Quarkus HTTP security path-normalization discrepancy allows unauthenticated remote attackers to craft a URL that the security matcher treats as public while the dispatcher routes it to a protected endpoint, bypassing path-based authorization and reading sensitive data (CVSS 3.1 7.5, C:H/I:N/A:N). This affects deployments that rely on Quarkus HTTP security path-pattern policies to gate confidential endpoints; applications using only handler-level role or annotation checks are not bypassed this way. No public exploit identified at time of analysis.
Remote unauthenticated attackers can exhaust memory in Netty-based services that parse PROXY protocol v2, due to a reference-count leak in the handling of nested TLVs within HAProxyMessageDecoder, leading to denial of service. The flaw is an incomplete fix of upstream PR #16881, so partially patched deployments may remain vulnerable through the grandchild-TLV code path. It affects numerous Red Hat products bundling Netty, such as JBoss EAP 7, Keycloak, and Quarkus, and no public exploit code has been identified at time of analysis.
Denial of service in Apache Neethi before 3.2.4 lets unauthenticated remote attackers pin CPU for extended periods by supplying a crafted pair of WS-Policy documents to an application that runs them through Neethi's policy-intersection logic. The flaw is an uncontrolled resource-consumption issue (CWE-770) in which a small, carefully constructed input drives exponential work, and CISA's SSVC framework rates it automatable; no public exploit code has been identified at time of analysis. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), confidentiality and integrity are untouched and scope is unchanged, so practical exposure is limited to SOAP/web-services deployments that actually intersect untrusted, client-supplied policy documents.
Denial of service in Red Hat's Camel-based and Java middleware products (Red Hat Build of Apache Camel for Spring Boot 4, Red Hat Fuse 7, JBoss EAP 7, and Red Hat Single Sign-On 7): a STOMP frame that declares an oversized content-length is truncated from a 64-bit long to a 32-bit integer, yielding a wrapped/negative length that leaves the STOMP decoder unable to advance, so it loops indefinitely and burns CPU on the affected message-processing thread. The flaw is remotely reachable and unauthenticated per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), but exposure is strictly limited to deployments that actually enable a network-reachable STOMP listener - products without a configured STOMP endpoint are not attackable. No confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis.
Malformed HTTP/2 CONNECT stream injection in Red Hat JBoss EAP and the wider Red Hat middleware stack (Quarkus, Keycloak, Camel for Spring Boot 4 and Quarkus 3, Data Grid 8, AMQ Broker 7, Fuse 7, Apicurio Registry 3, Debezium 3) lets unauthenticated remote attackers control the :authority of an upstream HTTP/2 CONNECT when the product is deployed as an HTTP/1-to-HTTP/2 translating proxy or gateway. The client-supplied Host header from an HTTP/1 authority-form CONNECT is copied verbatim into the HTTP/2 :authority pseudo-header, so the fronting component and the HTTP/2 backend can disagree about the routing target, yielding an integrity impact (vendor CVSS 3.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N; our assessment raises the attack complexity to High and the scope to Changed because a H1→H2 CONNECT translation path and a fronting-proxy topology are required). No public exploit identified at time of analysis, and no EPSS or CISA KEV data was provided.
Remote, unauthenticated attackers can exhaust CPU and memory on Suricata 8.0.0 through 8.0.5 sensors by sustaining application-layer traffic on flows that are handled by a pass rule or a pass-the-flow exception policy, degrading the IDS/IPS to a denial-of-service condition. The defect is an inverted guard in AppLayerParserSetTransactionInspectId() that marks only already-inspected transactions as inspected, so on those pass-handled flows detection is skipped and completed transactions are never marked or freed, accumulating in the per-flow list and being rescanned with quadratic cleanup cost. Only availability is affected (C:N/I:N/A:H); the issue is fixed in Suricata 8.0.6, and no public exploit has been identified at time of analysis, with no CISA KEV listing.
Denial of service in Netty's MQTT decoder lets unauthenticated remote attackers exhaust server memory and CPU by sending a crafted CONNECT packet whose Properties Length is enormous while its Remaining Length stays small, bypassing the maxBytesInMessage guard that was added to fix CVE-2026-44248. The issue affects any Netty pipeline that runs io.netty.handler.codec.mqtt.MqttDecoder and exposes an MQTT listener; downstream Red Hat products such as AMQ Broker 7, Fuse 7, JBoss EAP 7, Red Hat Single Sign-On 7, and Red Hat Build of Apache Camel for Spring Boot 4 are listed as affected. No public exploit has been identified at time of analysis, and the practical risk is bounded by the need to expose an MQTT endpoint.
