Stack-based buffer overflow in the web management server of PLANET IGS-5225-8P2T4S industrial managed switches lets an authenticated remote attacker (PR:L) crash the device for a denial of service or, with greater effort, execute arbitrary code on the underlying operating system. Affected are V1 firmware before 1.2412b260707 and V2 firmware before 2.2412b260519; exploitation requires network reachability to the switch web interface, valid credentials, and high attack complexity (AC:H) to achieve reliable code execution, so a straightforward crash/DoS is the more accessible outcome. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis; vendor firmware fixes are available.
Missing per-object authorization checks in the King Addons for Elementor WordPress plugin (affected range 51.1.56 through versions before 51.1.81) allow an authenticated user holding at least the WordPress 'author' role to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media files belonging to other users, including administrator-owned media. The plugin's image-optimization actions gate access only on a coarse capability that authors already possess and never verify ownership of the targeted attachment, so no user interaction or non-default configuration is required beyond having the plugin active. Exploitation is bounded by the authenticated author-level prerequisite, but publicly available exploit code exists and a vendor patch (51.1.81) is available, so sites that issue author accounts to untrusted or numerous users - multi-author blogs, membership and community sites - should treat this as a genuine but lower-tier priority to remediate promptly.
Broken object-level authorization in the MasterStudy LMS WordPress plugin before 3.7.50 lets an authenticated user holding the Instructor role modify any order on the site through the plugin's order REST API, enabling free course enrolment, revocation of other users' paid enrolments, and tampering with order notes. The flaw is an IDOR (CWE-639) reachable remotely over the network with low privileges required and no victim interaction; publicly available exploit code exists, though there is no confirmation of active exploitation (CISA KEV). Our assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) places this at moderate severity, with the Instructor account requirement being the principal real-world constraint.
Information disclosure in Microsoft 365 Copilot allows an authenticated, low-privileged user within an affected tenant to retrieve content that should fall outside their authorization boundary, with the disclosed data potentially belonging to a different security authority than the attacker (scope change). Exploitation is network-reachable, low complexity, and requires no user interaction, but it is not unauthenticated - the attacker must already hold a valid low-privileged identity in a tenant where Copilot is enabled, per the assessed vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7). This is a Microsoft-hosted cloud service issue with no CISA KEV listing, no vendor-acknowledged exploitation, and no public exploit code identified at time of analysis; because remediation occurs server-side, the practical customer exposure window is the period preceding Microsoft's fix.
PHP object injection in Cotonti 1.0.0 allows authenticated users with comment-write permissions to pass attacker-controlled base64-encoded data through the cb (comeback) parameter of the comments plugin EditAction, which is then unserialized without an allowed_classes restriction. This can lead to arbitrary PHP object instantiation and, only if a viable POP gadget chain exists among loaded classes, escalation to file write or remote code execution. No public exploit code or active exploitation has been identified at time of analysis; the vendor has published a fix in PR #1897, and the vendor CVSS 4.0 score is 7.7, while the independent CVSS 3.1 assessment is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
SQL injection in IBM Guardium Data Protection 12.2 allows a remote, authenticated attacker holding only a low-privilege session to read sensitive information out of the product's backend database by supplying crafted input to a request parameter that is concatenated into a SQL command without neutralization. No user interaction is required and no public exploit code has been identified at time of analysis, so the practical risk depends on who can already reach the management interface - which is normally deployed on segmented internal networks, keeping broad internet-facing exposure low. Impact is confined to confidentiality (information disclosure); there is no integrity or availability effect, and only version 12.2 is named as affected.
Authenticated SQL injection in ManageEngine DataSecurity Plus builds before 6310 allows a technician-level user to execute arbitrary SQL queries through the Reports module, enabling read access to sensitive data stored in the application's backend database. The vendor assigns a CVSS 3.1 base score of 7.7 with a scope change (S:C), while our independent assessment rates it as scope-unchanged with high confidentiality impact only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires valid technician credentials and network access to the web console; no public exploit identified at time of analysis.
