CPU exhaustion in MongoDB's Mongoid Ruby ODM allows an unauthenticated remote party to render an embedding application unresponsive by supplying crafted text that lands inside a pattern-matching query condition Mongoid evaluates in memory against an embedded association, triggering catastrophic regex backtracking (CWE-1333, ReDoS). The impact is availability-only: the affected Ruby application process burns CPU and stops responding, with no confidentiality or integrity effect. No public exploit code has been identified at time of analysis, and reachability depends on a specific application coding pattern, which is why the independent assessment applies AC:H and treats deployments that never route untrusted input into regex conditions on embedded documents as out of scope (the CNA's CVSS 4.0 vector rates it 8.7 with AC:L, a more aggressive reading than the assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
hickory-resolver releases before 0.26.2 fail to propagate a 'bogus' DNSSEC proof state out of the high-level Resolver::lookup() and Resolver::lookup_ip() APIs, so records that fail DNSSEC signature validation are handed back to the caller as successful, apparently validated answers. This is an integrity-only bypass affecting unauthenticated remote attackers (CVSS:4.0 8.7 / assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) who either control the authoritative zone answering the query or sit on the network path to inject forged records with invalid RRSIGs; applications that do not compile the crate's __dnssec feature are unaffected because they never expected validation in the first place. A vendor fix is available in 0.26.2 (commit 30720f4, PR 3871), and no public exploit code or confirmed active exploitation was observed at time of analysis. This is a genuine, high-priority integrity flaw despite the absence of exploitation telemetry.
Hardcoded MQTT credentials shipped inside Bransys ELD grant unauthenticated read access to real-time telemetry for every active device belonging to a subset of carriers connected to the affected MQTT broker. Because the static credential is embedded in the product, remote attackers who recover it - for example by reverse-engineering the shipped binary or firmware - can subscribe to the broker with any standard MQTT client, and no user interaction or per-victim authentication is required (PR:N/UI:N). The exposure is confidentiality-only against live fleet data (C:H/I:N/A:N in our assessed CVSS 3.1 vector) and no public exploit code or confirmed active exploitation was identified at time of analysis; the reported CVSS 4.0 score of 8.7 reflects the broad device population reachable with a single shared credential, and CISA ICS advisory ICSA-26-260-01 documents the issue.
Unauthenticated relative path traversal in HGiga OAKlouds Bulletin V3 (2.0 and 3.0 product lines, module builds below 107) lets remote attackers read arbitrary files from the underlying host, potentially exposing configuration files, stored credentials, and other sensitive system data. Both the published CVSS 4.0 score of 8.7 and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) agree that no authentication, no user interaction, and no non-default configuration are required - the only prerequisites are network reachability of the Bulletin web interface and a vulnerable build. No public exploit identified at time of analysis, and the vendor has released a fix in build 107, so residual risk hinges on whether internet-facing or partner-exposed deployments have actually been upgraded. This is a genuinely high-priority issue given the unauthenticated, confidentiality-only but high-impact nature of the flaw and the often sensitive content of Taiwanese bulletin/portal deployments.
An authentication downgrade in NASA CryptoLib 1.5.0 lets a remote, unauthenticated attacker defeat Space Data Link Security (SDLS) authentication on the Telecommand receive path by crafting a frame whose Security Parameter Index (SPI) names a weaker Security Association (SA) than the one legitimately authorized for that frame's Global Virtual Channel ID (GVCID). Because the receiver never checks that the selected SA is permitted for the frame's GVCID, the command is processed under the attacker-chosen SA, giving high integrity impact (VI:H, C:N, A:N) against spacecraft or ground-segment command handling. Exploitation is constrained rather than trivially remote: the attacker must be able to inject frames into the TC uplink/command channel (typically an RF ground link or internal command network, not the public internet) and a misconfigured or weaker SA must already exist for the targeted GVCID. No public exploit code was identified at time of analysis, and the flaw is an authorization/downgrade weakness rather than a confidentiality exposure.