Unauthenticated SQL injection in WP Multi Store Locator Pro, affecting all versions up to and including 4.5.1, lets any anonymous visitor append arbitrary SQL to the plugin's store search query and read sensitive data from the underlying WordPress database, including user credential hashes and other plugin or core records. The vulnerable entry point is the store_locatore_search_radius parameter, handled by an AJAX action registered on wp_ajax_nopriv_make_search_request with no nonce or capability check, so the only prerequisite is that the plugin is installed and active on a default WordPress site. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; exploitation intelligence is thin, but the code path is trivially reachable and the numeric, unquoted SQL context defeats WordPress's addslashes-based request sanitization, which supports the assessed CVSS 7.5 (C:H, no integrity or availability impact).
Netty's codec-rtsp component silently normalizes away trailing control bytes in RTSP method tokens, so a wire request whose method token ends in a byte with code point <= 0x20 immediately before the separating space (for example PLAY\x00 or PLAY\r) is decoded as a fully successful PLAY request with decoderResult().isSuccess() == true and request.method() referencing the same cached singleton object, leaving the application layer unable to distinguish it from a clean PLAY. This is a remote, unauthenticated, low-complexity integrity flaw (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) affecting any product that embeds Netty and exposes an RTSP listener, including the Red Hat components named in the advisory such as AMQ Broker 7, AMQ Clients, Quarkus, Camel for Quarkus 3/Spring Boot 4, Keycloak, JBoss EAP 7/8, Single Sign-On 7, Data Grid 8, Fuse 7, Debezium 3, and Apicurio Registry 3. Real security impact is gated on a downstream disagreement: a front-end proxy, WAF, gateway, or access-control layer must parse the RTSP method differently from Netty for method/request smuggling to produce genuine integrity effects, and exposure is narrow because RTSP listeners are far less commonly internet-facing than HTTP. Exploitation status: no public exploit identified at time of analysis and no CISA KEV confirmation, though the upstream advisory itself documents a minimal wire-level reproduction at a high level.
Denial of service in Suricata 8.0.5 allows remote, unauthenticated attackers to degrade an IDS/IPS sensor's packet processing by sending crafted FTP command data. When a single large chunk of FTP commands exceeds the configured app-layer.protocols.ftp.max-tx limit, the FTP parser keeps allocating transactions and then repeatedly walks the oversized transaction list with quadratic cost, triggering the too_many_transactions event and driving CPU consumption that reduces monitoring visibility or stalls inspection entirely. Impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) and is confined to the single 8.0.5 release; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Suricata 8.0.0 through 8.0.5 can be degraded into a denial-of-service condition by a remote, unauthenticated attacker who streams repeated small brotli-compressed HTTP/1 responses through a single inspected flow. The HTTP/1 parser caps the decompression work done per transaction but does not cap how many compression bombs a flow may submit, so each transaction forces the Rust htp decompression path to burn CPU until packet processing slows and monitoring visibility is lost; availability-only impact, with no confidentiality or integrity effect (CVSS base 7.5, CWE-400). Exploitation is gated on the non-default response-body-decompress-layer-limit setting being enabled and on the sensor seeing attacker-influenced traffic, and no public exploit or in-the-wild activity is identified at time of analysis; the vendor fixed the issue in Suricata 8.0.6.
Denial of service in Suricata versions 8.0.0 through 8.0.5 allows unauthenticated remote attackers to exhaust sensor CPU and degrade packet-processing throughput by sending crafted DNS-over-HTTP/2 traffic. The HTTP/2 DoH parser retains previously processed DATA frame contents instead of clearing its internal buffer, so a series of DATA frames with the EndOfStream flag set repeatedly reprocesses old data while the buffer grows toward its 65 KiB limit, yielding quadratic CPU cost and potential loss of network monitoring visibility. No public exploit identified at time of analysis, and the flaw is not confirmed actively exploited (CISA KEV); vendor-released patch 8.0.6 closes the issue.