Authenticated SQL injection in IBM Guardium Data Protection 12.2 allows a high-privilege administrator to extract sensitive information from the appliance's underlying database by supplying malformed input to a specific application parameter that fails to neutralize SQL special elements. The attacker must already hold an authenticated management-console session with elevated privileges (CVSS PR:H), so exploitation is limited to trusted administrators or attackers who have already compromised admin credentials; no user interaction is required and the interface is network-reachable. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, making this a moderate-risk, targeted issue rather than a mass-exploitation candidate; a vendor patch is available.
Path traversal in IBM Guardium Data Protection 12.2 lets a remote authenticated attacker with a low-privilege account manipulate file paths to reach locations outside the intended directory, producing a high integrity impact alongside limited confidentiality and availability effects. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, base 7.6) confirms the flaw is network-reachable and low-complexity but gated behind a valid account, so exposure is bounded by the authentication requirement and the typically segmented management network these appliances sit on. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; IBM has published a vendor patch, so remediation is available.
IBM Guardium Data Protection 12.2 permits a remote authenticated attacker to bypass security restrictions through an improper authorization check, compromising integrity with limited confidentiality and availability impact. The flaw is network reachable at low complexity and requires a valid low-privilege session but no user interaction; no public exploit identified at time of analysis. Affected deployments should apply the vendor patch referenced in IBM support node 7288035.
Heap-based out-of-bounds write in OpenImageIO before 3.1.16.0 lets remote attackers corrupt memory whenever an application linked against the library reads a crafted 1-bit contiguous CMYK TIFF, a condition that maps to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H (7.6). The flaw is reachable unauthenticated from the network perspective of the file, but exploitation is limited by the requirement that a victim open or process the malicious image (UI:R), and only that narrow PhotometricInterpretation 5 / BitsPerSample 1 / planarconfig contig code path is affected. Vendor-released patch: 3.1.16.0; no public exploit identified at time of analysis, though the upstream fix commit ships a regression test using a crafted sample (crash-cmyk-1bit.tif) that documents the exact triggering structure.
Unauthenticated remote denial of service in Parseable versions prior to 3.0.0 allows any network-reachable client to crash request handling by sending a crafted x-amz-firehose-common-attributes header to the HTTP ingestion endpoint. Because the vulnerable unwrap() chain executes in src/handlers/http/middleware.rs before authentication, an attacker needs no credentials and no user interaction: supplying non-UTF-8 header bytes, malformed JSON, or a derived authorization/x-p-stream value that is not a valid HTTP header triggers a Rust panic, and repeated requests can deny service or drive the container into a restart loop. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the EPSS-style risk profile is elevated by the trivial, unauthenticated nature of the trigger; the vendor-released fix is Parseable 3.0.0.
Path traversal in IBM Cloud Pak for Data 5.1.2 lets remote, unauthenticated attackers read arbitrary files from the server filesystem by sending crafted URL requests containing ../ (dot-dot-slash) sequences. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a straightforward, low-complexity information-disclosure issue with high confidentiality impact but no integrity or availability impact; no public exploit code was identified at time of analysis. Only version 5.1.2 is named as affected, and IBM has published a vendor fix, so exposure is limited to unpatched, network-reachable deployments of that release.
A remote, unauthenticated attacker can exhaust the JVM heap and cause a denial of service by sending a small crafted image to any RESTEasy (JAX-RS) endpoint that consumes an image request body, because the framework's IIOImageProvider decodes the image through ImageIO without validating declared dimensions or pixel count. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a clean, low-complexity, availability-only flaw with no confidentiality or integrity impact, consistent with CWE-409 data amplification. Reachability is the key limiting factor: only applications that actually expose a resource method consuming image content types through the image provider are affected, and no public exploit code was identified at time of analysis.
Stack exhaustion in Apache Neethi before 3.2.4 lets an unauthenticated remote attacker crash the WS-Policy parser by supplying a policy document whose element nesting is deep enough to slip past Neethi's nesting-depth guard and drive unbounded recursion until the thread stack is exhausted. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) the impact is availability-only: no confidentiality or integrity loss, but a successful parse failure can take down the parser thread and potentially the hosting SOAP endpoint. The practical reachability condition is that the target application must actually hand attacker-controlled WS-Policy content to Neethi - typical of Apache Axis2 or CXF-based WS-* services that accept client- or peer-supplied policy - whereas deployments that only parse locally configured, trusted policy are not exposed; no public exploit code was identified at time of analysis and neither CISA KEV nor EPSS data accompanies this record.