Stored cross-site scripting in SiYuan through 3.8.4 lets an attacker inject malicious style values into heading attributes that the outline and bookmark docks render without escaping, so the payload executes as JavaScript inside SiYuan's Electron renderer - which runs with full system access, making this effectively an XSS-to-code-execution condition on the host rather than ordinary script execution in a sandboxed browser context. Delivery is either a crafted notebook that the victim imports or opens, or abuse of SiYuan's administrative endpoints (the latter implying authenticated access); the payload only fires when the victim surfaces the affected heading in the outline or bookmark dock, so user interaction is required (UI:A) and exploitation is not purely passive. No public exploit identified at time of analysis; the CVE carries a CVSS 4.0 base score of 8.6 and was independently assessed as CVSS 3.1 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting the notebook-import path being unauthenticated while the administrative-endpoint path requires credentials.
Unauthenticated SQL injection in IBM Platform RTM (the real-time monitoring component of Spectrum LSF) lets a remote attacker who can reach the product's web/reporting interface inject crafted SQL into a back-end database, reading, adding, modifying, or deleting data. The vendor rates it CVSS 3.1 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), and our independent assessment agrees on severity while noting that in typical HPC/LSF deployments the component sits on a trusted cluster-management network rather than the public internet, which is the main real-world brake on exploitation; the assessed vector also raises the integrity impact to H (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) because successful SQL injection against a writable application account commonly yields full row-level manipulation, not just partial. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV, though the PR:N/UI:N profile means no credentials or user interaction are needed once the endpoint is reachable. Vendor patch availability is listed as available, giving administrators a direct fix path; the specific vulnerable parameter and page are not named in available data, so pre-auth reachability should be verified against the IBM advisory.
Unauthenticated SQL injection in the Load Balancer Groups component of IBM Guardium Data Protection 12.2 allows remote attackers to reach the Load Balancer Servlet endpoint and inject arbitrary SQL statements, potentially exposing managed data and degrading the confidentiality, integrity, and availability of the appliance (CVSS 8.6, with confidentiality impact rated high and integrity/availability impact limited). Per the CVSS vector PR:N/UI:N, no credentials or user interaction are required to attempt the attack, but practical risk depends on network exposure: Guardium appliances are normally deployed on internal management or security networks rather than the public internet, so reachability to the servlet is the principal gating condition. No public exploit code has been identified at time of analysis, and IBM has published remediation through its support advisory rather than confirmed in-the-wild activity.
Stored cross-site scripting in the Concrete CMS Community Store package before 2.7.8 lets an unauthenticated shopper plant script payloads in customer-supplied checkout fields - billing first/last name, email, and phone - which the storefront renders without HTML escaping in default order-slip, cart, and checkout templates. The injected script lies dormant until an authenticated store manager or administrator opens the affected order in the order slip or admin order views, at which point it executes in their privileged session and can create rogue accounts or exfiltrate store and customer data. Exploitation requires privileged-user interaction (no public exploit code identified at time of analysis), but because the vulnerable rendering lives in default templates and no non-default configuration is needed, any shop accepting guest orders is exposed - an attacker gains no access unless a manager views the poisoned order, and patch version 2.7.8 is available.
Authenticated low-privilege users can read and insert TimeSeries samples in ArcadeDB deployments running versions before 26.9.1 even when security-group ACL deny rules explicitly forbid it, because the permission resolver builds its grants from record bucket IDs while TimeSeries types own no normal record buckets, causing the access check to fail open. The flaw is a genuine authorization bypass (CWE-863) with high confidentiality and integrity impact but no availability impact, and it only manifests on instances that actually use TimeSeries types and rely on ACLs to segregate them. No public exploit code has been identified at time of analysis, but the vendor has released the fix in ArcadeDB 26.9.1.
Insecure direct object reference in Mongoid's nested-attributes handling lets an authenticated user with basic application privileges supply another user's record identifier, causing Mongoid to look up that record outside ownership or tenant scoping and then update and link it to the requester's own record-resulting in unintended disclosure and unauthorized modification of data. Exploitation is limited to applications that use accept_nested_attributes_for on ownership- or tenant-scoped associations and rely on Mongoid to enforce scoping; no public exploit identified at time of analysis, and no confirmed affected or fixed versions because the only reference is an unbounded MongoDB Jira advisory with a wildcard CPE.