Unauthenticated remote connection flooding against the cockpit-tls front-end of Cockpit (the TLS terminator for the Cockpit web console, default TCP 9090) forces the service to spawn an unbounded number of detached threads, exhausting memory and file descriptors until the console degrades or becomes unavailable. The flaw, tracked as CWE-770 (allocation of resources without limits or throttling), carries a 7.5 CVSS score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects Cockpit as shipped in Red Hat Enterprise Linux 7, 8, 9, and 10 as well as Red Hat OpenShift Dev Spaces; the CVSS vector confirms the attack needs no authentication or user interaction. Exploitation is bounded to availability of the management console rather than the underlying host services, CISA's SSVC assessment records Exploitation: none (automatable: yes, technical impact: partial), and no public exploit code was identified at time of analysis. Because the primitive is simply 'open many concurrent TCP connections,' it is highly automatable and becomes a practical risk anywhere port 9090 is reachable from an untrusted network.
Heap exhaustion in Netty's Redis array aggregator, as shipped inside Red Hat products such as JBoss Enterprise Application Platform 7, Red Hat Fuse 7, Red Hat Build of Apache Camel for Spring Boot 4, and Red Hat Single Sign-On 7, lets a remote unauthenticated attacker crash the JVM by sending a tiny stream of nested RESP array headers. Because the decoder eagerly allocates an ArrayList sized to the declared array length before any child element arrives, roughly 12 KB of crafted input can reserve about 1.02 billion child slots when the default 1024-level nesting limit and default element limit are in effect; the impact is availability-only, with no data read or modified. Exploitation is limited to deployments that feed attacker-reachable, untrusted RESP/Redis-protocol traffic into the Netty codec with the default constructor; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Serialization of Node.js Buffer objects in the JavaScript library devalue 5.1.0 through 5.9.2 leaks unrelated process memory: when stringify, stringifyAsync, or uneval encounters a Buffer, it emits the view's entire backing ArrayBuffer instead of only the visible bytes, and because small Buffers are carved from Node's process-wide shared allocation pool, the serialized output can include up to roughly 64 KB of memory belonging to other in-flight requests. Any server-side-rendered application that serializes a Buffer into HTML without authentication - a SvelteKit or Nuxt page whose load() returns a small Buffer or reads a small file - can therefore publish another user's request body or Authorization header in a public response, and the flaw triggers on every such render because it occurs during serialization rather than parsing, so the library's parse/unflatten prototype-pollution and denial-of-service guards provide no protection. Unauthenticated remote attackers need no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5), the affected CPE is cpe:2.3:a:sveltejs:devalue:*, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Memory exhaustion in Netty's SMTP client response decoder (SmtpResponseDecoder) allows an attacker who controls or can intercept the SMTP server that an application talks to, to force that application to accumulate unlimited multi-line responses until heap is exhausted. The defect is a pure availability issue (C:N/I:N/A:H, CVSS 7.5, AV:N/AC:L/PR:N/UI:N) and is reachable without authentication or user interaction on the victim side, but exploitation is conditional: the vulnerable JVM must have Netty's SMTP client codec active and must establish an SMTP session with a hostile or man-in-the-middle peer, since only server responses are parsed. Shipping products affected through bundled Netty include Red Hat JBoss Enterprise Application Platform 7, Red Hat Fuse 7, Red Hat Single Sign-On 7 and Red Hat Build of Apache Camel for Spring Boot 4; no public exploit code has been identified at time of analysis and there is no confirmed CISA KEV entry.
Detection bypass in OISF Suricata before 7.0.17 and 8.0.6 lets an unauthenticated remote attacker who can craft an aligned IPv4/IPv6 flow pair make the engine treat the two flows as one, corrupting flowbit and IP-only state so signatures may fail to fire. The root cause is a family-blind comparison in src/flow-hash.c (CWE-697, CVSS 5.9, AV:N/AC:H/PR:N/UI:N/I:H), reflecting a targeted technique rather than opportunistic scanning because the attacker must line up raw address words, ports, protocol, VLAN, recursion level, live device and hash bucket across families. Impact is confined to the IDS/IPS's own detection-integrity logic - no host confidentiality or availability loss was assessed - and no public exploit code was identified at time of analysis, though vendor patches are available in 7.0.17 and 8.0.6.
SMTP command injection in Netty's netty-codec-smtp allows unauthenticated remote attackers to inject arbitrary SMTP commands via CRLF sequences in the command-name field, affecting applications built on Netty such as Red Hat Build of Apache Camel for Spring Boot 4, Red Hat Fuse 7, JBoss EAP 7, and Red Hat Single Sign-On 7. This is an incomplete fix of CVE-2025-59419, requiring attacker-controlled input to reach the SMTP command name and a downstream SMTP server that acts on smuggled commands; no public exploit identified at time of analysis. Integrity impact is high, while confidentiality and availability are unaffected.