Unbounded per-connection queue growth in Netty's WebSocketServerExtensionHandler lets unauthenticated remote attackers exhaust server memory (OutOfMemory) and cause denial of service in Red Hat products that bundle the affected Netty code, including AMQ Broker 7, AMQ Clients, Build of Keycloak, Build of Quarkus, Camel for Spring Boot 4, Camel 4 for Quarkus 3, Data Grid 8, Fuse 7, JBoss EAP 7/8, Single Sign-On 7, Apicurio Registry 3 and Debezium 3. The flaw carries CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - unauthenticated, no user interaction, availability-only) and is reachable only where a Netty-based server exposes a WebSocket endpoint that negotiates protocol extensions such as permessage-deflate to untrusted clients. No public exploit identified at time of analysis, and no CISA KEV listing; impact is confined to availability, with no confidentiality or integrity loss.
Denial of service in Apache Neethi before 3.2.4 allows unauthenticated remote attackers to exhaust server CPU and memory by submitting a small WS-Policy document that contains repeated policy references, which Neethi re-expands exponentially during normalization. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), with impact limited to availability - there is no confidentiality or integrity loss. Practical exposure is bounded: only applications that actually parse and normalize attacker-supplied WS-Policy (typically SOAP/web-service endpoints built on Apache Axis2 or CXF) are reachable, and no public exploit identified at time of analysis. This is a genuine but bounded availability risk, and upgrading to 3.2.4 removes the flaw.
Heap exhaustion in Apache Neethi versions before 3.2.4 lets unauthenticated remote attackers exhaust server memory by submitting a crafted WS-Policy document whose oversized policy assertion is copied into memory without being counted against Neethi's size limits, resulting in denial of service. The issue is availability-only (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and reachable only where an application actually parses attacker-supplied WS-Policy input, most commonly SOAP endpoints built on Apache Axis2 or CXF. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), so the practical risk is bounded by whether untrusted WS-Policy documents reach the parser.
Remote code execution in IBM MQ Java and JMS client libraries allows an authenticated attacker with access to a message queue or topic to bypass the deserialization allow-list filter in exception handling and execute arbitrary code on client applications. The flaw is network-reachable but requires low-privileged authentication (PR:L) and is limited to a specific exception-handling path (AC:H), with impact confined to the client process rather than the MQ server. No public exploit code was identified at time of analysis.
Unauthenticated SQL injection in the WCFM Marketplace (Multivendor Marketplace for WooCommerce) WordPress plugin affects all versions up to and including 3.8.2, allowing remote attackers to inject arbitrary SQL through the 'wcfmmp_user_location_lng' parameter and read sensitive data from the underlying WordPress database. Rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), the flaw requires no authentication, privileges, or user interaction, although practical reachability depends on the store actually exercising the plugin's location/distance-based shipping code path alongside an active WooCommerce install. No confirmed active exploitation (the issue is not in CISA KEV) and no public exploit code identified at time of analysis; an upstream fix commit is visible in the plugin repository, but a released patched version has not been independently confirmed.
Improper handling of HTTP/2 and HTTP/3 Extended CONNECT requests in Netty-based services can downgrade them to ordinary CONNECT requests, enabling request-smuggling or desynchronization in deployments where a fronting proxy and backend interpret the downgraded request differently. The issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning unauthenticated remote attackers can affect integrity, though the independent assessment raises attack complexity to High and scope to Changed and limits practical impact to proxy/gateway mismatches on endpoints that accept HTTP/2 or HTTP/3 Extended CONNECT. No CISA KEV entry or public exploit code was identified at time of analysis, so priority is moderate and conditional rather than urgent.
Denial of service in libheif versions prior to 1.23.2 allows unauthenticated remote attackers to hang or exhaust a decoding process by supplying a small but crafted HEIF/AVIF sequence file whose stts timing and edit-list metadata drive Track::init_sample_timing_table() to compute an output-sample count larger than the uint32_t counters used by Track_Visual::decode_next_image_sample() and Track::get_next_sample_raw_data(). The oversized count can never be reached, so decode and raw-sample loops fail to terminate and bypass the max_sequence_frames safeguard, while repeated Box_stts::get_sample_duration() calls and unbounded allocations of Chunk::m_sample_ranges and Track::m_presentation_timeline occur outside MemoryHandle accounting, producing severe CPU and memory exhaustion. Impact is availability-only (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; CWE-835), with no confidentiality or integrity effect; there is no public exploit code identified at time of analysis, and exploitation requires that the application actually exercises the multi-sample sequence decode path on untrusted input. Vendor-released patch: 1.23.2.