Command injection within Acode on Android lets any locally installed application execute arbitrary shell commands inside Acode's own sandboxed UID, exposing private app data, stored remote credentials, Storage Access Framework grants and granted runtime permissions. The flaw affects builds from 1.11.6 up to but not including 1.12.7, where the terminal plugin exports com.foxdebug.acode.rk.exec.terminal.TerminalService without a binding permission and TerminalService.java performs no caller verification, so a zero-permission hostile app can bind the service and pass an attacker-controlled cmd value via MSG_EXEC. Exploitation is strictly local and requires the victim to already have run a malicious app alongside a vulnerable Acode release; no public exploit code has been identified at time of analysis and there is no CISA KEV listing or EPSS signal reported.
SQL injection in pg_partman before 5.5.0 allows an authenticated low-privileged partman_user to escalate to PostgreSQL superuser and execute operating-system commands as the PostgreSQL service account. The flaw only fires when pg_jobmon is installed, part_config.jobmon is true for the target partition set, and an affected exception handler in a pg_partman function actually runs; the injected SQL then executes with the privileges of pg_partman_bgw.role, which defaulted to a PostgreSQL superuser prior to 5.5.0. The malicious parent-table name is stored persistently in part_config, so the escalation can re-trigger on later background-worker maintenance ticks; exploitation is conditional and most dangerous in multi-tenant clusters that use jobmon with a superuser background worker, and no public exploit code was identified at time of analysis. Fixed in 5.5.0.
SQL injection in pg_partman before 5.5.0 allows an authenticated partman_user who owns a template table to escape the generated ALTER TABLE ADD PRIMARY KEY statement by placing a double-quote character in a column name, causing the background worker to run attacker-supplied SQL under the worker's role. Because pre-5.5.0 deployments effectively default pg_partman_bgw.role to a PostgreSQL superuser, successful exploitation yields database-wide compromise and operating-system command execution as the PostgreSQL service account, with the crafted catalog identifier persisting and re-triggering during later child-partition creation. Exploitation is gated on the background worker actually applying the primary key to a child partition (hence AC:H) and is neutralized entirely if the worker runs as a non-superuser role; no public exploit identified at time of analysis, and the flaw is fixed in 5.5.0 (CVSS 3.1 score 8.5).
SQL injection in pg_partman prior to 5.5.0 allows an authenticated PostgreSQL role holding the documented partman_user privileges to plant arbitrary SQL in the writable part_config.time_dncoder column and have it executed when routine maintenance or partition-inspection functions later interpolate that value into dynamic SQL. Because the injected statement runs with the privileges of the invoking operation, deployments whose pg_partman_bgw.role GUC is still pointed at a superuser role (the historical default before 5.5.0) can be escalated to database-wide compromise and operating-system command execution as the PostgreSQL service account, and the poisoned configuration row can re-establish elevated access on subsequent background-worker ticks. Exploitation requires write access to part_config and is most realistic in multi-tenant instances where several roles share pg_partman, and no public exploit code was identified at time of analysis; version 5.5.0 fixes the issue. The assessed CVSS is 8.5 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting authenticated access and a high-complexity, scope-changing path rather than a remotely unauthenticated attack.
SQL injection in pg_partman prior to 5.5.0 lets a role with partman_user access store arbitrary SQL - rather than a legitimate function name - in the part_config.time_encoder column, which undo_partition() interpolates into a dynamically executed SELECT without identifier quoting and runs with the privileges of whichever caller invokes that function. Exploitation is a two-step confused-deputy chain: an authenticated writer plants the payload, and a separate more-privileged role must later call undo_partition() on the same partition set, which is why the assessed vector is AV:N/AC:H/PR:L with impact bounded by the invoking caller rather than the attacker, and it does not carry the automatic superuser escalation of the background-worker create-partition flaw. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is resolved in pg_partman 5.5.0.
Unauthorized relocation of retained partition child tables in pg_partman before 5.5.0 lets an authenticated database role holding partman_user access move another tenant's child tables into a schema it does not own. The cause is that drop_partition_id() and drop_partition_time() pass part_config.retention_schema straight into ALTER TABLE SET SCHEMA, and the background worker executes the move under pg_partman_bgw.role - a PostgreSQL superuser by default before this release - so the privilege check that normally guards SET SCHEMA is never enforced. The realistic impact is bounded to multi-tenant deployments where several roles own partition sets on the same instance, no public exploit code was identified at time of analysis, and the escalation is fully neutralized by pointing pg_partman_bgw.role at a non-superuser role, which the vendor confirms can be done even before upgrading.