Unauthenticated remote attackers can cause a gradual denial of service in applications that use Netty's STOMP codec by sending a STOMP frame body without the terminating null byte; StompSubframeDecoder leaks a ByteBuf for each such frame, so sustained traffic exhausts JVM heap or direct memory. The issue carries CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning network-reachable, no authentication or user interaction, availability-only impact. Red Hat middleware products listed in CPE data are affected when STOMP-over-TCP/WebSocket is enabled; no public exploit code or confirmed active exploitation was identified at time of analysis, and a practical DoS requires repeated frames rather than a single packet.
Unauthenticated arbitrary file read and server-side request forgery in NUUO Network Video Recorder 2.0.0 allow a remote attacker to submit a crafted url parameter via POST to up.php, causing fopen() to retrieve a local file (or remote/internal URL) whose contents are then staged under /tmp/ using a basename()-derived filename. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) is consistent with the description's no-authentication requirement, indicating a low-complexity, confidentiality-only flaw reachable by anyone with network access to the NVR web service. Publicly available exploit code exists (SSVC Exploitation: poc, Automatable: yes, Technical Impact: partial), but the CVE is not listed in CISA KEV, so active exploitation is not confirmed; EPSS is low at 0.20% (10th percentile), and practical exposure is further reduced because the fetched content is written to /tmp/ rather than returned inline and NVRs are typically deployed on segmented internal networks.
Apache Airflow versions before 3.3.2 gate the asset queued-events DELETE endpoints on the read-only Dag permission (GET) instead of the write permission (PUT), so any authenticated user holding Dag read access can delete a Dag's queued asset events and silently suppress that Dag's asset-triggered scheduling. Exploitation requires valid credentials with Dag READ but not Dag EDIT on the target Dag - the normal RBAC arrangement, since read is usually granted more widely than edit - and only matters where asset-triggered scheduling is in use; the assessed impact is integrity-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), with no confidentiality or host availability loss. No public exploit code or active exploitation was identified at time of analysis, and EPSS is low (0.17%, 7th percentile), though the bug is trivially reproducible by hand against the three affected REST routes.
Remote denial of service in osmo-iuh's HNBGW (Home NodeB Gateway) lets a network-reachable peer on the Iuh interface crash the process by sending a RANAP connection-oriented direct-transfer message carrying an arbitrarily sized NAS-PDU, which trips a reachable assertion in ranap_handle_co_dt(). Per the CVE description the affected range is osmo-iuh 1.10.0 through 1.14.5, although the ENISA EUVD entry lists a much narrower 0.1.0 <1.8.0 scope and the supplied CPE points at osmocom:osmo-bsc, so the exact affected version set should be confirmed against the vendor advisory. Impact is availability-only (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; SSVC Technical Impact: partial) with no confidentiality or integrity loss; there is no CISA KEV listing, no public exploit code identified at time of analysis, and EPSS is low at 0.17% (7th percentile).
An out-of-bounds read in Osmocom libsmpp34 allows remote attackers to disclose adjacent process memory when a crafted SMPP 3.4 PDU is passed to the smpp34_unpack() parser. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) describes an unauthenticated, low-complexity network-triggerable read with high confidentiality impact and no integrity or availability impact, meaning the practical effect is memory disclosure and potentially a crash rather than the broader 'memory corruption' implied by the description text. Risk is tempered by the library's niche deployment as telecom SMS/SMPP middleware, a low EPSS of 0.16% (5th percentile), and CISA SSVC rating of no known exploitation; no public exploit code was identified at time of analysis. A vendor patch exists, and the fixed boundary identified in EUVD advisory data is version 1.14.5.
Remote denial of service in Osmocom osmo-bsc 1.0.1 through 1.14.1: a heap-based buffer overflow in ipaccess_proxy_read_msg() is triggered when a crafted IPA frame carries an attacker-controlled length value that is used without adequate validation against the actual buffer size. The issue is remotely reachable and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) from any host able to talk to an osmo-bsc instance with the ipaccess proxy component deployed, and the assessed impact is availability-only (C:N/I:N/A:H), meaning a successful trigger corrupts heap memory and crashes the process. There is no public exploit identified at time of analysis and EPSS is a low 0.14% (4th percentile), consistent with the deployment reality that BSC signaling paths such as the IPA/A-bis proxy are normally confined to segmented, non-public operator networks.