Unbounded remote-initiated stream creation in Netty's SpdySessionHandler allows an unauthenticated, network-positioned attacker to exhaust JVM heap and direct memory on any application that exposes a SPDY endpoint, producing OutOfMemoryError and a denial of service. The handler initializes localConcurrentStreams to Integer.MAX_VALUE and provides no API to change it, so no supported configuration knob reduces the exposure once SPDY is reachable; Netty 4.1.x before 4.1.138.Final and 4.2.x before 4.2.18.Final are affected, along with the Red Hat products that bundle those versions (AMQ Broker and AMQ Clients, Camel for Quarkus 3 and for Spring Boot 4, Keycloak, Quarkus, Debezium, Apicurio Registry, Data Grid, Fuse, JBoss EAP 7/8, and RH-SSO 7). Exploitation requires the target application to have explicitly wired the SPDY handler into its Netty pipeline, since SPDY is a deprecated protocol that is not enabled by default; there is no public exploit identified at time of analysis, and the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) reflects a low-complexity, availability-only denial of service with no confidentiality or integrity impact.
IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 contain a heap-based buffer overflow (CWE-122) that is triggered during queue manager startup when improperly validated cluster migration data is processed. The flaw is exploitable only by an authenticated attacker who can supply crafted migration data to a queue manager participating in MQ clustering, and the dependable outcome is a denial of service (queue manager startup failure or crash), with arbitrary code execution considered only potentially achievable. Independent assessment rates the realistic impact lower than the vendor's 7.5 score (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H), and there is confirmed no public exploit code and no CISA KEV listing - no public exploit identified at time of analysis. A vendor patch is available via IBM support page node 7287705.
Unbounded heap memory consumption in Netty's HttpServerCodec (io.netty:netty-codec-http) lets a remote, unauthenticated attacker drive a denial of service by exhausting server memory. An attacker who pipelines multiple HTTP/1.1 requests on a single connection and withholds reads prevents the internal methodOverflowQueue from being drained, so memory grows without limit; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is availability-only with no confidentiality or integrity impact, and no public exploit code was identified at time of analysis. Any HTTP/1.1 server built on the default Netty codec behavior is affected, and fixes ship in Netty 4.1.138.Final and 4.2.18.Final, with corresponding patched Red Hat product builds referenced through the Red Hat advisory.
Denial of service in Suricata's SMB parser allows remote, unauthenticated attackers to exhaust CPU and memory on a sensor by sustaining one-directional SMB traffic (including async-oneside flows), where force-completed transactions are retained and cleanup keeps waiting for inspection in the direction that never carries payload. Affected releases are Suricata before 7.0.17 and 8.0.0 through 8.0.5; the vendor fixed the issue in 7.0.17 and 8.0.6. Exploitation requires attacker traffic to transit a monitored network segment and to be sustained rather than a single packet, all exploitation signals indicate a genuine but moderate-priority availability issue, no public exploit has been identified at time of analysis, and EPSS is low (0.44%, 38th percentile).
Stack-based buffer overflow in the web management server of PLANET IGS-5225-8P2T4S industrial managed switches allows a remote authenticated administrator to crash the device or, with carefully crafted input, potentially execute arbitrary code on the underlying operating system. Affected devices run V1 firmware before 1.2412b260707 or V2 firmware before 2.2412b260519, and exploitation requires valid administrative credentials plus network reachability to the switch's management interface; the high attack complexity means many payloads will only produce a denial of service rather than code execution. No public exploit has been identified at time of analysis, and PLANET has released fixed firmware for both branches.