Privileged users of PLANET IGS-5225-8P2T4S industrial managed switches running V1 firmware before 1.2412b260707 or V2 firmware before 2.2412b260519 can activate undocumented debug functionality that ships enabled in the embedded software, reaching an OS command execution path that grants root-level access to the device. Exploitation requires high-privilege administrative/management access and local access to the device management plane (CVSS:4.0 AV:L/PR:H), so the realistic threat is a malicious insider or an attacker who has already obtained management credentials rather than an unauthenticated remote compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor-released patched firmware is available.
Unsafe reflection (CWE-470) in Mongoid's document persistence layer allows a crafted key to be reflected into an internal method invocation instead of the intended array-field update, which can delete stored records and render the embedding application unresponsive. The affected component is Mongoid, MongoDB's Ruby object-document mapper; the CPE record (cpe:2.3:a:mongodb_inc.:mongoid:*:*:*:*:*:*:*) carries no version bounds, so the vendor has not published a bounded version range, and exposure applies to any embedding application that forwards unauthenticated, attacker-controlled keys directly into an array-field update. The CVSS 4.0 vector marks this dependency as AT:P (Attack Requirements: Present), meaning Mongoid is not exploitable in isolation, but where that non-default coding pattern exists there is no authentication or user-interaction barrier (PR:N, UI:N/A:H). Impact is integrity and availability only (VI:H/VA:H, VC:N), and no public exploit code has been identified at time of analysis.
Unauthenticated, remote query-operator injection in Mongoid - the official MongoDB object-document mapper for Ruby - allows an attacker to shape how MongoDB evaluates a query whenever an application forwards externally supplied filter parameters straight into Mongoid query-building methods without whitelisting allowed operators. Successful abuse can disclose stored field values (for example through $ne, $gt or $regex-style filter logic used for blind extraction) and, because operators such as $regex or $where can force expensive scans, can degrade database performance. The impact is conditional: the vendor's CVSS 4.0 vector carries AT:P (attack requirements present) and our assessment uses AC:H, because exploitation depends entirely on the downstream application's query-construction pattern rather than on a Mongoid setting. No public exploit code was identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided. CVSS 4.0 base is 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L) and our independent CVSS 3.1 assessment is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L, i.e. high confidentiality impact with a limited availability effect and no integrity impact.
Heap out-of-bounds write in OpenImageIO's Cineon image reader (cineon.imageio) allows memory corruption when the library decodes a crafted .cin file that declares an unsupported per-channel bit depth, such as 26. Affected deployments are those running OpenImageIO versions prior to 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1, and exploitation requires that a victim or an automated pipeline actually open and parse the attacker-supplied Cineon file (CVSS vector PR:N with UI:R). The flaw is rated High (CVSS 3.1 base 8.3, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H) and no public exploit code has been identified at time of analysis; vendor-released fixes are available in 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
Memory-exhaustion denial of service in SGLang through 0.5.20 allows anyone who can reach the decode engine's internal ZMQ rank port to terminate the serving process by sending a single STAGING_REQ frame carrying an extremely large chunk_idx value. The flaw applies only to deployments running prefill/decode disaggregation - a non-default, multi-engine serving topology - and requires network reachability to the inter-rank ZMQ port that normally carries unauthenticated traffic on a trusted cluster network; when that port is bound to loopback or an isolated back-end network, the issue is not reachably exploitable. No public exploit identified at time of analysis, and the impact is confined to availability: the scheduler allocates memory until the system runs out and the process is killed, with no data exposure or code execution.
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat middleware lets a remote, unauthenticated attacker smuggle requests across the HTTP/1-to-HTTP/2 protocol boundary, overriding the :authority pseudo-header that downstream services use for routing and authorization. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N = 8.2 High) rates integrity as the dominant impact (I:H) with limited confidentiality exposure (C:L) and no availability effect, consistent with a CWE-444 request-smuggling class defect. Exploitation is not confirmed actively exploited (no CISA KEV listing) and no public exploit identified at time of analysis, although real-world exploitation requires a deployment that actually translates HTTP/1 requests into HTTP/2 and a downstream component that trusts :authority for routing or authorization decisions.