Denial of service in libheif 1.23.1 and earlier: decoding a crafted HEIF/AVIF file whose derived-image reference graph (grid, iovl, or iden items) points many branches at a common base image causes the decoder to re-decode that base image repeatedly, exhausting CPU and, depending on tile handling, memory. The flaw is unauthenticated and remotely triggerable (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) against any service that automatically decodes attacker-supplied files - upload pipelines, thumbnailers, and transcoders are the highest-value targets - while desktop viewers require the user to open the file, effectively adding user interaction. Impact is availability-only (no code execution, disclosure, or modification), and no public exploit code was identified at time of analysis, though the weaponized input is a small, trivially constructed file. Vendor-released patch: 1.23.2.
Denial of service in libheif 1.19.0 through 1.23.1 allows unauthenticated remote attackers to exhaust process memory and terminate the application by supplying a crafted HEIF or AVIF file whose compressed mime metadata or unci image data is decompressed without an effective output bound. According to the CVSS vector (AV:N/AC:L/PR:N/UI:N) no privileges or interaction are required, so automated server-side image ingestion pipelines that parse untrusted HEIF/AVIF content are the most exposed; interactive desktop viewers still require a user to open the malicious file. Impact is availability-only (crash/OOM, no code execution or data disclosure), no public exploit code has been identified at time of analysis, and the issue is fixed in libheif 1.23.2.
Heap corruption in IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 allows an authenticated remote user with a valid MQ session to crash the queue manager via a crafted MQINQ inquire request, and the same integer-overflow defect in request validation creates the potential for privilege escalation under specific memory-layout conditions. The issue is rated 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning credentials are required and the overflow is non-trivial to trigger reliably; there is no public exploit code and no public exploit identified at time of analysis, and IBM has published a vendor fix. Risk is further bounded because exploitation is confined to the specialized HPE NonStop platform running the affected 8.1.0.x maintenance levels, so deployments that have applied the patched level are not exposed.
Remote unauthenticated denial of service in µD3TN v0.15.0: an integer overflow (CWE-190) in the TCPCLv3 handshake processing path leads to a heap overflow that, per the reported analysis, reliably crashes the daemon. Any host able to reach a µD3TN node's TCPCLv3 listener can trigger it without credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), but the impact is confined to availability - no confidentiality or integrity loss and no code execution is indicated. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); exploitation also requires the deployment to actually run TCPCLv3 rather than another convergence layer.
Unauthenticated SQL injection in the Location Manager plugin for WordPress allows remote attackers to read arbitrary data from the underlying database. Every installation running version 2.3.38 or earlier is exposed, because the publicly reachable REST routes geodir/v2/locations/cities, /regions, /countries and /neighbourhoods pass the 'latitude' and 'longitude' parameters into SQL through the get_locations() and get_neighbourhoods() functions without escaping or query preparation whenever orderby=lat_lon is supplied. No authentication, user interaction, or non-default configuration is needed, giving the issue a CVSS 3.1 base score of 7.5 with high confidentiality impact; no public exploit code has been identified at time of analysis and there is no evidence of active exploitation.
Unauthenticated directory traversal in the Printcart Web to Print Product Designer for WooCommerce WordPress plugin (all versions up to and including 2.8.5) allows remote attackers to read arbitrary files on the underlying server by manipulating the 'mockups' parameter, exposing configuration files, wp-config.php-style secrets, and other sensitive data. The traversal is gated only by a 'nbdesigner-get-data' nonce, but that nonce is freely minted to anonymous visitors by the plugin's own nbd_check_use_logged_in nopriv AJAX endpoint, and the check disappears entirely if the NBDESIGNER_ENABLE_NONCE constant is disabled, so authentication requirements are effectively nil (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Impact is limited to confidentiality - integrity and availability are unaffected, and the depth of file access is bounded by the web server user's filesystem permissions. No CISA KEV listing and no public exploit code identified at time of analysis, though the low attack complexity and the absence of a confirmed patched release make exposed storefronts a high-priority remediation target.
An authentication bypass in ManageEngine DataSecurity Plus deployments running builds earlier than 6310 allows unenrolled agents to send requests to the server's agent communication interface without completing enrollment or authentication, potentially exposing or altering the data that interface handles. The vulnerability is remotely reachable and requires no user interaction and no prior authentication (CVSS vector PR:N/UI:N), though the vendor's AC:H rating and our own lower independent assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicate the practical impact is modest and gated by preconditions such as knowledge of the proprietary agent request format. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so active exploitation is unconfirmed; the risk is hard to pin down because the vendor advisory is the only source and the description is terse.