Quarkus HTTP security path-normalization discrepancy allows unauthenticated remote attackers to craft a URL that the security matcher treats as public while the dispatcher routes it to a protected endpoint, bypassing path-based authorization and reading sensitive data (CVSS 3.1 7.5, C:H/I:N/A:N). This affects deployments that rely on Quarkus HTTP security path-pattern policies to gate confidential endpoints; applications using only handler-level role or annotation checks are not bypassed this way. No public exploit identified at time of analysis.
Remote unauthenticated attackers can exhaust memory in Netty-based services that parse PROXY protocol v2, due to a reference-count leak in the handling of nested TLVs within HAProxyMessageDecoder, leading to denial of service. The flaw is an incomplete fix of upstream PR #16881, so partially patched deployments may remain vulnerable through the grandchild-TLV code path. It affects numerous Red Hat products bundling Netty, such as JBoss EAP 7, Keycloak, and Quarkus, and no public exploit code has been identified at time of analysis.
Denial of service in Apache Neethi before 3.2.4 lets unauthenticated remote attackers pin CPU for extended periods by supplying a crafted pair of WS-Policy documents to an application that runs them through Neethi's policy-intersection logic. The flaw is an uncontrolled resource-consumption issue (CWE-770) in which a small, carefully constructed input drives exponential work, and CISA's SSVC framework rates it automatable; no public exploit code has been identified at time of analysis. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), confidentiality and integrity are untouched and scope is unchanged, so practical exposure is limited to SOAP/web-services deployments that actually intersect untrusted, client-supplied policy documents.
Denial of service in Red Hat's Camel-based and Java middleware products (Red Hat Build of Apache Camel for Spring Boot 4, Red Hat Fuse 7, JBoss EAP 7, and Red Hat Single Sign-On 7): a STOMP frame that declares an oversized content-length is truncated from a 64-bit long to a 32-bit integer, yielding a wrapped/negative length that leaves the STOMP decoder unable to advance, so it loops indefinitely and burns CPU on the affected message-processing thread. The flaw is remotely reachable and unauthenticated per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), but exposure is strictly limited to deployments that actually enable a network-reachable STOMP listener - products without a configured STOMP endpoint are not attackable. No confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis.
Malformed HTTP/2 CONNECT stream injection in Red Hat JBoss EAP and the wider Red Hat middleware stack (Quarkus, Keycloak, Camel for Spring Boot 4 and Quarkus 3, Data Grid 8, AMQ Broker 7, Fuse 7, Apicurio Registry 3, Debezium 3) lets unauthenticated remote attackers control the :authority of an upstream HTTP/2 CONNECT when the product is deployed as an HTTP/1-to-HTTP/2 translating proxy or gateway. The client-supplied Host header from an HTTP/1 authority-form CONNECT is copied verbatim into the HTTP/2 :authority pseudo-header, so the fronting component and the HTTP/2 backend can disagree about the routing target, yielding an integrity impact (vendor CVSS 3.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N; our assessment raises the attack complexity to High and the scope to Changed because a H1→H2 CONNECT translation path and a fronting-proxy topology are required). No public exploit identified at time of analysis, and no EPSS or CISA KEV data was provided.
Remote, unauthenticated attackers can exhaust CPU and memory on Suricata 8.0.0 through 8.0.5 sensors by sustaining application-layer traffic on flows that are handled by a pass rule or a pass-the-flow exception policy, degrading the IDS/IPS to a denial-of-service condition. The defect is an inverted guard in AppLayerParserSetTransactionInspectId() that marks only already-inspected transactions as inspected, so on those pass-handled flows detection is skipped and completed transactions are never marked or freed, accumulating in the per-flow list and being rescanned with quadratic cleanup cost. Only availability is affected (C:N/I:N/A:H); the issue is fixed in Suricata 8.0.6, and no public exploit has been identified at time of analysis, with no CISA KEV listing.
Denial of service in Netty's MQTT decoder lets unauthenticated remote attackers exhaust server memory and CPU by sending a crafted CONNECT packet whose Properties Length is enormous while its Remaining Length stays small, bypassing the maxBytesInMessage guard that was added to fix CVE-2026-44248. The issue affects any Netty pipeline that runs io.netty.handler.codec.mqtt.MqttDecoder and exposes an MQTT listener; downstream Red Hat products such as AMQ Broker 7, Fuse 7, JBoss EAP 7, Red Hat Single Sign-On 7, and Red Hat Build of Apache Camel for Spring Boot 4 are listed as affected. No public exploit has been identified at time of analysis, and the practical risk is bounded by the need to expose an MQTT endpoint.