Cross-client information disclosure in http-cache-semantics through 4.2.0 allows remote, unauthenticated attackers to receive cached responses that were generated for other users. The library's _varyMatches() function performs byte-for-byte comparison of Vary header values and therefore fails to treat a wildcard 'Vary: *' directive as a prohibition on shared-cache reuse, so a request for a URL previously fetched by someone else can be satisfied from cache with that other client's sensitive per-user data. Exploitation is conditional and non-deterministic - it requires a shared, multi-user cache deployment and an origin that emits wildcard Vary on cacheable responses - which is consistent with the vendor CVSS 4.0 score of 8.2 with AC:H and AT:P; no public exploit code has been identified at time of analysis.
Privileged users inside a QEMU guest running on the Q35 machine type with the KVM accelerator can abuse the VAPIC setup hypercall (hw/i386/vapic.c) to break SMM isolation, because the code fails to verify that a writable RAM alias stays inside the option ROM window. By repositioning that alias over chipset-locked SMRAM, an attacker with root-equivalent guest access defeats D_LCK protection and injects code into System Management Mode memory, which QEMU scores as a scope-changing, total-impact compromise (CVSS 8.2). Exploitation is local to the guest with high privileges required (AV:L, PR:H, S:C), publicly available exploit code exists according to the CISA SSVC assessment, but there is no confirmed active exploitation and EPSS is low at 0.20% (10th percentile).
Heap-based buffer overflow in the IBM MQ C client shipped with IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 lets a remote attacker who controls the queue manager's responses crash the client process or potentially execute arbitrary code in its context (CVSS 3.1 base 8.1). The flaw is triggered when the client requests AMS (Advanced Message Security) policy data and the client fails to properly validate the returned queue manager response; exploitation is unauthenticated from the client side (PR:N) but requires the attacker to operate a malicious or compromised queue manager or to man-in-the-middle the client-to-queue-manager channel, which is why the vector carries AC:H. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
Bransys ELD ships with hardcoded MQTT credentials that grant read access to real-time telemetry for active devices across a subset of carriers whose hardware was provisioned against the affected MQTT broker. An unauthenticated remote attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) who can reach that broker and recover the embedded credentials from firmware or client software can subscribe and read live operational data; impact is confidentiality-only (C:H/I:N/A:N) and is scoped to devices on that specific broker, not all Bransys customers. Reported through CISA ICS channels as ICSA-26-260-01, the exposure is rated 5.9 by both the vendor score and independent assessment; at time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit identified.
Improper validation of message header offset values in IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 allows an authenticated MQ user with network reach to an affected queue manager to trigger an out-of-bounds read, which can leak queue manager memory (high confidentiality impact) and crash the broker (high availability impact), yielding a CVSS 3.1 score of 8.1. Exploitation requires valid credentials - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - but no user interaction, and the requirement for authentication rules out anonymous abuse while the flaw is confined to the HPE NonStop platform port rather than all MQ deployments. No public exploit identified at time of analysis; a vendor patch is referenced in IBM's advisory.
Cross-site scripting in IBM Guardium Data Protection 12.2 lets a remote attacker who can reach the web management interface place script into an input that the application reflects into a generated page without output encoding, so JavaScript runs in the browser of any user who views that page. The vendor describes this as arbitrary code execution and scores it 8.1, but the weakness class is CWE-79 rather than a server-side code-execution primitive; our independent assessment rates it materially lower (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) because realistic exploitation needs a low-privileged foothold plus a victim with console access loading the crafted page, bounding impact to that user's session. No public exploit code was identified at time of analysis, and the issue is not listed in CISA KEV. Treat this as a high-CVSS-but-likely-overstated finding centered on console session abuse rather than host compromise.
Unauthenticated OS command injection in IBM Guardium Data Protection 12.2 allows a remote attacker with network reachability to a vulnerable appliance component to execute arbitrary operating system commands, yielding full confidentiality, integrity, and availability impact on the affected system. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1 High) confirms no authentication or user interaction is required, though the AC:H rating indicates exploitation depends on a precondition not fully specified by IBM rather than being reliably repeatable against any default install. No public exploit code or confirmed active exploitation was identified at time of analysis, but real-world risk is elevated because Guardium is a security-data platform that frequently holds sensitive audit and database activity records, and successful exploitation effectively equates to remote code execution on the appliance.