OS command injection in IBM Guardium Data Protection 12.2 allows a privileged authenticated attacker to execute arbitrary commands with root-level privileges through the Universal Connector plugin upload feature. The flaw carries a CVSS 3.1 base score of 7.2 (HIGH) under the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, reflecting network reachability and full confidentiality, integrity and availability impact, though exploitation is gated behind a high-privilege account. No public exploit code is identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Command injection in IBM Guardium Data Protection 12.2 lets an authenticated, highly privileged administrator execute arbitrary shell commands with root privileges by supplying a crafted filename to the 'import remotelog_config file' CLI command. Successful exploitation compromises the confidentiality, integrity, and availability of the appliance, and no public exploit has been identified at time of analysis. IBM has released a fix via its support advisory, so exposure is limited to unpatched 12.2 deployments whose administrative CLI access is reachable by an attacker.
Heap-based out-of-bounds write in libheif prior to 1.23.2 lets an attacker who can supply an independently constructed tile image to the uncompressed-codec tiled encoding path corrupt memory past the heap output buffer. The flaw is only reachable when the library is built with WITH_UNCOMPRESSED_CODEC enabled and the host application uses the tiled writing API (heif_context_add_image_tile), which makes the encoder encode rather than decode attacker-influenced data; because that path is an encoder-side, build-optional feature requiring a specific application design, the vendor's AC:H rating is appropriate. CVSS is 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) with high integrity and availability impact but no confidentiality impact, and no public exploit code or active exploitation has been identified at time of analysis; a vendor fix is available in 1.23.2.
Cross-origin data exposure in RESTEasy's CorsFilter (CVSS 7.4) occurs when a deployment is configured with allowedOrigins set to the wildcard '*' together with allowCredentials=true, causing the filter to reflect the caller's Origin header back in Access-Control-Allow-Origin alongside Access-Control-Allow-Credentials: true. Because that configuration defeats the browser's built-in guard against combining wildcard origins with credentials, an attacker who lures an already-authenticated user (UI:R) to an attacker-controlled page can issue credentialed cross-origin requests and read that user's authenticated API responses - a confidentiality-only impact (C:H/I:N/A:N), with no integrity or availability effect. The prerequisite wildcard-plus-credentials CORS configuration is a non-default operator choice, and analysis identifies no public exploit identified at time of analysis.
Command injection in the 'create csr wildcard' CLI command of IBM Guardium Data Protection 12.2 allows an authenticated privileged CLI user to embed shell metacharacters in the 'alias' input, breaking out of the restricted CLI and executing arbitrary commands with root privileges on the appliance. The CVSS v3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2 High) confirms this is not an unauthenticated remote compromise: the attacker must already hold privileged CLI credentials and CLI access, typically over SSH, making this fundamentally a restricted-shell-to-root privilege escalation rather than an external initial-access vector. Impact is total for confidentiality, integrity, and availability of the appliance given the root-level execution context; no public exploit code was identified at time of analysis, and CISA KEV does not list this CVE as actively exploited.
Improper authorization in IBM Guardium Data Protection 12.2 lets a remote attacker who already holds a valid low-privilege account reach functions or data that the platform's access controls are supposed to withhold, effectively bypassing security restrictions. The defect maps to CWE-285 (Improper Authorization); IBM rates it 7.4 while our independent assessment scores it 7.4-class only with scope unchanged, yielding a moderate 6.3-level risk because confidentiality, integrity, and availability impacts are all low. Authentication is required (CVSS vector PR:L), no user interaction is needed, and no public exploit code has been identified at time of analysis. A vendor patch is available via IBM support node 7288035, so remediation is straightforward for organizations that can schedule an upgrade.
TLS server identity verification bypass in PJSIP 2.17 and earlier can let an on-path attacker impersonate a SIP server and capture REGISTER credentials. The OpenSSL and GnuTLS backends in pjlib/src/pj/ssl_sock_ossl.c and pjlib/src/pj/ssl_sock_gtls.c copy DNS SubjectAltName values using string functions that recompute length and therefore truncate at an embedded NUL byte, so when server verification is enabled through --tls-verify-server, a certificate whose DNS SAN is the target hostname prefix followed by an embedded NUL and an attacker-controlled suffix is accepted for the prefix hostname. No public exploit code or confirmed active exploitation (no CISA KEV listing) was identified at time of analysis, and exploitation remains gated on the attacker holding such a certificate from a trusted issuer - compliant public CAs reject embedded-NUL SANs - plus an on-path interception position, which is what drives the high attack complexity even though the vector is network-reachable and unauthenticated.