Unauthenticated SQL injection in WP Multi Store Locator Pro, affecting all versions up to and including 4.5.1, lets any anonymous visitor append arbitrary SQL to the plugin's store search query and read sensitive data from the underlying WordPress database, including user credential hashes and other plugin or core records. The vulnerable entry point is the store_locatore_search_radius parameter, handled by an AJAX action registered on wp_ajax_nopriv_make_search_request with no nonce or capability check, so the only prerequisite is that the plugin is installed and active on a default WordPress site. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; exploitation intelligence is thin, but the code path is trivially reachable and the numeric, unquoted SQL context defeats WordPress's addslashes-based request sanitization, which supports the assessed CVSS 7.5 (C:H, no integrity or availability impact).
Netty's codec-rtsp component silently normalizes away trailing control bytes in RTSP method tokens, so a wire request whose method token ends in a byte with code point <= 0x20 immediately before the separating space (for example PLAY\x00 or PLAY\r) is decoded as a fully successful PLAY request with decoderResult().isSuccess() == true and request.method() referencing the same cached singleton object, leaving the application layer unable to distinguish it from a clean PLAY. This is a remote, unauthenticated, low-complexity integrity flaw (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) affecting any product that embeds Netty and exposes an RTSP listener, including the Red Hat components named in the advisory such as AMQ Broker 7, AMQ Clients, Quarkus, Camel for Quarkus 3/Spring Boot 4, Keycloak, JBoss EAP 7/8, Single Sign-On 7, Data Grid 8, Fuse 7, Debezium 3, and Apicurio Registry 3. Real security impact is gated on a downstream disagreement: a front-end proxy, WAF, gateway, or access-control layer must parse the RTSP method differently from Netty for method/request smuggling to produce genuine integrity effects, and exposure is narrow because RTSP listeners are far less commonly internet-facing than HTTP. Exploitation status: no public exploit identified at time of analysis and no CISA KEV confirmation, though the upstream advisory itself documents a minimal wire-level reproduction at a high level.
Denial of service in Suricata 8.0.5 allows remote, unauthenticated attackers to degrade an IDS/IPS sensor's packet processing by sending crafted FTP command data. When a single large chunk of FTP commands exceeds the configured app-layer.protocols.ftp.max-tx limit, the FTP parser keeps allocating transactions and then repeatedly walks the oversized transaction list with quadratic cost, triggering the too_many_transactions event and driving CPU consumption that reduces monitoring visibility or stalls inspection entirely. Impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) and is confined to the single 8.0.5 release; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Suricata 8.0.0 through 8.0.5 can be degraded into a denial-of-service condition by a remote, unauthenticated attacker who streams repeated small brotli-compressed HTTP/1 responses through a single inspected flow. The HTTP/1 parser caps the decompression work done per transaction but does not cap how many compression bombs a flow may submit, so each transaction forces the Rust htp decompression path to burn CPU until packet processing slows and monitoring visibility is lost; availability-only impact, with no confidentiality or integrity effect (CVSS base 7.5, CWE-400). Exploitation is gated on the non-default response-body-decompress-layer-limit setting being enabled and on the sensor seeing attacker-influenced traffic, and no public exploit or in-the-wild activity is identified at time of analysis; the vendor fixed the issue in Suricata 8.0.6.
Denial of service in Suricata versions 8.0.0 through 8.0.5 allows unauthenticated remote attackers to exhaust sensor CPU and degrade packet-processing throughput by sending crafted DNS-over-HTTP/2 traffic. The HTTP/2 DoH parser retains previously processed DATA frame contents instead of clearing its internal buffer, so a series of DATA frames with the EndOfStream flag set repeatedly reprocesses old data while the buffer grows toward its 65 KiB limit, yielding quadratic CPU cost and potential loss of network monitoring visibility. No public exploit identified at time of analysis, and the flaw is not confirmed actively exploited (CISA KEV); vendor-released patch 8.0.6 closes the issue.