Authenticated users of LubeLogger prior to 1.6.8 - including non-administrative accounts - can abuse the translation file upload path to place or overwrite files outside the intended storage directory, because the RenameFile helper constructs the destination path by string replacement without verifying that the resolved absolute path remains under the web root or data directory. Exploitation requires only a valid low-privileged session and a crafted upload file name, giving the attacker the file-system rights of the application process, which is why the assessed impact is high integrity with limited availability and no confidentiality component. Vendor-released patch: 1.6.8; no public exploit identified at time of analysis.
OS command injection in IBM Guardium Data Protection 12.2 allows a remote, unauthenticated attacker to execute arbitrary operating system commands on the affected appliance, giving full compromise of confidentiality, integrity, and availability (CVSS 8.1, CWE-78). The assessed vector (AV:N/AC:H/PR:N/UI:N) means no credentials and no user interaction are needed, but exploitation is not a single deterministic request - the attacker must first satisfy a specific precondition such as a crafted payload meeting input constraints or a particular application/timing state, and the target's vulnerable network service must be reachable, which is uncommon for a security-monitoring appliance that is typically segmented. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available per the referenced IBM support advisory.
An external control of file name or path flaw in the Synology DiskStation Manager (DSM) Upload API allows remote authenticated users to write files to arbitrary locations on the appliance, which can be leveraged for data integrity tampering and denial-of-service against the NAS. The defect is reachable over the network with low attack complexity and no user interaction, but it requires a valid DSM account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1 High), so practical exposure is concentrated on low-privilege or compromised accounts and on DSM instances whose login interface faces untrusted networks. Affected builds are DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation. The dual integrity-and-availability impact, with no confidentiality effect, is what drives the High severity rating.
An authorization bypass in the Master Addons for Elementor WordPress plugin (all versions up to and including 3.2.2) lets any authenticated user with Contributor-level access or above rename, alter metadata on, or permanently delete arbitrary posts on the site. The flaw is a missing authorization check (CWE-862) in the plugin's popup-builder admin code: because the jltma_popup custom post type is registered with capability_type='post', Contributors can reach the edit-jltma_popup screen, harvest the nonce emitted there, and supply an attacker-controlled popup_id to reach posts they do not own. Exploitation requires an authenticated low-privilege account and no user interaction (CVSS 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H); no public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is a genuine priority for affected sites rather than a mass-exploitation emergency - exposure concentrates on sites with open registration or multiple untrusted authors.
Authorization bypass in IBM Guardium Data Protection 12.2 lets remote, unauthenticated network attackers (CVSS vector AV:N/PR:N/UI:N) reach the product's management/web interface and sidestep intended authorization checks, granting access to data-protection functions they should not be able to invoke. IBM scores the flaw 8.1 (HIGH) with full unscoped impact (C:H/I:H/A:H) and AC:H, while our independent assessment keeps the same unauthenticated network vector but lowers the assessed impact to C:L/I:L/A:L - meaning the practical effect is more likely unauthorized read/modification of limited functionality than complete compromise, with the high complexity reflecting a non-trivial precondition (a specific request state, timing, or authorization configuration) that the vendor does not disclose. No public exploit identified at time of analysis, and a vendor fix is available through IBM support node 7288035.
Missing role enforcement in WACRM 0.7.0 and earlier allows any authenticated user holding the low-privilege 'viewer' role to perform write operations that should be restricted to 'agent' or higher - creating, editing, activating, and deleting WhatsApp flows, creating and modifying automations, and triggering outbound WhatsApp sends through the automation engine. The affected route handlers (src/app/api/flows/[id]/route.ts, src/app/api/flows/[id]/activate/route.ts, src/app/api/flows/route.ts, src/app/api/automations/route.ts, and src/app/api/automations/engine/route.ts) check only account membership before writing through a service-role database client that bypasses row-level security, so the server-side RLS policies that would otherwise require the agent role never apply. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); exploitation requires only a valid viewer-level account on the target instance, making this a straightforward post-authentication privilege escalation with high integrity impact but no direct confidentiality loss.
Broken access control in HCL BigFix Service Management lets a low-privileged authenticated user reach administrative screens and functions reserved for higher-privileged roles, effectively escalating their privileges within the ITSM instance. Per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1 High), the attacker must already hold a valid standard-role account and can reach the application over the network without user interaction, obtaining full read and write capability over the exposed administrative functionality with no direct availability impact. No public exploit code has been identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV).