Arbitrary code execution is possible on IBM Guardium Data Protection 12.2 when a remote attacker who already holds high-privilege credentials abuses a file-handling feature that fails to constrain a user-supplied pathname to its intended restricted directory (CWE-22). The requirement for HIGH privileges (PR:H) on the management interface is the primary limiting factor, restricting realistic exploitation to trusted administrative accounts on an appliance that is normally deployed on internal or segmented networks, though no user interaction is required (UI:N). The vendor has published a fix advisory, and no public exploit identified at time of analysis (no CISA KEV listing and no published proof-of-concept in the supplied intelligence).
Local privilege escalation in uutils coreutils before 0.10.0: the `install` utility applies a requested setuid/setgid mode (for example -m 4755 or -m 2755) to the destination before performing the requested ownership change, so if the underlying chown(2) call fails the file is left behind as a setuid/setgid executable owned by the privileged invoker who ran the command. Affected are uutils coreutils releases from 0.0.18 up to but not including 0.10.0 (CPE cpe:2.3:a:uutils:coreutils:*:*:*:*:*:*:*:*) on capability-restricted hosts where chown can actually fail, such as environments with euid != 0 or a dropped CAP_CHOWN; a local, authenticated low-privileged operator who can invoke `install` can then execute the leftover binary with elevated privileges. There is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was provided; the honest risk picture is a genuine but modest-priority local flaw (CVSS:4.0 7.3 AV:L/AC:H/AT:P/PR:L, our independent CVSS:3.1 assessment AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), not a mass-exploitable remote issue, because on unrestricted systems where chown succeeds the setuid bits are correctly cleared and re-applied.
Missing object-level authorization in the OpenStack Blazar V2 lease API allows any authenticated user to modify or delete leases belonging to other users and projects if they know the target lease UUID. The defect affects Blazar releases before 17.0.1 and arises because the oslo.policy authorize() wrapper resolves the wrong request parameter, so the ownership check silently degrades into comparing the requester against their own project_id and user_id and therefore always passes. No public exploit code has been identified at time of analysis, and exploitation requires a valid cloud credential plus a deployment that actually runs the optional reservation service, but the integrity and availability impact on lease objects is high because reservations underpin the scheduled resource allocations of other tenants.
SQL injection in SiYuan versions before 3.8.3 allows unauthenticated remote readers, in deployments running publish/sharing mode, to execute arbitrary SQL against the read-write database through the getGraph endpoint and exfiltrate private data across notebooks. The CWE-89 flaw arises in graph.go's query2Stmt function, where tag values are concatenated raw into SQL string literals without escaping single quotes, and it can be reached via inline HTML span tags. The vendor released a fix in 3.8.3, and no public exploit code or CISA KEV confirmed active exploitation was identified at time of analysis; the CVSS 4.0 base score is 7.2 (High) with high confidentiality impact.
Stored cross-site scripting in the Popup Maker WordPress plugin (all versions up to and including 1.24.0) allows unauthenticated visitors to inject arbitrary web scripts through the values[Name] field of an optin, newsletter, or subscriber form, with the payload stored server-side and later rendered in the WordPress admin. Execution is not automatic: it is gated on a logged-in administrator opening the Popup Maker Subscribers list table and clicking a contextual help-tab anchor, which routes the attacker-controlled value into the jQuery(link.attr('href')) DOM sink in wp-admin/js/common.js. The vendor/Wordfence CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), though the required privileged admin interaction is better reflected as UI:R; no public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis.