Unauthenticated remote connection flooding against the cockpit-tls front-end of Cockpit (the TLS terminator for the Cockpit web console, default TCP 9090) forces the service to spawn an unbounded number of detached threads, exhausting memory and file descriptors until the console degrades or becomes unavailable. The flaw, tracked as CWE-770 (allocation of resources without limits or throttling), carries a 7.5 CVSS score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects Cockpit as shipped in Red Hat Enterprise Linux 7, 8, 9, and 10 as well as Red Hat OpenShift Dev Spaces; the CVSS vector confirms the attack needs no authentication or user interaction. Exploitation is bounded to availability of the management console rather than the underlying host services, CISA's SSVC assessment records Exploitation: none (automatable: yes, technical impact: partial), and no public exploit code was identified at time of analysis. Because the primitive is simply 'open many concurrent TCP connections,' it is highly automatable and becomes a practical risk anywhere port 9090 is reachable from an untrusted network.
Heap exhaustion in Netty's Redis array aggregator, as shipped inside Red Hat products such as JBoss Enterprise Application Platform 7, Red Hat Fuse 7, Red Hat Build of Apache Camel for Spring Boot 4, and Red Hat Single Sign-On 7, lets a remote unauthenticated attacker crash the JVM by sending a tiny stream of nested RESP array headers. Because the decoder eagerly allocates an ArrayList sized to the declared array length before any child element arrives, roughly 12 KB of crafted input can reserve about 1.02 billion child slots when the default 1024-level nesting limit and default element limit are in effect; the impact is availability-only, with no data read or modified. Exploitation is limited to deployments that feed attacker-reachable, untrusted RESP/Redis-protocol traffic into the Netty codec with the default constructor; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Serialization of Node.js Buffer objects in the JavaScript library devalue 5.1.0 through 5.9.2 leaks unrelated process memory: when stringify, stringifyAsync, or uneval encounters a Buffer, it emits the view's entire backing ArrayBuffer instead of only the visible bytes, and because small Buffers are carved from Node's process-wide shared allocation pool, the serialized output can include up to roughly 64 KB of memory belonging to other in-flight requests. Any server-side-rendered application that serializes a Buffer into HTML without authentication - a SvelteKit or Nuxt page whose load() returns a small Buffer or reads a small file - can therefore publish another user's request body or Authorization header in a public response, and the flaw triggers on every such render because it occurs during serialization rather than parsing, so the library's parse/unflatten prototype-pollution and denial-of-service guards provide no protection. Unauthenticated remote attackers need no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5), the affected CPE is cpe:2.3:a:sveltejs:devalue:*, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Memory exhaustion in Netty's SMTP client response decoder (SmtpResponseDecoder) allows an attacker who controls or can intercept the SMTP server that an application talks to, to force that application to accumulate unlimited multi-line responses until heap is exhausted. The defect is a pure availability issue (C:N/I:N/A:H, CVSS 7.5, AV:N/AC:L/PR:N/UI:N) and is reachable without authentication or user interaction on the victim side, but exploitation is conditional: the vulnerable JVM must have Netty's SMTP client codec active and must establish an SMTP session with a hostile or man-in-the-middle peer, since only server responses are parsed. Shipping products affected through bundled Netty include Red Hat JBoss Enterprise Application Platform 7, Red Hat Fuse 7, Red Hat Single Sign-On 7 and Red Hat Build of Apache Camel for Spring Boot 4; no public exploit code has been identified at time of analysis and there is no confirmed CISA KEV entry.
Detection bypass in OISF Suricata before 7.0.17 and 8.0.6 lets an unauthenticated remote attacker who can craft an aligned IPv4/IPv6 flow pair make the engine treat the two flows as one, corrupting flowbit and IP-only state so signatures may fail to fire. The root cause is a family-blind comparison in src/flow-hash.c (CWE-697, CVSS 5.9, AV:N/AC:H/PR:N/UI:N/I:H), reflecting a targeted technique rather than opportunistic scanning because the attacker must line up raw address words, ports, protocol, VLAN, recursion level, live device and hash bucket across families. Impact is confined to the IDS/IPS's own detection-integrity logic - no host confidentiality or availability loss was assessed - and no public exploit code was identified at time of analysis, though vendor patches are available in 7.0.17 and 8.0.6.