IBM Guardium Data Protection 12.2 accepts TLS peer certificates it should reject, letting an attacker positioned on the network path impersonate a trusted endpoint and bypass the security restrictions the encrypted channel is meant to enforce. The vector is PR:N and UI:N, so no credentials or user action are needed, but the practical barrier is the MITM foothold itself - ARP or DNS spoofing, a rogue access point, or a compromised intermediate segment - which is exactly why the score carries AC:H and why properly segmented deployments are largely shielded. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV; IBM has published a vendor fix.
Cross-site request forgery in IBM Guardium Data Protection 12.2 allows a remote, unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L, base 8.1) to bypass security restrictions by riding an already-authenticated administrator's browser session, producing high integrity impact on protected configuration. The attacker supplies no credentials of their own, but exploitation requires a victim who is currently logged in to Guardium to be tricked into loading attacker-controlled web content while that session is live, so no public exploit code has been identified at time of analysis. IBM has published a vendor patch via support page node 7288035, and deployments enforcing anti-CSRF tokens, SameSite cookies, or re-authentication for sensitive actions are materially less exposed.
Password reset token disclosure in SysReptor prior to 2026.58 allows an unauthenticated attacker who knows a victim's email address to request a reset email with a forged Host header, causing the generated reset link to point at an attacker-controlled system; when the victim follows the link, the reset token is disclosed and the attacker can reset the victim's password and fully take over the account. Exploitation is narrowly gated: the installation must enable email-based password reset (FORGOT_PASSWORD_ENABLED and LOCAL_USER_AUTH_ENABLED) with a configured email gateway (EMAIL_HOST), must run a professional license, and must have configured the Django ALLOWED_HOSTS setting with the wildcard '*'; installs with ALLOWED_HOSTS pinned to real domain names are not affected. Fixed in 2026.58, with no public exploit identified at time of analysis; the CVSS 3.1 base is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) driving a HIGH rating on unauthenticated network reach plus high confidentiality and integrity impact, although an independent assessment rates attack complexity as High because the wildcard host configuration is a non-default production-hardening miss rather than a shipped default.
Out-of-bounds reads in FluidSynth 2.5.0 through 2.5.5 can be triggered when the process loads and renders an attacker-controlled DLS soundfont, allowing memory disclosure and denial of service. Only builds compiled with the CMake option enable-native-dls enabled expose the vulnerable loader in src/sfloader/fluid_dls.cpp; builds with that option set to OFF are unaffected. The vendor rates this 8.0 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H), while independent assessment narrows the impact to confidentiality and availability (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) because the crafted file must reach the process locally and no public exploit code has been identified at time of analysis. A vendor-released fix is available in version 2.5.6.
CRLF injection in the Synology DiskStation Manager (DSM) User API lets a remote, low-privileged authenticated user (PR:L) who can also induce limited user interaction (UI:R) read or write arbitrary files on the appliance and trigger a denial-of-service condition that surfaces only after the next reboot. Deployments running DSM before 7.2.1-69057-10, before 7.2.2-72806-7, or before 7.3.2-86009-2 are affected; there is no public exploit identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). Because the flaw is a file read/write primitive, integrity and confidentiality impact is high, but it is gated behind a valid low-privileged DSM account rather than being unauthenticated mass-exploitable, and vendor-released fixed builds eliminate exposure.
Local privilege escalation in Microsoft Edge (Chromium-based) versions below 153.0.4234.46 stems from a use-after-free (CWE-416) memory corruption flaw that an attacker with an existing low-privileged foothold on a Windows host can trigger to elevate privileges. Exploitation requires local access and low privileges (AV:L, PR:L, UI:N) and is constrained by high attack complexity (AC:H) because the bug is timing/race-dependent, so it is not reliably or automatically triggerable (SSVC Automatable=no); the changed-scope rating (S:C) reflects impact that can cross a security boundary such as the browser sandbox. No public exploit code has been identified and EPSS is low at 0.22% (13th percentile), with no evidence of active exploitation in CISA KEV or SSVC (Exploitation=none), making this a genuine but moderate-priority patching item rather than a remotely wormable emergency.