Stored cross-site scripting in the Jeg Elementor Kit WordPress plugin (all versions up to and including 3.2.16) allows unauthenticated attackers to inject arbitrary JavaScript into comment content, which then executes in the browser of any user who later views the affected page. The attack is conditional rather than universal: the targeted post must also render a legitimate Jeg Kit Countdown widget, which causes the plugin's countdown frontend script to be enqueued and to initialize on any matching DOM element - including forged Countdown widget markup smuggled into a published comment - and comments must be enabled and the malicious comment published (sites that hold first-time comments for administrator moderation break the unauthenticated path). The vendor rates this CVSS 3.1 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), while our independent assessment scores it AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N given the widget dependency, moderation gate, and victim-visit requirement; impact is confined to client-side script execution with no availability impact, and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the Complianz GDPR/CCPA Cookie Consent Banner WordPress plugin, affecting all versions up to and including 7.5.4, allows unauthenticated attackers to embed arbitrary JavaScript in comment content that later executes in the browser of anyone viewing the approved comment page. Realistic exploitation is gated by three conditions that must all hold: a site administrator must approve the attacker's submitted comment, the Elementor page-builder plugin must be installed and active, and Complianz must be configured with the Twitter or Facebook cookie/script blocker enabled so comment content is routed through the vulnerable cookie-blocker regex path; independent assessment rates the vector as AC:H/UI:R despite PR:N, since exploitation depends on a moderator action and a specific third-party configuration. No public exploit code was identified at time of analysis, and there is no confirmed active exploitation (no CISA KEV listing); a vendor patch is available in version 7.5.5.
Privilege escalation in the Booking Calendar plugin for WordPress (wpdevelop, cpe:2.3:a:wpdevelop:booking_calendar) in all versions up to and including 11.8.2 lets an authenticated user holding Editor-level capabilities or higher promote themselves to Administrator and seize control of the site. The wpbc_ajax_option_save AJAX action writes an attacker-supplied option name straight into update_option() because the handler's per-option safeguards only cover names explicitly registered via register_option_policy(), so unregistered options - including core WordPress settings - receive an empty policy and skip every can_save, force_mode, and allowed_keys check; an attacker can therefore set default_role=administrator and users_can_register=1 and then register a new administrative account. The embedded nonce check offers no real barrier since both the nonce value and nonce action are attacker-controlled POST parameters and a valid nonce can be fetched from admin-ajax.php?action=rest-nonce; exploitation requires an authenticated Editor+ account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H per our assessment), no public exploit code has been identified at time of analysis.
An incomplete deny-list in ArcadeDB's polyglot script sandbox allows an authenticated user who holds the UPDATE_SCHEMA privilege (enough to create or alter a JavaScript trigger, but explicitly not server-admin rights) to reach the inherited static ResourceBundle.getBundle(String) method and read .properties resources from the application classpath, disclosing packaged configuration such as database credentials and API keys. Affects ArcadeDB (Maven com.arcadedb:arcadedb-engine) through 26.8.1 and is graded 7.1 (CVSS 4.0 PR:L, confidentiality-only; independently assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code was identified at time of analysis, and the vendor advisory explicitly limits impact to classpath resource disclosure - not arbitrary host filesystem read and not remote code execution - with the fix released in 26.9.1.
Authenticated users of ClipBucket v5 through 5.5.3 can extract arbitrary data - including credential hashes - from the underlying database by abusing a time-based blind SQL injection in the back-office bulk photo-deletion handler. The root cause is a parameter-type bypass: submitting the check_photo parameter as an array causes its elements to slip past the clean_requests() sanitization in ClipBucket.class.php and reach photo_exists() in photos.class.php, where non-numeric values are concatenated directly into a SQL query. Exploitation requires a valid ClipBucket account able to reach manage_photos.php (CVSS vector shows PR:L, unauthenticated access is not sufficient), the injection is blind and time-based so extraction is slow and iterative, and no public exploit code has been identified at time of analysis; EPSS scoring was not provided in the source data. This is a moderate-risk, authentication-gated data-disclosure flaw rather than a critical exposure.
Authenticated users of LubeLogger versions prior to 1.6.8 can copy other users' vehicle maintenance records into a vehicle they control, because the DuplicateRecordsToOtherVehicles endpoint authorizes the destination vehicle but never checks edit permission on the source vehicle. This exposes the contents of service, collision, upgrade, fuel, tax, supply, note, odometer, reminder, plan, inspection and equipment records, including attachment paths, and creates persistent attacker-held copies. The flaw is rated CVSS 3.1 7.1 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) and only matters on multi-user or household-shared instances; there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis. The vendor-released patch: 1.6.8.
Azkaban through 4.0.0 fails to enforce project-level permission checks in the ScheduleServlet fetchSchedule action, letting any authenticated user read the scheduling configuration of projects they do not own or have rights to. A logged-in attacker who supplies arbitrary project and flow identifiers can retrieve execution times, cron expressions, flow parameters, and notification email lists belonging to other teams. This is a read-only confidentiality exposure (CWE-862 missing authorization) with no code execution or data modification, exploitation requires a valid account (CVSS 3.1 PR:L), and no public exploit code or CISA KEV active-exploitation listing was identified at time of analysis.