or integrity impact.
IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 contain a heap-based buffer overflow (CWE-122) that is triggered during queue manager startup when improperly validated cluster migration data is processed. The flaw is exploitable only by an authenticated attacker who can supply crafted migration data to a queue manager participating in MQ clustering, and the dependable outcome is a denial of service (queue manager startup failure or crash), with arbitrary code execution considered only potentially achievable. Independent assessment rates the realistic impact lower than the vendor's 7.5 score (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H), and there is confirmed no public exploit code and no CISA KEV listing - no public exploit identified at time of analysis. A vendor patch is available via IBM support page node 7287705.
Unbounded heap memory consumption in Netty's HttpServerCodec (io.netty:netty-codec-http) lets a remote, unauthenticated attacker drive a denial of service by exhausting server memory. An attacker who pipelines multiple HTTP/1.1 requests on a single connection and withholds reads prevents the internal methodOverflowQueue from being drained, so memory grows without limit; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is availability-only with no confidentiality or integrity impact, and no public exploit code was identified at time of analysis. Any HTTP/1.1 server built on the default Netty codec behavior is affected, and fixes ship in Netty 4.1.138.Final and 4.2.18.Final, with corresponding patched Red Hat product builds referenced through the Red Hat advisory.
Denial of service in Suricata's SMB parser allows remote, unauthenticated attackers to exhaust CPU and memory on a sensor by sustaining one-directional SMB traffic (including async-oneside flows), where force-completed transactions are retained and cleanup keeps waiting for inspection in the direction that never carries payload. Affected releases are Suricata before 7.0.17 and 8.0.0 through 8.0.5; the vendor fixed the issue in 7.0.17 and 8.0.6. Exploitation requires attacker traffic to transit a monitored network segment and to be sustained rather than a single packet, all exploitation signals indicate a genuine but moderate-priority availability issue, no public exploit has been identified at time of analysis, and EPSS is low (0.44%, 38th percentile).
Stack-based buffer overflow in the web management server of PLANET IGS-5225-8P2T4S industrial managed switches allows a remote authenticated administrator to crash the device or, with carefully crafted input, potentially execute arbitrary code on the underlying operating system. Affected devices run V1 firmware before 1.2412b260707 or V2 firmware before 2.2412b260519, and exploitation requires valid administrative credentials plus network reachability to the switch's management interface; the high attack complexity means many payloads will only produce a denial of service rather than code execution. No public exploit has been identified at time of analysis, and PLANET has released fixed firmware for both branches.