Heap out-of-bounds write in OpenImageIO's Maya IFF decoder (src/iff.imageio/iffinput.cpp) lets a crafted .iff file corrupt heap memory in any application built against affected releases prior to 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1. The trigger is a zbuffer-only tiled IFF whose Z-depth data is exposed through a 16-bit public ImageSpec while the decoder keeps a 32-bit internal pixel size, combined with a failure path that leaves m_buf partially populated so a later read_native_tile() copies half-initialized data into an undersized caller buffer sized by m_header.pixel_bytes() instead of ImageSpec::tile_bytes(true). The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) confirms no privileges are required but the attack is local and depends on a victim or pipeline opening the malicious image; no public exploit code or active exploitation has been identified at time of analysis, and risk is highest in automated render/asset pipelines that batch-process untrusted IFF files without human review.
Out-of-bounds heap read and write in FluidSynth's MIDI player channel-tracking logic corrupts memory whenever the synth.midi-channels setting is configured above its default of 16, letting a local user who can influence that configuration crash the synthesizer and potentially achieve memory corruption with confidentiality, integrity and availability impact in the playing process. All releases from 2.2.4 up to but not including 2.5.6 are affected; the unsafe state is created by configuration alone plus ordinary playback, so no specially crafted MIDI file is required. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, and although the assessed CVSS 3.1 score is 7.8 High (AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H), the real-world risk is materially lower because default installations that leave synth.midi-channels at 16 never reach the vulnerable path.
Decoding a crafted tiled OpenEXR image with OpenImageIO releases prior to 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1 can corrupt the heap, because the tiled reader copies decoded rows into the caller's buffer using a padded whole-tile stride instead of the width of the requested rectangle; affected files are those whose width is not an exact multiple of the tile width and are read as a partial edge-tile rectangle. The flaw is reachable without any privileges (PR:N) but requires the victim to open or process the malicious file (UI:R) and is scored as a local-vector bug (AV:L), yielding CVSS 7.8 with high confidentiality, integrity, and availability impact; both the classic and OpenEXR-Core readers (src/openexr.imageio/exrinput.cpp and exrinput_c.cpp) are affected. No public exploit identified at time of analysis, and vendor fixes are available in the three named release lines.
Local privilege escalation in the virtio-win Viosock (vsock) paravirtualized driver, builds mm210 through mm319, lets an attacker who already has low-privilege code execution inside a Windows guest corrupt kernel memory and escalate to SYSTEM. The driver's IOCTL_SELECT handler adds three attacker-controlled descriptor counts with 32-bit arithmetic, so an integer-wrapped total passes the FD_SETSIZE bounds check while an individual fd_count remains far above the expected limit; the subsequent copy routine then walks the unchecked count and writes past the NonPagedPool-allocated pPkt->Fds array. Exploitation is local only (AV:L) and requires a low-privileged foothold (PR:L) with no user interaction; no public exploit code was identified at time of analysis, and the vendor fixed the issue in build mm320 via commit c6bef93d7909584bbda4e5c87603ea175825f342.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows a low-privileged local attacker to execute arbitrary commands as root by exploiting insufficient argument validation in the SUID-root nmap_wrapper binary on the Collector appliance, resulting in full compromise of the Collector. The vulnerability requires existing low-privileged local shell access to the Collector and is not remotely exploitable. No public exploit code or confirmed active exploitation has been identified at the time of analysis; a vendor patch is available.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows an authenticated, low-privileged user with existing access to the appliance host to raise their privileges to a higher level, affecting confidentiality, integrity and availability of the platform. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires a pre-existing local account and low complexity but no user interaction; it is an escalation step rather than a remote entry vector, so risk is concentrated on collector/aggregator hosts where untrusted or lower-tier accounts or shells already exist. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; this is a genuine but moderate-priority local privilege escalation rather than an actively exploited campaign.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows an attacker who already holds a low-privileged local account on the appliance - such as a constrained operator role, a compromised low-privileged process, or a malicious insider - to gain elevated privileges, with full compromise of confidentiality, integrity, and availability of the affected system. The flaw (CWE-269, improper privilege management) is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring no user interaction and no network-facing path; the local-access prerequisite makes it a post-compromise escalation step rather than a remote entry point. No public exploit code or confirmed active exploitation has been identified at time of analysis, and IBM has published a vendor patch advisory.