SMTP command injection in Netty's netty-codec-smtp allows unauthenticated remote attackers to inject arbitrary SMTP commands via CRLF sequences in the command-name field, affecting applications built on Netty such as Red Hat Build of Apache Camel for Spring Boot 4, Red Hat Fuse 7, JBoss EAP 7, and Red Hat Single Sign-On 7. This is an incomplete fix of CVE-2025-59419, requiring attacker-controlled input to reach the SMTP command name and a downstream SMTP server that acts on smuggled commands; no public exploit identified at time of analysis. Integrity impact is high, while confidentiality and availability are unaffected.
Unauthenticated remote attackers can cause a gradual denial of service in applications that use Netty's STOMP codec by sending a STOMP frame body without the terminating null byte; StompSubframeDecoder leaks a ByteBuf for each such frame, so sustained traffic exhausts JVM heap or direct memory. The issue carries CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning network-reachable, no authentication or user interaction, availability-only impact. Red Hat middleware products listed in CPE data are affected when STOMP-over-TCP/WebSocket is enabled; no public exploit code or confirmed active exploitation was identified at time of analysis, and a practical DoS requires repeated frames rather than a single packet.
Unauthenticated arbitrary file read and server-side request forgery in NUUO Network Video Recorder 2.0.0 allow a remote attacker to submit a crafted url parameter via POST to up.php, causing fopen() to retrieve a local file (or remote/internal URL) whose contents are then staged under /tmp/ using a basename()-derived filename. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) is consistent with the description's no-authentication requirement, indicating a low-complexity, confidentiality-only flaw reachable by anyone with network access to the NVR web service. Publicly available exploit code exists (SSVC Exploitation: poc, Automatable: yes, Technical Impact: partial), but the CVE is not listed in CISA KEV, so active exploitation is not confirmed; EPSS is low at 0.20% (10th percentile), and practical exposure is further reduced because the fetched content is written to /tmp/ rather than returned inline and NVRs are typically deployed on segmented internal networks.
Apache Airflow versions before 3.3.2 gate the asset queued-events DELETE endpoints on the read-only Dag permission (GET) instead of the write permission (PUT), so any authenticated user holding Dag read access can delete a Dag's queued asset events and silently suppress that Dag's asset-triggered scheduling. Exploitation requires valid credentials with Dag READ but not Dag EDIT on the target Dag - the normal RBAC arrangement, since read is usually granted more widely than edit - and only matters where asset-triggered scheduling is in use; the assessed impact is integrity-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), with no confidentiality or host availability loss. No public exploit code or active exploitation was identified at time of analysis, and EPSS is low (0.17%, 7th percentile), though the bug is trivially reproducible by hand against the three affected REST routes.
Remote denial of service in osmo-iuh's HNBGW (Home NodeB Gateway) lets a network-reachable peer on the Iuh interface crash the process by sending a RANAP connection-oriented direct-transfer message carrying an arbitrarily sized NAS-PDU, which trips a reachable assertion in ranap_handle_co_dt(). Per the CVE description the affected range is osmo-iuh 1.10.0 through 1.14.5, although the ENISA EUVD entry lists a much narrower 0.1.0 <1.8.0 scope and the supplied CPE points at osmocom:osmo-bsc, so the exact affected version set should be confirmed against the vendor advisory. Impact is availability-only (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; SSVC Technical Impact: partial) with no confidentiality or integrity loss; there is no CISA KEV listing, no public exploit code identified at time of analysis, and EPSS is low at 0.17% (7th percentile).
An out-of-bounds read in Osmocom libsmpp34 allows remote attackers to disclose adjacent process memory when a crafted SMPP 3.4 PDU is passed to the smpp34_unpack() parser. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) describes an unauthenticated, low-complexity network-triggerable read with high confidentiality impact and no integrity or availability impact, meaning the practical effect is memory disclosure and potentially a crash rather than the broader 'memory corruption' implied by the description text. Risk is tempered by the library's niche deployment as telecom SMS/SMPP middleware, a low EPSS of 0.16% (5th percentile), and CISA SSVC rating of no known exploitation; no public exploit code was identified at time of analysis. A vendor patch exists, and the fixed boundary identified in EUVD advisory data is version 1.14.5.